Privacy Policy

At Kankali Context, we believe user privacy is an architectural requirement, not an afterthought. This policy explains our Self-Custodial & Zero-Retention Data Architecture.

1. Self-Custody Core Principle (Where Your Data Lives)

Unlike proprietary SaaS platforms that store your AI conversations and codebase notes in centralized databases, Kankali operates on a Self-Custodial model:

• Google Drive App Data: Context files are stored in your own Google account inside a private, hidden sandbox folder (spaces=appDataFolder) accessible only by you.
• GitHub Repository Vault: Context files are committed directly to your own private GitHub repository (e.g. username/context-vault).
• Zero Central Storage: Kankali servers do NOT host, copy, or maintain copies of your context documents, project files, or notes.

2. Zero AI Training Guarantee

We never use, sell, or process any context, code, memories, or prompts passing through the MCP transport layer to train AI models. All MCP requests are processed in-memory as stateless proxies directly communicating with Google Drive or GitHub APIs.

3. Data Collected & Encryption Standards

To facilitate authentication and API routing, we collect only minimal metadata:

• Account Identity: User email address and OAuth UID provided during Google Sign-in.
• OAuth Access & Refresh Tokens: Scoped strictly to https://www.googleapis.com/auth/drive.appdata (hidden AppData only; cannot read your personal Google Drive files).
• GitHub Personal Access Tokens (PAT): If connected, GitHub tokens are encrypted with AES-256-GCM using dedicated server encryption keys before storage.

4. Third-Party Access & MCP Flow

When you connect your Claude, Cursor, ChatGPT, or Grok assistant via our Model Context Protocol (MCP) endpoints (/mcp/master, /mcp/Drive, /mcp/git), requests are authenticated via signed time-limited Master Tokens (km_...) or OAuth 2.1 PKCE. Data flows directly between your AI client and your designated storage vault.

5. Open Source & Independent Verification

Kankali Context is 100% open source under the MIT License. You can inspect every line of code, verify token handling, or self-host your own instance on Oracle Cloud, VPS, or Vercel:

Inspect Public GitHub Repository (JBPATEL06/kankali-context) →

6. Account Deletion & Right to Erasure

You can revoke OAuth permissions at any time from your Google Account or GitHub Settings. Because files live in your own Drive/Repo, you retain complete physical control to delete your context files at any time.