Privacy Policy

Learn how Kiro collects, uses, stores, and protects your personal data.

Last updated: May 23, 2026

1. Introduction

Welcome to Kiro, a product made by Soumyadeep Dey (“we,” “our,” or “us”). We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website, services, and products (collectively, the “Services”).

By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our Services.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Email address
  • Password (encrypted)
  • Avatar preferences
  • Account creation date

2.2 Project Information

When you create monitoring projects, we collect:

  • Project name
  • Domain/website being monitored
  • Technology stack information (optional)

2.3 Monitoring Data (Collected via Beacon)

Our beacon script collects Real User Monitoring (RUM) data from your website visitors, including:

  • Network performance metrics (DNS time, TCP time, TLS time, TTFB, download time)
  • Page load performance metrics (Core Web Vitals: LCP, FCP, CLS, INP)
  • JavaScript errors and stack traces
  • Request details (URL, HTTP method, status code)
  • Connection information (connection type, estimated RTT, downlink speed)
  • Geographic data (country, city, latitude/longitude - derived from IP address)
  • ISP/Network information (ASN, ISP name)
  • Cloudflare datacenter code (colo)

Important: We do not collect any personally identifiable information (PII) from your website visitors. All data is anonymized and aggregated for performance analysis purposes only.

2.4 Waitlist Information

When you join our waitlist, we collect:

  • Email address
  • Geographic location (city, country, region)
  • IP address
  • User agent string (browser/device information)
  • ISP and network information
  • Referrer URL

2.5 Billing Information

When you subscribe to a paid plan, our payment processor (Dodo Payments) collects:

  • Payment method details (processed securely by our payment provider)
  • Billing address
  • Transaction history
  • Subscription status and plan details

We do not store full payment card details on our servers. All payment processing is handled by our PCI-compliant payment provider.

All fees are exclusive of applicable taxes. Refunds are not applicable; you may cancel your subscription at any time and retain access until the end of your current billing period.

2.6 Cookies and Analytics

We use essential cookies for authentication and session management. We also use Kiro Analytics, a privacy-focused analytics solution that does not use cookies and does not track personal data. Kiro collects anonymous usage statistics to help us improve our Services.

3. How We Use Your Information

We use the collected information for the following purposes:

  • Service Provision: To provide, maintain, and improve our monitoring and analytics Services.
  • Performance Analysis: To generate insights about your website's performance, errors, and user experience.
  • Account Management: To manage your account, authenticate your identity, and provide customer support.
  • Billing: To process payments, manage subscriptions, and send billing-related communications.
  • Alerts: To send you alerts about performance issues, errors, or threshold violations you configure.
  • Communication: To send important updates, security notices, and product announcements.
  • Legal Compliance: To comply with applicable laws, regulations, and legal processes.

4. Data Sharing and Third Parties

We do not sell, rent, or share your data with any third parties for marketing or advertising purposes.

We only share data in the following limited circumstances:

  • Service Providers: We use trusted third-party services to host our infrastructure (Cloudflare, Neon) and process payments (Dodo Payments). These providers only have access to data necessary to perform their services and are bound by strict confidentiality obligations.
  • Legal Requirements: We may disclose information if required by law, court order, or governmental regulation.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of that transaction. We will notify you of any such change.
  • With Your Consent: We may share information with third parties when you explicitly consent to such sharing.

5. Data Retention

We retain your data for as long as necessary to provide our Services and fulfill the purposes outlined in this Privacy Policy. Our data retention policies are as follows:

5.1 Monitoring Data Retention

Raw monitoring data (measurements, errors, vitals) is retained based on your subscription plan:

  • Free Plan: 30 days
  • Pro Plan: 90 days
  • Premium Plan: 365 days

After the retention period, raw data is automatically deleted through our automated cleanup process. Aggregated daily statistics may be retained longer for historical analysis and trend reporting.

5.2 Account Data Retention

Account information, project settings, and subscription details are retained for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as transaction records for tax compliance).

5.3 Waitlist Data Retention

Waitlist entries are retained until you create an account or request deletion. You may request removal from our waitlist at any time by contacting us.

6. Data Security

We implement appropriate technical and organizational security measures to protect your data:

  • Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
  • Access Controls: Strict role-based access controls (RBAC) and Row Level Security (RLS) policies ensure users can only access their own data.
  • Authentication: Secure authentication using Better Auth with encrypted tokens.
  • Infrastructure: Our infrastructure is hosted on Cloudflare and Neon, which provide enterprise-grade security.
  • Regular Audits: We conduct regular security reviews and monitor for suspicious activity.

Despite our efforts, no security system is impenetrable. We will notify you promptly of any data breach affecting your personal data in accordance with applicable law.

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your personal data (right to be forgotten).
  • Portability: Request transfer of your data to another service.
  • Restriction: Request limitation of processing of your data.
  • Objection: Object to processing of your data for certain purposes.
  • Withdraw Consent: Withdraw consent where processing is based on consent.

To exercise any of these rights, please contact us at contact@kiro-webb.vercel.app. We will respond to your request within 30 days.

8. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. We ensure appropriate safeguards are in place to protect your data when transferred internationally, including through the use of Standard Contractual Clauses approved by relevant authorities.

9. Children's Privacy

Our Services are not intended for individuals under the age of 13. We do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with personal data, please contact us immediately at contact@kiro-webb.vercel.app, and we will take steps to delete such information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date. For significant changes, we will provide additional notice via email or through our Services. Your continued use of the Services after such modifications constitutes your acknowledgment and acceptance of the modified policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: