Privacy policy

Version 2026-11-10 · effective 10 November 2026

Kanuko is a connector for AI assistants such as ChatGPT and Claude. It searches small, independent products listed on Kanuko and, when you ask, sends requests to them for you. This policy covers kanuko.in, docs.kanuko.in and the Kanuko connector at mcp.kanuko.in. It explains what we collect, why we collect it, how long we keep it, and the choices you have.

The short version: we collect as little as we can, we don't read or store your chats, we never sell your data, we don't use advertising or tracking cookies, and you can download or delete your data yourself at kanuko.in/account.

1. Who we are

Kanuko (operator details to be added) is the data fiduciary for the personal data described here. For any privacy question or request, write to privacy@kanuko.in. Grievances under India's Digital Personal Data Protection Act, 2023 (DPDP Act) go to our grievance officer at grievance@kanuko.in.

2. What we collect

When you sign in

• Account details: your name, email address and an account id, received from our sign-in provider when you sign in with Google, GitHub or email.
• Consent records: which version of these terms and this policy you accepted, and when.
• Sign-in sessions: a hashed session id, when the session started and was last used, your browser's name and version, and a one-way hash of your IP address. We use these to keep you signed in, to show you where you're signed in, and to detect misuse.

When your assistant uses Kanuko

• Usage records: which Kanuko tool was used, when, which assistant app (for example ChatGPT or Claude), how long it took, how many results came back, and a few normalized search keywords (for example "internship" or "python"). The filters you used are recorded too: category, location, job type and product. If you're not signed in, these records carry a one-way hash of your IP address instead of your account id.
• Product call log: for each call Kanuko makes to a product, we record the product, the action, the names of the fields sent (for example "email") and whether the call worked. We never record the values.
• Clicks: links in results pass through Kanuko so we can count visits per product. We record which product's link was opened and when.

If you list a product

• Your domain, the contents of your kanuko.json, the contact email in it, the results of our checks, and our review notes.
• Any API key you give us for your product. It is stored encrypted (AES-256-GCM) and is never shown to anyone, including AI assistants.

What we don't collect

• Your conversations. We don't receive or store your chats or your full messages, only the tool requests your assistant sends to Kanuko.
• The personal details you choose to send to a product, such as your name, email or resume. We pass them through and keep only the field names (see section 4).
• Payment details, precise location, contacts or device identifiers.

3. Why we use it

• To provide Kanuko, with your consent: running searches, calling products, signing you in, and showing developers their own product's statistics.
• To keep Kanuko safe and lawful: preventing abuse with rate limits and audit logs, investigating reports, and meeting legal obligations. These are legitimate uses under section 7 of the DPDP Act.
• To improve Kanuko: understanding which searches return nothing, which products help, and how fast things are, using the usage records above.

We don't sell personal data. We don't use it for advertising, and we don't build profiles of you for anyone else.

4. Personal details you send to products

Some actions, such as applying for a job, need details like your name, email or resume. Before Kanuko sends any of them, your assistant must tell you which product will receive which fields, and you must agree. Kanuko sends only the fields that action needs and doesn't keep their values. Once a product receives them, that product is responsible for them under its own privacy policy, which you can find on its website. Products listed on Kanuko are independent businesses. We review every product before listing it, but we don't control them.

5. Who we share it with

• Service providers who process data on our behalf and under contract:
  • WorkOS, for sign-in. It is based in the United States.
  • Supabase, for our database. It is hosted in Mumbai, India.
  • Fly.io, for application hosting. It runs in Mumbai, India.
• Product developers see only aggregate numbers for their own product, such as how often it appeared and was clicked. They never see who you are.
• Authorities, when Indian law requires it.

Because our sign-in provider is in the United States, your account details are transferred there. We transfer data only to countries the Government of India has not restricted under section 16 of the DPDP Act.

6. How long we keep it

• Usage records, click records and product call logs: 12 months. Older records are deleted automatically every day.
• Sign-in sessions: they expire after 7 days of inactivity or 30 days at most, and are deleted 30 days after that.
• Account details, consent records and submissions: until you delete your account. After deletion, usage records are kept only as anonymous counts until they reach the 12-month limit.
• Records we must keep by law are kept for as long as the law requires.

7. How we protect it

All traffic uses HTTPS. Session ids, setup tokens and IP addresses are stored only as one-way hashes. Product API keys are encrypted. Sign-in cookies can't be read by scripts. Access to production data is limited to the people who run Kanuko. If a personal data breach happens, we'll inform affected users and the Data Protection Board of India as the law requires.

8. Your rights and choices

• See and download your data: any time, at kanuko.in/account, as a JSON file.
• Correct it: your name and email come from your sign-in account, so update them there and they'll update here the next time you sign in. Or write to us.
• Delete it and withdraw consent: delete your account at kanuko.in/account. You can also remove the Kanuko connector from your assistant at any time. Withdrawing consent doesn't affect anything done before you withdrew it.
• Nominate someone to exercise these rights if you die or become unable to: write to us.
• Raise a grievance with our grievance officer at grievance@kanuko.in. We'll respond within 30 days. If you're not satisfied, you can complain to the Data Protection Board of India.

9. Children

Kanuko accounts are for people aged 18 and over, and we ask you to confirm your age when you sign up. If you believe a child has given us personal data, write to privacy@kanuko.in and we'll delete it.

10. Cookies

We use only the cookies needed to sign you in, and no analytics or advertising cookies. One local-storage value remembers that you've seen the intro animation; it never leaves your device. See the cookie policy.

11. Changes

If we change this policy in a way that matters, we'll update the version at the top, and signed-in users will be asked to review and accept it before continuing. Earlier versions are available on request.