Kelbie holds sensitive data. What you weigh, what you take, what you write on a hard day. Here's how we protect it.
This page describes what we actually do, in plain language. It isn't a legal document or a compliance certification. It's a description of the practices behind the privacy promises we make elsewhere on the site. We'll update it as our practices evolve.
Where your data lives
Kelbie runs on servers operated by DigitalOcean, located in the United States. Your data stays in the US unless you take an explicit action to move it — like exporting a file to your own device.
We don't use third-party analytics services that collect your behavior inside the app. We don't use advertising trackers. The small amount of data we collect about how you use Kelbie (page views, basic actions) stays on our own servers.
How it's protected
Encrypted in transit. All communication between your browser or device and our servers is encrypted using TLS 1.3. If someone intercepts the connection between you and Kelbie, they see scrambled bytes, not your data.
Encrypted at rest. The database that stores your logs, journal entries, and account information is encrypted at the storage layer. If the physical hardware were somehow compromised, the data on it is not directly readable.
We do not claim end-to-end encryption. Kelbie's servers need to be able to read your data to generate insights, send you the Sunday Letter, and respond to your journal entries. True end-to-end encryption would make those features impossible. We think the honest tradeoff is worth naming.
Passwords. Your password is hashed using bcrypt, an industry-standard algorithm designed specifically for password storage. We cannot see your password, recover it, or tell you what it was — only reset it. If someone were to obtain our database, the hashed passwords would be computationally impractical to reverse.
Authentication. Kelbie uses JWT-based authentication with session management. You can enable time-based one-time password (TOTP) two-factor authentication on your account — we strongly recommend it, especially because Kelbie holds information about your health.
Rate limiting and abuse protection. Login attempts, account creation, and API calls are rate-limited to prevent brute force attacks and automated abuse. Our servers are protected by a web application firewall and automated intrusion protection that blocks repeat offenders.
Security headers. The Kelbie website and app send modern security headers (CSP, HSTS, X-Frame-Options, and others) to reduce the risk of cross-site scripting, clickjacking, and other browser-based attacks.
Who can access it
Production database access is restricted to system administrators. Access requires a strong password, two-factor authentication, and leaves a log. We do not have customer support staff, contractors, or interns with the ability to read your journal entries. We do not share database credentials over Slack, email, or any other unsecured channel.
The only humans who can technically see your data are the ones building Kelbie, and they only do so when strictly necessary — investigating a bug you reported, responding to a support request that requires it, or maintaining the infrastructure. We do not browse user data for any other reason.
When AI generates insights
When Kelbie writes a daily response, a daily observation, or the Sunday Letter, we send data to our AI service provider to generate the response. We send:
- An anonymized summary of the logs relevant to the insight
- Relevant themes from your journal entries — not the raw text, except when you're asking a direct follow-up about something you specifically wrote
We do not send your name, your email, or any account identifier. Per our agreement with our AI provider, the information we send is not retained after your response is generated, is not used to train any AI model, and is not shared with any other party.
Email and transactional communication
Emails from Kelbie — beta invites, account confirmations, security notices, the Sunday Letter — are sent through Resend, our email delivery provider. Our domain is authenticated with SPF, DKIM, and DMARC records so that messages claiming to be from kelbie.ai can be verified as genuinely from us.
If you ever receive an email from kelbie.ai that looks suspicious, forward it to security@kelbie.ai and we'll investigate.
Backups and recovery
We run regular backups of user data so we can recover from hardware failure, data corruption, or accidental deletion. Backups are encrypted and stored separately from the primary database. When you delete your account, your data is removed from the primary database within 30 days and from backups within the retention window described in our privacy.
What we don't do
Some things are worth saying by their absence:
- We do not sell, rent, or trade your data to anyone.
- We do not use your journal entries or logs to train AI models.
- We do not run third-party advertising or tracking on our site or app.
- We do not allow customer support staff to read your journal entries, because we do not have any.
- We do not share your data with data brokers or analytics companies.
If something goes wrong
No system is perfectly secure. If we discover a security incident that affects your data, we commit to:
- Notifying affected users within 72 hours of confirming the incident
- Telling you clearly what happened, what data was involved, what we did about it, and what you can do
- Being honest about what we know and what we don't, rather than issuing vague or minimizing statements
We notify users even when the law doesn't strictly require us to. Your trust depends on transparency, and so does your ability to protect yourself after a breach.
Reporting a vulnerability
If you believe you've found a security vulnerability in Kelbie, please email security@kelbie.ai. We take reports seriously, we respond to every legitimate one, and we commit to:
- Acknowledging your report as quickly as we can
- Working with you in good faith to understand and address the issue
- Not pursuing legal action against researchers who disclose vulnerabilities responsibly
We don't currently offer a paid bug bounty program. What we can offer is a genuine thank-you, credit (if you want it) once the issue is resolved, and our full attention to fixing it. As Kelbie grows, so will our security program.
Questions
Email security@kelbie.ai for anything related to how we protect your data. A human will read it and write back.