Privacy policy.

Kitegraph ("Kitegraph", "we", "us") provides a public data library and chart publishing service at kitegraph.com, app.kitegraph.com, and related subdomains (together, the "Service"). This policy explains what information we collect, why we collect it, and the choices you have. It applies to everyone who uses the Service, with or without an account.

1. Information we collect

Account information. When you create an account we collect your email address, which is your account identity. You may optionally add a display name. If you sign in with Google, we receive your email address from Google; we do not receive your contacts or any other Google data.

Content you create. Charts you build and save, their revision history, comments in a team workspace, brand assets you upload (logos, fonts, themes), and data you bring to the Service by pasting, uploading a file, or linking a Google Sheet or CSV URL. Linked URLs are fetched by our servers to render your charts.

Billing information. Payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers. We store your plan, a Stripe customer reference, and subscription status so the Service knows what you have paid for.

Usage information. We record product events on our own servers: sign-ins, saves, publishes, exports, renders, and API calls, associated with your account. We use this to operate the Service, enforce plan features, and understand what to improve. We do not use third party analytics services, advertising trackers, or session recording tools.

Technical information. Standard server logs, including IP addresses, which we use for security, debugging, and rate limiting.

2. How we use information

• To provide the Service: authenticate you, store and render your charts, process your data, and deliver your exports.
• To bill you for a paid plan and manage your subscription.
• To secure the Service: prevent abuse, enforce rate limits, and investigate incidents.
• To improve the product, using our own usage measurements.
• To communicate with you about your account: sign-in links, billing receipts, and material changes to the Service. We do not send marketing email without your consent.

Where the law requires a legal basis, we process your information to perform our contract with you (providing the Service you signed up for), for our legitimate interests in securing and improving the Service, and to meet legal obligations such as tax record keeping.

We do not sell your information. We do not share it with advertisers. We do not use your charts or your uploaded data to train machine learning models.

3. Published content is public

Publishing a chart creates a public share page and embed. Anyone with the link can view the chart, the data plotted in it, and any title, notes, source line, or byline you added. Your email address is never shown on published charts. Unpublished charts and uploaded data are private to your account and, if you are on a team plan, to your team workspace.

4. Cookies

We use one essential cookie: a session cookie that keeps you signed in across kitegraph.com and its subdomains. It is not used for tracking or advertising, and we set no third party cookies. If you clear it you are simply signed out.

5. Service providers

We share information with a small number of providers only as needed to run the Service:

• Stripe for payment processing and subscription management.
• Mailgun for delivering sign-in links and account email.
• Cloudflare for DNS, content delivery, and protection against network attacks.
• Google only if you choose to sign in with Google.

Each provider receives only what it needs for its function and is bound by its own privacy commitments. We may also disclose information if required by law, or to protect the rights, safety, or property of Kitegraph or its users.

6. Data retention

Your account, charts, and uploaded data are kept for as long as your account exists. Deleted charts are removed from your library immediately and purged from our systems thereafter. Product usage events are retained for about 90 days. Billing records are retained as required for tax and accounting purposes.

7. Your rights

You can access and update your account details in your account settings, and download the data behind your charts at any time. You may also request a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account and its content. Depending on where you live, including the EEA, the UK, and California, these may be legal rights. To exercise any of them, email [email protected] from your account address and we will respond within 30 days. Deleting your account removes your charts, uploads, and personal information; published charts you delete stop being served.

8. Security

All traffic to the Service is encrypted in transit. API keys are stored as one-way hashes and shown only once at creation. Access to production systems is restricted. No service can promise perfect security; if we learn of a breach affecting your personal information, we will notify you as required by law.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

10. International transfers

The Service is operated from servers in the United States. If you use it from elsewhere, your information is processed in the United States under this policy.

11. Changes to this policy

If we change this policy we will post the new version here and update the effective date above. For material changes we will also notify account holders by email. Continued use of the Service after a change means you accept the updated policy.

12. Contact

Questions about this policy or your information reach us at [email protected].