Privacy policy

Kiln collects only what running the product needs. That falls into four groups.

• Your account: the email address you sign up with, a name if you give one, and your password, which is stored only as a hash that cannot be turned back into the password.
• Your study material: the notes you write, the photos, PDFs, documents, slides and audio you attach to them, the transcripts, questions, flashcards and summaries Kiln generates from them, your answers in quiz sessions, your ratings of flashcards, your conversations with the tutor, and the mastery figures computed from all of that.
• Your plan: which plan you are on, your Stripe customer and subscription identifiers, and the state of your subscription. Kiln never sees or stores your card number; Stripe collects it directly.
• Technical records: the server logs Cloudflare keeps for Kiln, which include your IP address, browser type and the time and path of each request, used to keep the service running and secure, and Resend's record of the emails Kiln sent you.

• To run Kiln for you: keep your notebook, generate practice from it, quiz you, schedule your flashcard reviews, answer your questions about your material and show your progress.
• To bill you, if you subscribe, and to keep your plan's allowances in step with what you have paid for.
• To send you the emails the product needs: sign-in links, password resets, and notices about your account or these policies. Kiln sends no marketing email.
• To keep the service secure, find and fix faults, and prevent abuse.
• To answer a request you make about your data or your account.

Kiln does not use your information for advertising, does not sell or rent it, and does not share it with anyone for their own purposes.

When you ask Kiln to generate questions, flashcards or a summary, transcribe a recording, or answer a tutor question, the relevant note content, attachments and your question are sent to third-party AI model providers through OpenRouter, a service that routes requests to those providers. This happens only when you take one of those actions; nothing is sent in the background.

Kiln does not use your content to train models, its own or anyone else's. The model providers process your content under their own terms, which OpenRouter publishes for each model, and Kiln makes no promise about their handling beyond that.

What comes back is generated text. It can be wrong, incomplete or misleading, and it is not a substitute for your course material, your teachers or professional advice.

Kiln is built on services run by other companies. Each one handles your information only to do its part of the work, and only as much of it as that part needs.

• Cloudflare runs the application and stores your attachments, and its servers see every request.
• Neon hosts the database that holds your account, notes and generated material.
• OpenRouter and the model providers it routes to receive the content described under AI processing.
• Stripe takes payment and holds your card and billing details.
• Resend delivers the emails Kiln sends.

Beyond those, Kiln discloses personal information only when the law requires it, to protect Kiln or its users from harm or fraud, or as part of a sale or merger of the business, in which case the buyer takes on this policy's obligations. All of these services and Kiln itself operate in the United States, so your information is stored and processed there. If you use Kiln from elsewhere, you are transferring it to the United States, whose data protection laws may differ from those where you live; Kiln's contracts with each provider require them to protect it.

Kiln sets two cookies, both needed for the product to work: one that keeps you signed in, and one that routes your requests to the server holding your account's data. Neither is used to track you, and there are no advertising, analytics or third-party cookies. Blocking them means you cannot stay signed in.

• Your account and study material are kept for as long as your account exists.
• A file you start uploading but never attach to a note is removed automatically within a day.
• When you ask for your account to be deleted, your account, notes, attachments, generated material and progress are erased within 30 days of the request.
• Records of payments are kept for as long as tax and accounting law requires, and Stripe keeps its own records under its own policy.
• Server logs are kept for a short period for security and fault-finding and then discarded.

You can ask Kiln to tell you what personal information it holds about you, to correct it, to give you a copy of your study material, or to delete your account and everything in it. Send the request from the email address on your account to the contact address at the top of this page, and Kiln will answer within 30 days.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to object to or restrict processing and to complain to your data protection authority. If you are a California resident, the California Consumer Privacy Act gives you rights to know, delete and correct, and the right not to be discriminated against for using them; Kiln does not sell or share personal information as that law defines those terms.

Kiln is for people aged 13 and over. Anyone under 18 needs a parent or guardian's permission to use it. Kiln does not knowingly collect personal information from children under 13; if you believe a child under 13 has an account, write to the contact address and it will be deleted.

Every connection to Kiln is encrypted. Passwords are stored as hashes, and the credentials Kiln uses to reach other services are encrypted before they are stored. Access to production systems is limited to the people who run Kiln. No system is perfectly secure, and Kiln cannot guarantee that information will never be lost or accessed without authority; if that happens, Kiln will tell you as the law requires.

When this policy changes, the new version is published on this page with a new effective date. If a change materially reduces your rights or expands what Kiln does with your information, Kiln will email the address on your account before it takes effect.