PrivacyPolicy.

01Who we are

KernelCode (“Kernel”, “we”) runs kernelcode.io, app.kernelcode.io, mcp.kernelcode.io and the Kernel APIs. This policy explains what personal data we handle and why. Contact us at legal@kernelcode.io.

02What we collect

• Wallet address. When you sign in with your wallet or pay with x402, your address identifies your Kernel account. We record when you last signed in.
• Sessions. A session cookie keeps you signed in for up to 14 days. We store only a hash of it.
• What you submit. Repository names and refs, contract addresses, the reports Kernel generates, and whether you shared or attested them.
• Proof data. For Kernel Prove: the source files sent to Aristotle, your specification, Aristotle’s task events, its property verdicts and its result archive.
• Aristotle API key. Stored encrypted (AES-256-GCM). A key you save stays until you remove it. Each proof gets its own encrypted copy, deleted when the run ends and never kept more than 48 hours.
• Kernel API keys. We keep only a hash of each key, its name and when it was last used.
• Payments. For x402 calls: the paying address, amount, network and transaction, which are also public onchain.
• Update sign-ups. If you use the form on kernelcode.io/access: your email, role, interests, optional note, whether you opted in to $KERNEL updates, and your approximate country (from Cloudflare’s request data).
• Technical data. Our hosting provider processes IP addresses, user agents and request logs to serve and secure the Services, and we keep application logs for debugging.

We do not use advertising or analytics trackers, and we do not sell personal data.

03How we use it

• to sign you in, run your scans and proofs, and show you your reports;
• to prepare attestations and process x402 payments;
• to prevent abuse, enforce rate limits and keep the Services secure;
• to email you about Kernel if you signed up, and about $KERNEL only if you opted in;
• to meet legal obligations.

04Who we share it with

Only the service providers Kernel needs to work:

• Cloudflare: hosting, database, file storage, containers and logs.
• Harmonic (Aristotle): for proofs, your source files and specification, sent with your own Aristotle API key. Harmonic’s own privacy terms apply to what it receives.
• GitHub: we download the public repositories you ask us to scan or prove.
• OSV.dev (Google): package names and versions from lockfiles, to look up known vulnerabilities.
• Alchemy, Blockscout and Sourcify: contract addresses and transactions, to read chain data and verified source.
• x402 facilitators (Priors for Robinhood Chain, x402.org for Base Sepolia): the signed payment authorization, so they can verify and settle it.
• Google Fonts and jsDelivr: your browser loads fonts and a graphics library from them, which shares your IP address with them.

We may also disclose data when the law requires it, or to protect Kernel, our users or the public.

05Public and onchain data

A report you share can be read by anyone with its link. An attestation, and every x402 payment, is written to a public blockchain (Robinhood Chain or Base Sepolia) together with your wallet address. Blockchain records are permanent: neither you nor we can edit or delete them, and deleting your Kernel account does not remove them.

06Cookies and local storage

The app sets one cookie, kc_session, to keep you signed in. It is HTTP-only and expires after 14 days or when you sign out. Wallet libraries in the app store your connection preferences in your browser’s local storage. The marketing site sets no cookies. There are no tracking or advertising cookies.

07How long we keep it

• Account data, reports and proof results: while you use Kernel, until you ask us to delete them.
• Sessions: up to 14 days. Unused sign-in nonces: a few hours.
• Per-proof Aristotle key copies: until the run ends, 48 hours at most.
• Update sign-ups: until you unsubscribe or ask us to delete them.
• Logs: for the limited period our hosting provider retains them.

08Your choices and rights

You can remove your saved Aristotle key and revoke API keys in the app at any time. To access, correct or delete your data, or to stop update emails, write to legal@kernelcode.io from the email you signed up with, or tell us your wallet address. We may ask you to sign a message to prove you control the wallet. We aim to reply within 30 days.

Depending on where you live, laws such as Singapore’s Personal Data Protection Act or the EU and UK GDPR give you rights to access, correct, delete, restrict or port your data, and to object to some processing. Where those laws apply, our legal bases are performing our agreement with you, our legitimate interest in running and securing the Services, your consent (for update emails) and legal obligations. You can also complain to your local data protection authority.

09Security

Keys and sessions are stored as hashes or encrypted, data travels over HTTPS, submitted code runs only through readers and the Aristotle SDK (it is never executed), and access to production systems is restricted. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

10International transfers

Our providers operate worldwide, so your data may be processed outside your country. Where required, we rely on our providers’ contractual safeguards for those transfers.

11Children

Kernel is not meant for anyone under 18, and we do not knowingly collect their data.

12Changes

We will post any update here with a new effective date, and give notice in the app or on the site for material changes.

13Contact

Privacy questions and requests: legal@kernelcode.io.