privacy

01who we are

kenn.pro is run by kenn, an individual based in the united kingdom. for anything in this policy, "we" means kenn and "the service" means kenn.pro, its subdomains, and the third-party apps hosted under kenn.to that sign you in with your kenn.pro account.

02what we collect

account. when you sign in with google, github or discord we receive the id of your account there, your email address, your display name and your avatar. we store these against your kenn.pro account. we never receive or store your password for those services.

username. the username you choose on first sign-in.

sessions. when you sign in we create a session and store a hashed token for it, when it was created, when it expires, and the browser it came from.

presence. while you have kenn.pro open, your browser tells us whether the tab is active and which app it's showing, so that friends can see you're online. this is held in memory only and is gone the moment you close your last tab.

content. anything you create in an app: notes, clips, posts, uploads. what each app stores is described in that app.

roles. which roles your account holds, who granted them and when.

logs. our servers keep request logs with your ip address, the page requested and the time, for a short period, to keep the service running and to spot abuse.

03why we collect it

• to sign you in and keep you signed in
• to identify you to other people on the service by your username
• to run the features you use, including showing whether you're online
• to keep the service secure and to investigate abuse
• to contact you about your account if we need to

we don't use your data for advertising, we don't build profiles of you, and we don't sell or rent it to anyone. under uk gdpr our lawful basis is performance of a contract for running your account, and legitimate interests for security and logs.

04cookies

we set these cookies, all strictly necessary, so no consent banner is needed:

• __Host-kenn_session, which keeps you signed in. it lasts 30 days and is only ever sent to kenn.pro itself; the other things you sign in to with kenn get their own sign-in from it.
• __Host-kenn_device, a random name for this browser, so the sessions page can show which sign-ins are the same device and you can end them together. it lasts two years and says nothing about you.
• kenn_login and kennect_interaction_… (one for each sign-in under way), which last a few minutes during sign-in to protect the process against forgery, then are removed.

we use no analytics or advertising cookies, and no third-party trackers.

05who else sees it

sign-in providers. google, github and discord see that you signed in to kenn.pro using them, under their own privacy policies.

infrastructure. our servers are at hetzner in germany. media files and backups are stored with cloudflare r2 in the eu. web traffic for some of our domains passes through cloudflare's network. each of these is a processor acting on our instructions.

other users. your username, avatar, roles and online status are visible to other users of the service. content you post is visible according to the settings of the app you posted it in.

the law. we'll disclose data if a valid legal process requires it, and we'll tell you unless we're prohibited from doing so.

nobody else.

06where it lives

your data is stored and processed in the european union and the united kingdom. sign-in providers may process the data they hold about you elsewhere under their own terms.

07how long we keep it

• account data: until you delete your account
• sessions: until they expire or you sign out, at most 30 days
• presence: not stored at all beyond the moment
• request logs: up to 30 days
• backups: rolling copies for up to 30 days, after which deleted data is gone from those too
• role history: kept while the account exists, so questions like "why did i lose plus" can be answered

08your rights

under uk gdpr you can ask us to show you the data we hold about you, correct it, export it in a usable format, delete it, restrict or object to how we use it. deleting your account removes your account, identities, sessions and roles and unlinks your content; each app describes what happens to content you created there. to exercise any of these, email us. we'll reply within a month. if you're not happy with how we handle it you can complain to the information commissioner's office at ico.org.uk.

09children

you must be at least 13 to use the service. we don't knowingly collect data from anyone younger, and we'll delete it if we learn we have.

10changes

if this policy changes in a way that matters we'll say so on the site before it takes effect. the date at the top is the version you're reading.

11contact

anything about your data: [email protected].