Privacy

What we store

Almost nothing. kerf.box is account-free — there is no login, no password, no user database, and no API key to issue. We hold no record that you used the product.

• Your kerfs stay in your browser. Strategy artifacts you save go to your own browser's localStorage — they never reach our servers. They live on the device that created them; clearing your browser storage removes them. To move a kerf elsewhere, export it as JSON and import it on another device.
• Transient request metadata. To operate per-IP rate limits and debug failures, we may briefly process the endpoint, status code, timing, and a derived rate-limit key for each request. Secrets are scrubbed from logs before anything is written, and we do not build a profile of you across requests.

What we never hold

• Your AI provider key (BYOK). When you pass a key — any provider, via the X-Provider / X-Api-Key headers or the legacy X-Anthropic-Key header — it is used for that single request and never persisted, logged, or proxied anywhere we can read it. In the web app it lives only in your own browser's storage; clearing the field removes it for good.
• Accounts. There are none. We never ask you to sign up, so there is no identity, email, or login record to hold in the first place.
• Payment details. kerf.box is free — there is no subscription and we do not process payments, so we never see or store a card number. You pay your AI provider directly for the inference you run with your own key.
• Your data, for sale. We do not sell or rent personal data, and we don't run third-party advertising trackers on the app.

Third-party processors

We rely on a deliberately small set of infrastructure providers: Vercel (hosting) and the AI provider you choose (model inference — Anthropic, OpenAI, Google, Moonshot, Alibaba, DeepSeek, Groq, OpenRouter, or your own endpoint). Your inputs are sent to that provider only to generate the response you requested — billed to your own key. There is no authentication provider and no database, because there are no accounts and we store nothing server-side.

Your choices

Your saved kerfs are yours to manage directly: delete any entry — or clear the whole archive — from the archive page, or just clear your browser's site data. Because there is no account and we hold nothing server-side, there is no profile to request the deletion of. Questions go to the issue tracker.