Legal

Privacy Policy

Last updated October 7, 2026

If you join the waitlist, we keep your email so we can tell you about early access. Beta invitations use separate access records. Website analytics stay off unless you choose Accept, and optional structured security-improvement sharing is a separate choice that is currently disabled.

Who we are

Kalyxo is operated by Wend Labs Inc., doing business as Kalyxo ("Kalyxo", "we", "us"). Wend Labs Inc. runs kalyxosec.com and is responsible for the data described on this page.

Kalyxo is a Mac app, currently in early access, that checks what AI agents do on your computer. This policy covers kalyxosec.com, the waitlist, and the cloud services used by the app for adjudication and selected source review.

Questions about this policy go to privacy@kalyxosec.com.

What we collect

When the app uses cloud review

Kalyxo makes cloud requests for eligible uncertain actions and selected package source reviews. Local hard blocks do not require a cloud request. Before a report leaves your Mac, Kalyxo redacts secret and identifying patterns, masks local paths, and checks the result for residual secret patterns. If that check fails, it sends no report. Redaction reduces exposure but may not remove every sensitive detail.

A Stage-D review report can include a summary of your instruction to the agent, a redacted excerpt of untrusted content the agent encountered, the proposed action, guard signals, and structured information about where instructions came from. A source review can include redacted source text, a package name, and sanitized static evidence. The cloud service uses this material to decide whether to allow, hold, or block the action. The report is sent to Kalyxo's Cloudflare adjudication service, which may send the bounded report to Microsoft Azure AI Foundry for model review.

For enrollment and request authentication, the service receives and stores an install identifier, a public signing key, and an entitlement identifier. Each signed request also carries a timestamp, a replay-prevention nonce, and a signature. The service records replay nonces temporarily to reject reuse, deleting expired nonce records during later claims. The signing key is public and contains no private key material.

The service stores per-install, per-route daily request counts for Stage-D and supply review. It also keeps service-wide daily route counts. Older daily counter rows are deleted when a later day's count is reserved. The service stores no adjudication report or source-review payload in its database and returns responses with no-store caching directives. The app checks signed responses before applying them.

The install identifier, public key, entitlement identifier, and consumed invitation record remain in the enrollment store after enrollment or revocation; the current service code does not define a deletion period for those records. Cloudflare processes request network data to deliver and protect the service. Microsoft Azure AI Foundry processes report material when a model review is needed. This policy does not state a retention period for that provider's processing.

These app records are separate from website waitlist and white paper records described below. Joining the waitlist does not itself enroll an app installation.

When beta invitations are enabled

The current Project Tools internal build uses selected folder MCP tools. It does not use the app enrollment or cloud adjudication flow described above, and training collection remains disabled.

For an internal-test download, an administrator supplies a tester contact email and private label. The email is encrypted in the access record and is not used to sign the tester into the app. Kalyxo stores invitation expiry and revocation, the fixed release version and hash, download request counts and reserved byte totals, and the Beta terms version, server acceptance time and random acceptance receipt. The tester must select an unchecked box on the invitation page to accept the Beta Access Terms before the one-time invitation can be redeemed or a download session can start. The receipt is evidence of acceptance, not an access credential. Invitation and download capabilities are random and stored as hashes. Capability values never appear in request URLs. Acceptance does not enable optional analytics or telemetry.

An internal-test download does not issue a pairing code, create a beta identity, or enroll GuardCore protection. If a separate production beta identity flow is offered in the future, it may verify a signed Google identity assertion and bind an opaque entitlement to an install signing key. Such a flow is not part of the internal-test download described here. Downloading alone does not enroll protection or create a GuardCore lease.

These operational records support access, security and download recovery independently of optional marketing analytics. Cloudflare processes connection IP addresses and other network metadata at its edge to deliver and protect requests. The Worker uses keyed network identifiers for short-lived rate limits and does not write raw connection IP addresses into Beta records. Cloudflare may process or retain network metadata under its service and account settings; Kalyxo has not verified account-level log retention for every Cloudflare setting. Owner-only latest-build downloads require an allowlisted Google session and use a random ticket whose hash is stored server-side and whose raw value is held in an HttpOnly cookie, never in the request URL. The ticket stops working after five minutes; its expired hash is removed by scheduled retention. Beta event records older than 90 days are removed by that task. Invitation, encrypted email and acceptance receipt records remain until deliberate owner deletion; there is no automatic deletion period for them. Contact privacy@kalyxosec.com for a deletion request. Interrupted downloads reserve bytes even when transfer fails, so counters do not prove completed downloads or active installations.

Optional structured security-improvement data

Kalyxo may offer a separate optional choice to share de-identified structured guard outcomes for security-model improvement and training. The choice is unchecked by default and is distinct from required terms, cloud adjudication and local diagnostics. Accepting required terms or website analytics does not opt you in, and declining does not turn off local diagnostics. This collection is disabled in the current deployment and will remain off until the policy and server controls have been verified.

If enabled, each upload contains only these closed-vocabulary categories: guard outcome, decision, finding class, broad agent type, scope, surface, authorization state and user-feedback signal. It excludes prompts, commands, other text or content, paths, host names, secrets, persistent device or account identifiers, per-event identifiers and client timestamps.

Cloudflare necessarily processes source IP addresses and other network metadata at its edge, including to derive a short-window rate-limit key. The application does not write the source IP or account, device, event or batch identifiers into training objects. R2 objects have server-side creation metadata, and edge metadata, request timing or batching may make records correlatable; we do not describe them as fully anonymous. The checked-in Worker configuration requests invocation logging and traces off. Kalyxo has not verified that the deployed Worker uses those settings or checked all account-level Cloudflare logging and retention settings.

Each successfully stored record has a random, one-use deletion receipt that can be used to request deletion while the source object is retained. Source objects expire after 30 days, with lifecycle processing taking up to about one additional day. If an upload succeeds but its response is lost, you may not receive a receipt; the object still expires on that schedule. If a record has already contributed to trained model weights, Kalyxo cannot guarantee that its individual contribution can be removed from those weights.

When you join the waitlist

• The email address you type into the form. To read the technical white paper we also ask for your first and last name, so we know who has a copy.
• Which button opened the form: the navigation bar, the end of the page, a direct link to the form, the white paper page, or the form shown when JavaScript is off.
• The approximate country Cloudflare derives from your request, and your device type (desktop, mobile or tablet).
• Only if you accepted analytics: the campaign tags in the link you arrived from (utm_source, utm_medium, utm_campaign) and the domain of the site that referred you, so we know which channels bring people to the waitlist.
• The date and time you joined.

When you read the white paper

• We email you a private link to read the paper. We record when that link is first opened and each later time it is opened, so we know the paper reached you.
• If you arrived from a link someone shared with you, we record who shared it, so we can see how the paper spreads. We do this with a share code, never by matching you across other sites.

To prevent abuse

For each waitlist submission, Kalyxo's application store keeps a salted one-way hash of your IP address for 24 hours so it can limit repeated submissions. After 24 hours the hash is deleted. Kalyxo does not store the raw address in its application records. Cloudflare separately processes source IP and other connection metadata at its edge. Short rate limits on the waitlist, the analytics endpoint and our admin tools use a salted hash of your address, or of its network prefix for IPv6, held in memory for about a minute.

Analytics, only with your consent

Website analytics run only if you click Accept on the consent prompt. They record aggregated events:

• Page views.
• Which parts of a page or document you viewed, and how long you spent on each, kept as aggregate totals and not tied to you individually.
• Whether the waitlist form was opened or submitted.
• How long the page stayed open, in broad ranges such as 10 to 30 seconds.
• How fast the page loaded and how smoothly its animation ran, in broad ranges.
• Which cited sources were clicked, recorded as the source's domain.

Each event stores the event name, the page path, the domain of the referring website (without the rest of its address), the campaign tags in the link you arrived from, if any, your approximate country, your device type (desktop, mobile or tablet), and the date. Events are stored as daily counts, not as individual visits, and the events from one visit are usually sent together in a single request.

If you click Decline, nothing is recorded.

What the website never collects

• Advertising cookies or cookies used for cross-site tracking.
• Raw IP addresses as fields in Kalyxo analytics or training objects. Cloudflare separately processes source IP addresses at its edge as described above.
• Device or advertising identifiers through the website.
• Data for cross-site tracking.
• Request logs of our own.

How we use it

• App cloud review: to authenticate enrolled installations, prevent replayed requests, enforce daily route limits, and adjudicate eligible actions and source reviews.
• Waitlist details: to email you about early access and Kalyxo's launch, to grant and confirm access to the technical white paper, and, infrequently, to send updates about major milestones.
• White paper name and reading activity: to send your private link, to know who holds a copy, and to understand how the paper spreads when readers share it.
• The IP hash: to limit repeated submissions.
• Analytics events: to understand how people find and use the site, which campaigns work, and whether the page loads quickly and runs smoothly.
• Optional structured security-improvement data, if activated: to improve security models using the closed-vocabulary categories described above.

We never sell your data, and we never share it for anyone else's marketing. Every email we send includes a way to opt out. You can ask us to delete your waitlist entry at any time by writing to privacy@kalyxosec.com.

Legal bases (GDPR and UK GDPR)

• Consent for analytics.
• Separate consent for optional structured security-improvement data, if that feature is activated.
• Your request for the waitlist: you ask to hear about early access, and we use your email to do that.
• Legitimate interests for abuse prevention and site security, and for understanding where waitlist demand comes from (the country and device type stored with a signup).

Cookies and your choices

Kalyxo uses first-party cookies for site functions such as white-paper reading, admin sessions and invite-only Beta downloads. We do not use advertising cookies or cross-site tracking cookies.

Until you make a choice, a consent prompt asks whether to allow website analytics. Click Accept to turn on the analytics described above, or Decline to keep them off. Unless you choose Accept, no optional website analytics are recorded. This choice does not control the separate structured security-improvement choice, which is currently disabled.

Your choice is saved in your browser's local storage under the key kalyxo-consent-v1, so the site can remember it.

To change your mind, use the Privacy choices link in the footer of any page. It clears the stored choice and shows the prompt again.

Cloudflare, which hosts the site, may also set strictly necessary security cookies, for example __cf_bm, to filter automated traffic. These are distinct from Kalyxo's first-party cookies. The consent prompt applies to website analytics only; it does not enable structured training data collection.

Who processes your data

Cloudflare hosts the site and stores data using Cloudflare Workers, Cloudflare D1, plus Cloudflare R2 for private app builds and, if the optional structured-data feature is later activated, structured source objects. Cloudflare processes source IP addresses and other network metadata at its edge to deliver and protect requests. The checked-in Worker configuration requests invocation logging and traces off. Kalyxo has not verified that the deployed Worker uses those settings or checked all account-level Cloudflare logging and retention settings.

Everything the site loads, including fonts, scripts and images, is served from kalyxosec.com. The site makes no third-party requests. There are no ad networks and no social pixels.

The landing page cites third-party statistics and news and links to their sources. That content belongs to its publishers. If you follow one of those links, you leave kalyxosec.com.

How long we keep website data

• Waitlist entries: until you ask us to delete yours, or until we no longer need it for early access and launch updates.
• Waitlist IP hashes: 24 hours, then deleted.
• Analytics records: deleted after 24 months.
• Structured training source objects, if the feature is activated: expire after 30 days, with lifecycle processing taking up to about one additional day. A deletion receipt can be used before expiry.
• Your consent choice: stays in your browser until you clear it or use Privacy choices.

For app cloud review, replay nonce records are removed after expiry when a later nonce is claimed. Daily route counter records from earlier UTC days are removed when a later day's counter is reserved. Enrollment records, including the install identifier, public key, entitlement identifier, and consumed invitation record, have no deletion period defined in the current service code. The Worker does not store report or source-review payloads in its database. We do not state a retention period for processing by Microsoft Azure AI Foundry.

International processing

Cloudflare runs a global network, so your data may be processed in the United States and in other countries.

Your rights

You can:

• Access the data we hold about you.
• Correct it if it is wrong.
• Delete it.
• Object to how we use it.
• Withdraw consent for analytics at any time.

To access, correct, delete or object, email privacy@kalyxosec.com. To withdraw analytics consent, use the Privacy choices link in the footer.

EU and UK visitors

You have the rights above under the GDPR and UK GDPR. You can also complain to a data protection authority, such as the one where you live.

California residents

Kalyxo does not sell or share personal information, as those terms are defined under the CCPA and CPRA. You can use the rights listed above by emailing privacy@kalyxosec.com.

Children

This site is not directed to children under 16, and Kalyxo does not knowingly collect their data. If you think a child under 16 has joined the waitlist, email privacy@kalyxosec.com and ask us to delete the entry.

Security

• All traffic to the site uses HTTPS.
• Access to stored data is limited to the Kalyxo team.
• Kalyxo's waitlist store keeps only a salted hash of an IP address for 24 hours. Cloudflare separately processes source IP addresses and other network metadata at its edge.

If you find a vulnerability, report it to security@kalyxosec.com. Our Security page explains scope and how we handle reports.

Changes to this policy

When this policy changes, we update the date at the top of this page.

Contact

• Privacy questions and requests: privacy@kalyxosec.com
• Security reports: security@kalyxosec.com

Wend Labs Inc., doing business as Kalyxo. https://kalyxosec.com