Skip to content

Legal · Privacy

Privacy policy

Last updated 2026-07-12

Kengo learns from your work, so the data boundary should be plain. Capture is permission-based and consented. The desktop app processes activity on your Mac, then sends structured activity and selected text to your Kengo workspace so your operator can remember and act.

The short version

  • You choose which macOS permissions to grant and can pause capture or revoke workspace consent.
  • Screen, accessibility, keyboard-interaction, and meeting features can produce content-bearing records—not only anonymous counts.
  • Kengo does not sell your data or use it to train Kengo models.
  • You can export your data or delete your workspace from account settings.

Account, integrations, and operator runs

  • Account details such as your email, name, workspace, region, and billing state.
  • Credentials for integrations you connect. OAuth credentials are encrypted at rest and are not included in data exports.
  • Integration content needed for the work you request, such as messages, documents, calendar events, and tool results.
  • Trace records for operator runs, including inputs, tool calls, outputs, usage, cost, approvals, and errors.

Browser extension capture

The optional browser extension can send canonicalized page visits and labeled interactions from supported web apps. Query strings and unstable identifiers are removed where the extension's canonicalization rules apply. Extension capture is separate from the higher-fidelity desktop lanes below.

Desktop capture

Depending on the permissions and features you enable, the Mac app can process:

  • Screen and OCR: visible on-screen text, foreground app, window or tab title, and browser URL.
  • Accessibility and input: element roles and labels, clicks, typing activity, and text associated with a captured interaction.
  • Meetings and voice: microphone or system audio and the resulting transcript, speaker, and meeting records when those features are enabled.
  • Derived activity: timestamps, dwell durations, routine signatures, pattern counts, and references used to deduplicate or explain a captured event.

Raw capture is processed on the device where possible. Structured records and relevant text sync to your cloud workspace after consent. Some meeting, transcription, and model features send the content needed to the configured cloud processor. Kengo does not claim that all captured content stays only on your Mac.

Public forms and email

  • Windows, Linux, and other desktop waitlists store the email, requested platform, form location, and submission time. They do not create a Kengo account.
  • The mobile “email me the Mac link” form sends one transactional message through Resend. Kengo does not add that address to a waitlist or marketing list.
  • Authenticated feedback stores the feedback text, category, current page URL, workspace, and user.

Processors and location

Kengo uses service providers for hosting and compute, Neon Postgres, model inference, transactional email through Resend, product analytics through PostHog, and error reporting through Sentry. The exact model provider can depend on your selected model and Kengo's managed routing.

Core workspace database records are stored in the workspace's configured region (Frankfurt for EU workspaces and a US Neon region for US workspaces). Some subprocessors may process limited data in other locations under their service terms; regional database placement is not a promise that every subprocessor operates only in that region.

Retention and controls

  • Captured observer events follow the retention limit shown for your plan and workspace settings. Current plan limits are 30, 90, or 365 days.
  • Pause capture from the Mac app or revoke workspace observer consent in observer settings. Revocation stops new observer-event ingestion; it does not automatically erase existing records.
  • Disconnect integrations from integration settings and remove devices from device settings.
  • Export your workspace data or soft-delete your workspace in account settings. Soft-deletion immediately stops normal product access and processing. Automated hard deletion is not currently active; email support@trykengo.com to request irreversible deletion.
  • Waitlist records are retained only for the requested platform notice until the relevant platform program closes or you ask us to remove the record. Email support@trykengo.com to remove a waitlist record or make another privacy request.

Changes and contact

Material changes to capture or processing will be explained in the product and may require renewed consent. Questions, access requests, corrections, or deletion requests can be sent to support@trykengo.com.