Privacy Policy

Last updated 27 October 2026

Kithe is a social platform where posts are permanent, each one is performed by a character, and each one is grounded in what its author has said before. That design decides most of what follows, so this policy is specific about it rather than general.

1. Who is responsible

Kithe is operated by Nirvan Labs, registered in the Netherlands (KvK 85770833), nirvanlabs.eu. Nirvan Labs is the controller of your personal data. Contact: support@nirvanlabs.eu

2. What we collect

Because you give it to us

• Your email address and password (stored hashed, by our authentication provider — we never see it). If you sign in with Google or another provider instead, we receive your email address and name from them, and never a password.
• Your display name and handle.
• Anything you choose to put on your profile: bio, pronouns, location, link, profile picture, cover image.
• Your date of birth. We keep it to check you are old enough to be here, and to pick an age band when a general character is drawn for you. The date itself is never shown to anybody.
• Your gender, if you choose to give one. It is used for one purpose — shaping a general character — and is never displayed.
• The posts, replies and corrections you publish.
• Your reactions, reposts, follows, mutes, blocks, muted words and reports.
• Your settings, including the three switches that decide where your character comes from.

Because you use the service

• When you signed up, and when you last used the service.
• Which posts you have liked or relayed, so the buttons can reflect it.
• Follow requests, and notifications generated for you.
• Errors the app runs into, with the screen and the message, so faults reach us at all. These are not behavioural analytics: nothing records what you looked at or for how long.

Derived by us from what you publish — see sections 4 and 5.

We do not collect contacts, location beyond what you type into your profile, advertising identifiers, or behavioural tracking across other sites. There is no third-party analytics or advertising SDK in the app.

3. Your picture, and the character drawn from it

Your character is the figure that performs your posts. It is not a photograph of you, and it is not a live likeness — but if you allow it, it is *drawn from* your profile picture, and that involves sending your picture outside our infrastructure. This section is the detail of that.

• Your profile picture is published when you upload it. It is not held for review. It is stored in a public bucket, which means anybody who knows or guesses its address can fetch it without signing in to Kithe. Treat it as public, because it is.
• Where your character comes from is your choice, in Settings. With "draw my character from my profile picture" on, your picture is used. With it off, or with no picture, you get a general character shaped only by the gender and age band you allow — shared with everyone else in the same band, so it is nobody in particular.
• Your picture is sent to a model provider to make that character: once to check it, and once as the reference the character is drawn from. See section 5 for who, and on what terms.
• Your character is stored in a public bucket too, addressed by a hash of what it was drawn from.
• Removing your picture, or turning that switch off, stops it being used again. It does not unmake a character already drawn; ask us and we will delete it.

Camera capture. The app contains code to compose a gesture from your camera, in which frames are converted to landmark measurements on your device and discarded, with no frame leaving it. That feature is currently switched off and unreachable, so at present the app does not use your camera at all.

4. What our models read on your device

Four models read your posts without the text leaving your device: sentiment, subject, stance, and a text embedding. What we store is the result:

• The subject a post appears to be about.
• A stance for the post, marked either as *yours* (because you answered the prompt about it) or as *the system's guess*. A guess is never displayed as your position, anywhere.
• A numeric embedding of the post, used to find things you have already said that bear on what you are saying now.
• Which model version produced each of these, so a later model cannot be mistaken for a change of mind on your part.

Summaries of your views on a subject quote sentences you actually published. We do not generate text describing what you believe, and a summary only draws on posts since you last changed your mind on that subject.

You can see everything said about you: your profile shows your own summaries and timelines exactly as another reader sees them. Nothing is inferred about you privately.

5. What leaves our infrastructure, and where it goes

Three things go to a model provider. They are the only ones.

The text of every post you publish. When you publish, the text is sent to OpenRouter, which routes it to a language model that returns how the post feels — an emotion, how strongly, and whether it is positive or negative. That reading is what decides how your character performs the post. We request routing only to providers that do not retain and do not collect what is sent to them.

Your profile picture, to check it. Before a character is drawn from your picture, the picture is sent to a vision model that answers one question: does it contain sexual content, gore, a hate symbol, or abusive text. If it does, no character is drawn from it — the picture itself is left exactly as you uploaded it, and Settings tells you it was not used. The answer is stored so the same picture is not sent again.

Your profile picture, to draw from. If the check passes, your picture is sent to an image model that draws the character's head from it.

Who they are. OpenRouter routes these requests to model providers. We ask for zero-data-retention routing and for providers that do not collect request data, which is a setting on every call we make; we cannot audit what a provider does beyond what it publishes. Generic characters — the ones not drawn from anybody's picture — are generated through Hugging Face from a text description only, with no personal data in the request.

One more automated check runs on our own servers. Every post is matched against a list of patterns for threats of violence and for publishing somebody else's private details. It is a pattern match, not a model, and it does not profile you — it looks at the words of the post in front of it and nothing else. A match does not delete or refuse anything: the post is held, you are told, and a person decides.

6. Why we are allowed to do this

Under the GDPR our lawful bases are:

• Contract — running your account, publishing your posts, delivering your feed, and drawing the character that performs them.
• Legitimate interests — keeping the service safe and working: moderation, abuse prevention, checking that a picture is fit to draw from, error reporting, and the grounding features that are the substance of the product. You can object; see section 9.
• Consent — drawing your character from your profile picture rather than from a general one, using your gender or age band to shape a general character, importing posts and connections from another platform, and identity verification if you ever request it. Each is a switch you control, and turning it off stops that use going forward.
• Legal obligation — responding to lawful requests, and keeping records we are required to keep.

7. Who else sees it

• Other people on Kithe. Your posts, profile, positions and summaries are public to signed-in users. Your profile picture and your character are public to anybody at all, as section 3 explains. Your email address, date of birth, gender, settings, mutes, blocks and reports are not.
• Supabase hosts our database, authentication and file storage as our processor, in the EU.
• Google Cloud hosts the website and the service that draws characters, in the EU.
• OpenRouter, and the model providers it routes to, receive what section 5 lists and nothing else.
• Hugging Face receives text prompts for generic characters, with no personal data in them.
• Your sign-in provider, if you use one — Google, Meta, LinkedIn or X — knows you signed in to Kithe. We receive your email address and name from them.
• Moderators, who are people on our team, see reported content, deletion requests, and posts held by the check described in section 5.
• Nobody else. We do not sell personal data and we do not share it for advertising.

We may disclose data where the law requires it. Where we are allowed to tell you, we will.

Accounts we run ourselves. Kithe operates automated accounts that post and reply. They are labelled "Bot" everywhere a person is named, they cannot enter live conversations, and they never follow a person. They read public posts as any reader does. They are not a way for us to collect anything.

8. How long we keep it

• Posts: indefinitely. They are an append-only public record — this is the point of the product, and section 3 of the Terms explains it. Removal is by review, not by deletion.
• Account data: until you delete your account.
• After account deletion: your profile and private data are removed, and your uploaded pictures are deleted from storage. A character already drawn from your picture is not deleted automatically — it stays in the public bucket until you ask us to remove it, and we will. Posts other people have replied to become tombstones that keep the author and the time but not the words, so conversations do not lose their shape. Backups roll off within 30 days.
• The answer about your picture, if one was ever refused: kept while the account exists, so the same picture is not sent for checking again.
• Identity verification evidence, if that feature is ever used: deleted after review unless you ask us to retain it.
• Moderation records: kept while the account exists, and for 12 months after a decision, so appeals and repeat behaviour can be assessed.

9. Your rights

You can:

• See it — Settings → Export your archive gives you a machine-readable copy of your data.
• Correct it — edit your profile; tell us if a summary or timeline misrepresents you.
• Delete it — Settings → Delete account, subject to the post-retention rules above.
• Object or restrict — email us and we will stop the processing we rely on legitimate interests for, unless we have a compelling reason not to, which we will explain.
• Withdraw consent — turn off the character switches in Settings, disconnect an imported account, or revert an import.
• Complain — to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the supervisory authority where you live. Please tell us first if you can; we would rather fix it.

We answer within one month.

10. Children

Kithe is not for people under 16, or under the local age of digital consent where that is higher. We ask your date of birth when you sign up and refuse an account below that age. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will remove it.

11. Where your data is

We are established in the Netherlands, and our database, our file storage and our servers are in the European Union. The model providers in section 5 may process a request outside the EEA. Where data is transferred outside the EEA, we rely on the European Commission's standard contractual clauses.

12. Security

Access to the database is enforced per-row: a rule in the database, not a check in the app, decides what each account can read and write. Passwords are hashed by our authentication provider. Traffic is encrypted in transit. Profile pictures and characters are deliberately public, as section 3 says; everything else is not.

No system is perfectly secure. If a breach affects your rights we will tell you and the regulator within 72 hours of becoming aware of it.

13. Changes

We will give at least 14 days' notice in the app before a material change takes effect.

14. Contact

support@nirvanlabs.eu