Krater Pro
Trust, in plain language

Privacy Notice

Effective July 27, 2026

Krater Pro is built to make its data boundaries understandable. This notice explains what the hosted Cloud Lab handles, why it handles it, and what leaves it when you ask Kimi K3 for help.

1. Scope

This notice applies to the hosted Krater Pro Cloud Lab and its account, project, and inference features. The local Krater Pro CLI and IDE run on your computer and have different data flows determined by how you configure and use them.

2. Data Cloud Lab handles

Account records

Cloud Lab stores your normalized email address, a password-derived hash, its unique salt and iteration count, and account timestamps in Cloudflare D1. Before the salted 100,000-iteration PBKDF2-SHA256 step, the service keys the password with HMAC-SHA-256 using an independent deployment secret. That pepper is held in the service environment and is not stored in D1. Cloud Lab does not store your plaintext password or the pepper alongside account records. Existing password hashes depend on that pepper; losing or replacing it prevents password verification unless an account migration has been planned.

Virtual projects

Cloud Lab stores project names, virtual file paths and contents, the active file path, saved user and assistant chat messages, and project timestamps. These are virtual scratch projects; Cloud Lab does not read your device filesystem or Git repositories.

Essential session data

After authentication, Cloud Lab sets an essential session cookie that lasts for up to seven days. The cookie is marked Secure, HttpOnly, and SameSite=Strict. The database stores a hash of the session token, its account association, and issue and expiry times—not the raw cookie token.

Abuse-prevention records

Registration, login, project-mutation, key-validation, and chat routes use temporary rate limits. The database stores secret-salted hashes derived from the requesting IP address, the normalized login email for a separate IP-independent login bucket, and, for signed-in routes, the account identifier, plus the rate-limit scope, time window, count, and expiry. The application does not store the raw IP address or raw login email in its rate-limit table.

Your Krater.ai API key and inference payloads

Your Krater API key is transient request data. The Krater Pro application code does not write it to D1, browser storage, application logs, project snapshots, or responses, and does not echo it back to the page. The page keeps a connected key only in memory until you leave or reload the page, log out, or close it. Cloudflare necessarily processes the encrypted request as the hosting provider, so its independent infrastructure practices also apply.

Each inference request sends your supplied API key to Krater.ai together with your prompt, bounded context from your saved virtual files (with the active file considered first), and a bounded portion of recent saved project chat. Krater.ai processes that information to generate the response.

3. How the data is used

The hosted service uses this data only to:

  • create and authenticate your Cloud Lab account;
  • save, load, update, and delete your virtual projects;
  • protect authentication and inference routes from automated abuse;
  • send an inference request to Krater.ai when you explicitly ask the agent; and
  • operate, secure, diagnose, and maintain the service.

Cloud Lab does not include advertising pixels, behavioral advertising, or product-analytics scripts. Krater Pro does not sell your account or project data.

4. Service providers and disclosures

Cloudflare

Cloudflare processes hosting, network, security, cookie, and database traffic for the Pages application and D1 database. Cloudflare may handle operational network data under its own service terms and privacy practices.

Krater.ai

Krater.ai receives the API key and inference payload described above only when you validate a key or submit a chat request. Your use of its API, model, account, and paid plan is also governed by Krater.ai’s own terms and privacy practices. Review those practices before sending sensitive material.

Required disclosures

Information may be disclosed when reasonably necessary to comply with a valid legal obligation, protect users or the service, or investigate abuse. No disclosure can make a model prompt appropriate for secrets; avoid submitting credentials, private keys, or regulated data.

5. Retention and deletion

  • Account and projects: retained in the active service until you delete individual projects or delete your account.
  • Sessions: tokens stop authorizing requests at expiry. Logout removes the current session row. Expired rows, including short rotation-overlap rows, are removed opportunistically during authenticated traffic or through operational cleanup. Account deletion cascades to all associated session rows.
  • Rate-limit records: cease being used after their short security windows. Expired hashed records are deleted opportunistically when later protected traffic runs; without later traffic, they may remain until operational cleanup.
  • Krater API keys: not retained by this application.

Deleting your account removes the account, projects, and sessions from the active service through database cascade deletion. Temporary IP-derived security records are not linked to an account; they cease being used after their short security window and are removed opportunistically by later protected traffic or operational cleanup.

Cloudflare D1 Time Travel may retain prior database snapshots for Cloudflare’s applicable limited disaster-recovery window after active deletion. Those historical snapshots are not used for ordinary Cloud Lab access. If a disaster-recovery restore reintroduces data that had been deleted, it will be removed again when the restoration is discovered or when you report it.

6. Your choices

You can delete a virtual project, clear its saved chat, log out, or remove your account from the active service through the Cloud Lab account menu. You can disconnect an API key by leaving or reloading the page, logging out, or closing it. Use public GitHub Issues only for non-sensitive questions. For a request involving your identity or private details, contact the maker privately through LinkedIn first; never include passwords or API keys.

7. Security boundaries

Cloud Lab uses bounded inputs, same-origin mutation checks, secure session cookies, independently peppered and per-user salted password hashing, hashed session tokens, per-account project access checks, and a restrictive content security policy. No Internet service can promise absolute security. Use unique account credentials and do not place secrets in virtual files or prompts.

8. Changes and contact

This notice may change when Cloud Lab’s features or data flows change. Material updates will appear on this page with a revised effective date.

For non-sensitive questions, use Krater Pro GitHub Issues. For a privacy request involving your identity or private details, contact Supratim privately on LinkedIn first. Never send passwords or API keys through either channel.