Privacy, in plain words
Your private thoughts are not
an advertising profile.
This is the plain version, written to be accurate rather than reassuring. Nothing below is described as working unless it works today, and where there's a limit we say what it is.
Where things stand today
Kelven is live: you can create an account, adjust your privacy settings, see which model answered and what was shared with it, keep memory on your device or in your account, and export or delete everything. The formal privacy policy is published, and this page is the plain-language companion to it.
Stored
What Kelven keeps.
Your account
The email address you sign up with, and the record that you have an account.
Your memory, if you choose cloud memory
Preferences, projects and context you've asked it to remember — encrypted at rest, exportable and deletable by you.
Using Kelven
Account settings, subscription and payment status, usage records and the conversations you save in your account may be stored to run the service. Payment details are handled by our payment provider. Device-only memories and local replacement values remain on your device; when you use cloud AI, protected request content is sent to the selected provider. Privacy checks are not perfect.
Not stored
What it won’t do.
Conversation data as a business model
Kelven is intended to be paid for by the people who use it. Selling private conversations or behavioural profiles is not part of the plan.
A profile attached to every request
The design goal is the opposite: retrieve what's relevant to this request, send that, and nothing more.
Memory you can't see
Anything remembered should be viewable, editable and removable by you.
Memory
Where your memory lives.
Three options, each with an honest description of what it does and does not protect.
Memory is stored by Kelven. Relevant context still travels to the AI provider handling a request.
All three are available in Kelven today, chosen from the app and applied to every conversation until you change it.
Tokenization
The model answers
without knowing who.
Most reasoning doesn’t need real identities. Before a request leaves your device, Kelven finds the sensitive values in it and decides which ones the task actually needs. The rest become typed stand-ins — a person, a client, a company, a property — so the structure of your situation survives and the identities don’t.
The answer comes back about the stand-ins. Kelven puts the real details back locally, and the mapping is destroyed.
Credentials are a harder rule: passwords, API keys, recovery phrases, card and government numbers are removed outright and never sent anywhere.
This is minimisation, not invisibility. A provider still processes the abstracted request — and Kelven shows you exactly what that request contained.
- You
- Your device
- Privacy gateway
- Approved model
What you write
Jordan Lee runs Northstar Labs and needs to reply to client Casey Morgan about Project Aurora at a project site in Austin, Texas, where a delivery arrived damaged.
What the model receives
PERSON_1 runs COMPANY_1 and needs to reply to client CLIENT_1 about Project PROJECT_1 at a project PROJECT_2 in Austin, Texas, where a delivery arrived damaged.
5 values were replaced before the request left the device. The model reasons on the abstracted version; the real names are put back locally when the answer comes home.
Context
What travels with a request.
Kelven brings only the few useful details into a question and leaves everything else alone. The outside AI does not need your whole history to help with one task.
Nine of these memories stay where they are. Three are relevant to the request.
Your memory
Everything you've told it, at rest.
Local retrieval
Only the request decides what's relevant.
3 relevant memories
Not a profile. Three items.
Kelven
Assembles the minimum context needed.
The model that answers
Receives the request and that context.
Your internet address
Your connection is a return address.
Yours stays off the envelope.
Every time your device sends something out, it includes a number so the reply knows where to come back to. You never see it, but it barely changes from one hour to the next.
An IP address is like the return address on an envelope. It can reveal a rough area and help companies connect activity from the same internet connection.
When you ask Kelven something, Kelven does the asking. The AI company answers Kelven — it never receives your connection, so there is no signature of yours to match anything to.
The outside AI sees Kelven’s internet address, not yours
Without Kelven
You → the AI company. Your question, your name in it, and your connection all arrive together, and can be kept together.
With Kelven
You → Kelven → the AI company. The personal parts are removed on your device, and the request arrives from Kelven, from a connection that is not yours.
Kelven never keeps a readable copy of your connection either — for signed-out use it is turned into a short scrambled code that cannot be turned back, only used to stop abuse.
Straight answers
Four privacy promises worth explaining clearly.
“Nothing is saved” and “nobody sees it” are different promises
Kelven can keep nothing at all, and the outside AI still has to read the stood-in version of your question in order to answer it. Both things are true at once, and we'd rather say so.
Keeping memory on your device doesn't mean the answer is made there
It means we don't hold a copy. The part of it that's needed for the question still travels out, with your personal details standing in as placeholders.
Nobody can honestly call a cloud answer fully sealed
An AI has to be able to read something to answer it. Your stored information is encrypted, and so is everything in transit — but the wording sent out to be answered is readable at that moment.
How long things are kept depends on who answered
Different AI companies keep things for different lengths of time, and they change their rules. We state it where we can check it, with the date we last checked.
Status
Every privacy capability, with its real status.
One status vocabulary, used the same way across this whole site: Available — working in the product today. Beta — working, still being hardened — expect rough edges. Planned — designed and on the roadmap, not built yet. By arrangement — delivered as part of a contract, not self-serve.
- Available
Privacy controls
Choose which details Kelven protects, what stays on your device and whether a request can use cloud AI.
- Available
See what was shared
Every answer shows which AI answered, why it was chosen, and which details were replaced first.
- Available
Use your own AI account
Connect your own OpenAI, Google, Claude, Perplexity, or Meta account. Kelven still protects your request first.
- Available
Portable export
One structured export of memory, preferences, projects and instructions that you keep.
- Beta
Local processing
Retrieval, classification and sensitive-data detection run on your device; on-device answering works on supported hardware.
- By arrangement
Kelven Private
Organisation-controlled credentials, private memory infrastructure, retention rules, routing policies, allowlists and audit logs.
- Planned
Connected applications acting for you
Approved external actions carried out on your behalf, inside the ceilings you set.
Your data is not our business model.
If improving Kelven ever involves your content, that will be an explicit choice you make — not a line in a policy document. Questions we haven’t answered here are worth asking directly.
The formal privacy policy governs; this page is the plain-language description of what Kelven does with data.