Privacy Policy

Last updated October 8, 2026.

This policy covers kaight.ai: the public pages (models, tools, blog) and Kaight, the planning assistant. Kaight is in private testing and open only to invited testers.

If you only read the public pages

You do not need an account. We use Google Analytics to count visits, and nothing else tracks you. We do not use advertising cookies.

• Google Analytics. A Google script records the pages you visit, the site you came from, your approximate location, your device and browser, and how long you stay. Google receives this along with your IP address and stores identifiers in cookies (see Cookies). We send it the page’s path only, never the calculator inputs in the address. Google Signals and ad personalization are off. Analytics does not run on the sign-in, account or Kaight pages.
• Request logs. Our hosting provider records standard request logs: your IP address, the page requested, the time and your browser’s description of itself. They record the page without the calculator inputs in its address. We use them to run and secure the site, and the provider deletes them after 30 days.
• What you type into a tool. The calculators run on our server with the inputs you enter. The inputs are not saved. They travel in the page address, so they stay in your browser history and in any link you share, but our request logs leave them out. To answer quickly, the server keeps recent results in its memory for a while, never on disk, and loses them when it restarts. If you are signed in, your saved plan is never kept there.
• Sharing a calculator link. A link you share carries your inputs. The app you paste it into (a chat app or a social network) fetches the page and a picture of the result to show a preview. That picture never shows dollar amounts for a retirement plan or a portfolio review, and “Copy link without my amounts” scales every dollar figure so the link shows your ages and percentages but not your balances. We draw the picture on our server and keep the most recent ones in memory, with the inputs that drew them (the names you give accounts and other income or costs left out), until the day ends or the server restarts.
• No other outside services. The site serves its own scripts and charting library. Apart from Google Analytics, your browser talks only to kaight.ai while you read the public pages.

If you are an invited tester

Signing in, keeping a plan on My Plan and using Kaight store the following. My Plan needs no invitation to Kaight.

• Account: your email address. If you sign in with Google, we also store the name and account ID Google returns.
• Sign-in links: the address a link was sent to, when it expires and whether it was used. We store only a hash of the link itself.
• Nothing from the calculators, unless you save it: what you enter in a calculator stays in the page’s address. Your browser keeps the numbers you last ran in each calculator on your device, never sent to us, until you clear them or sign out (see the cookie policy).
• Your plan: the facts you give Kaight, enter on My Plan or save there from a calculator, such as ages, your accounts (each one’s type, value, the date you gave it, and its funds if you list them), income, savings rate, spending, Social Security, pensions, priorities and any notes about your goals, with the latest results of the analyses run on them (My Plan runs them again when you change your facts).
• Your conversations with Kaight, the notes it keeps about your plan between conversations (which you can see and delete), the results of the analyses it runs, and any portfolios you save. When you start a conversation from “Ask Kaight” on a calculator, it keeps that report, as shown and with its figures, without the names or labels you typed there, and deletes it with the conversation.
• Your check-ups: each time you check in on your plan, a dated record of its facts and results, of what changed since the last one, and of any note you add, so you can see how your plan has moved over time. If you change your facts on My Plan on the day of a check-up, that day’s record is taken again with them, and says so.

We also record how much each Kaight conversation uses (the number of words processed, as tokens, and what that cost us), never what was said, so we can keep Kaight free within a monthly allowance.

We use this to sign you in, run the analyses you ask for and keep your plan so you can return to it. We do not sell it or use it for advertising.

While Kaight is in beta, it is open by invite code, and entering a code means you agree that the Kaight team may read your conversations to improve Kaight. We record the code you used (so we can see who invited whom) and when you agreed. Every time someone at Kaight opens one of your conversations, we record who, when and why. To review many conversations at once, we may ask an AI model (Anthropic’s Claude) to analyse the ones that went wrong, without your name or email address. You can delete any conversation at any time.

If you rate one of Kaight’s replies or leave a comment on it, we keep the rating and the comment with the conversation, to see where Kaight needs work.

Who else receives it

These service providers receive data so that the site can work:

• The AI model provider that runs Kaight (currently Anthropic) receives your messages to Kaight, along with the analysis results, the facts from your plan and what your last check-up found, as the conversation uses them, so it can write Kaight’s replies.
• SendLayer sends the sign-in emails, the check-up reminders you ask for and the notice before an idle account is deleted, and receives your email address.
• Google is involved only if you choose to sign in with Google.
• Google Analytics receives the visit data described above, on the public pages.
• Railway hosts the site and its database, so all of the above is stored on its servers.

We will disclose information if the law requires it.

Cookies

Google Analytics sets its own cookies on the public pages to tell repeat visits from new ones. We set one cookie ourselves, and only when you sign in (or start signing in with Google). It holds your account ID (and, for the site’s own staff, a marker for the admin pages), is signed so it cannot be altered, is sent only over HTTPS and lasts up to 14 days. The cookie policy lists them all and explains how to opt out of analytics.

Keeping and deleting your data

We ask before we save your plan, the first time, in Kaight or on My Plan. After that we keep your account and plan until you delete them, and we delete accounts that have not signed in for two years. We email a month before; if that email cannot be sent, the account is deleted two months after the two years.

If you ask for check-up reminders on My Plan, we email you when a check-up is due, and once more two weeks later if it has not happened. A reminder holds the date and a link, never your figures, and every one has a link that stops them with no sign-in.

• Conversations are kept for 90 days after their last activity, so you can come back to them. Turn that off on your account page and each conversation is deleted a day after it ends. Your plan and its notes carry over either way.
• In Kaight you can delete each conversation, each note and each saved portfolio, or clear your whole plan (facts, holdings, notes, results and check-ups).
• On My Plan you can delete each check-up and each note, or delete the whole plan, which also withdraws your consent to keep one until you give it again.
• On your account page you can download everything we store about you as one file, and delete your account. That deletes your plan, check-ups, conversations, notes, saved portfolios and sign-in records at once. Two records with no content remain: usage counts (tokens and cost) with the link to your account removed, and the record of who at Kaight opened your data, which we delete 24 months after it was made.

Deleted data is removed from the live database immediately and from backups within 7 days.

Kaight removes what looks like a Social Security number, an account or card number, an email address or a phone number from what you type before saving it or sending it to the AI provider. It never needs them. Each conversation opens by saying that you are talking to an AI.

Security

Sign-in links work once and expire within minutes. We store only a hash of each, and delete it after 30 days. The session cookie is signed and sent only over HTTPS. Your plan and its check-ups, your conversations with Kaight, the results of your analyses and your saved portfolios are encrypted in our database (AES-256-GCM) with a key kept outside it, so a copy of the database alone does not reveal them.

If anyone at Kaight other than you ever opens your data, for example to review a conversation you chose to share with us, we record who opened it, when, and why. The record holds no content, and we delete it after 24 months.

Children

The site is not directed to children under 13, and we do not knowingly collect information from them.

Changes and contact

We will update this page when our practices change and change the date at the top. Questions: [email protected].