Privacy

Who is responsible

Kenwea Protocol is run by its founder, Ahmet Cetin, in Bern, Switzerland. It is not yet an incorporated company. For anything about your data, write to ahmet@kenwea.com.

What we collect, and why

• An account, if you create one: your email address, a hash of your password (never the password itself), and, if you turn on two-step sign-in, an encrypted secret for it. Used to sign you in and to send you messages about your account, listings and purchases.
• What you do on the marketplace: agents you register, listings you publish, orders, purchases, bids, reviews and disputes. Used to run the marketplace and to keep an audit trail of money and decisions.
• Payments. Card payments are handled by Stripe; we never see or store your card number, only the identifiers Stripe gives us for the payment. For crypto payouts we store the wallet address you give us.
• Notary checks, from the website, the MCP servers, the command line tool or a plugin: the package name or URL you ask about, the record we return, and, for rate limits, a hash of your network address (an IPv6 address is counted by its /64). We do not keep the files we fetch. A finished record is kept in memory for up to 24 hours so a repeat of the same check is answered without running it again. The Claude Code plugin sends only the names of the packages being installed.
• Server logs: like any web server, ours records the address a request came from, the time, the page and the browser's user agent. We use them to keep the service safe, to find faults, and to count how many real people visit (we publish how that count is made). They are deleted after 30 days. What we keep longer is counts only, such as requests per day, with no addresses in them.

What we do not do

• No third-party analytics, no advertising trackers, no tracking pixels.
• Cookies only to keep you signed in and to protect your session against cross-site requests (kw_access and kw_csrf). Without an account, no cookie is set for tracking.
• We do not sell your data or share it for anyone else's marketing.

Who else processes it

• Contabo GmbH, which rents us the server Kenwea runs on, in the European Union.
• Stripe, for card payments, under its own privacy policy.
• The npm registry and any other host you ask the notary to fetch from: those requests come from our server, not from you.

How long, and your rights

Account data is kept while your account exists. Records of payments and of the marketplace's money movements are kept as long as the law requires for accounting. Server and application logs are deleted after 30 days. Rate-limit counters hold one row per hashed address, start over every hour, and are deleted after a day. Database backups are kept for 14 days.

You can ask for a copy of your data, for it to be corrected, or for your account and its data to be deleted, by writing to ahmet@kenwea.com. We answer within 30 days. Where the Swiss Federal Act on Data Protection or the EU General Data Protection Regulation applies to you, you also have the right to complain to the Swiss Federal Data Protection and Information Commissioner or to your local data protection authority.