Privacy Policy
Effective 29 August 2026 · Last updated 30 August 2026
Kibble counts what your coding agents spent. It does not read what they wrote.
The collector on each machine sends token totals, model names, opaque session ids and repository names. It never sends prompts, file contents, tool arguments, file paths, hostnames or hardware ids. That is not only a promise: the collector is open source, and the server rejects any request carrying a field it does not expect.
01Who we are
Kibble is operated by Nhan Duc Nguyen, a sole proprietor in Japan, at usekibble.com and app.usekibble.com. In this policy, "Kibble", "we" and "us" mean that operator.
For anything in this policy, including access, correction and deletion requests, write to hello@usekibble.com. Our postal address is given without delay on request to that address.
Where the GDPR applies, we are the controller for the account data described below, and we act as a processor on your organization's instructions for the usage data your engineers' machines push to us. Where the Japanese Act on the Protection of Personal Information applies, we are the business operator handling that data.
02What the collector sends
The collector is the CLI your engineers install (npm install -g @usekibble/cli). It reads the usage logs the coding agents already write on the machine and pushes one summary per day, per agent, per model. Every field it can send is listed here.
| Field | What it is |
|---|---|
| date | The day being summarised. |
| agent | The tool that ran, for example claude-code or codex. |
| model | The model name the agent reported. |
| token counts | Input, output, cache read, cache write and reasoning totals, plus a message count. |
| cost estimate | Those counts priced at the vendor's published list rates, as an integer. |
| session ids | The opaque identifier the agent already assigned to a session, so a session is not counted twice. It is a random string, and it carries nothing about the conversation. |
| repository name | The name of the checkout the session ran in, for example web. The name only: never the path, never the remote URL, never the contents. A branch name is stored and is not shown anywhere in the product. |
| device | A label for the machine, its operating system family, and a random identifier the collector generated on first run and keeps in ~/.config/kibble/device.json. It is a number the machine chose, not a fingerprint: no serial, MAC address or hardware id is read to produce it. |
What it never sends: prompts, replies, file contents, diffs, tool arguments, file paths, directory names, environment variables, hostnames, IP addresses gathered on the machine, hardware identifiers, or a list of the software installed. The server's ingest schema is strict, so a request carrying a field outside the list above is refused rather than trimmed.
Widening that list would mean changing the collector in public. If it ever changes, this page and the source change with it.
03What the dashboard holds
Your account
Sign-in is Google only. From Google we receive the name, the email address Google has verified, and the profile picture URL on the account you choose. We store those, a session record for the browser you signed in with, and the role and team you hold in your organization. We never receive your Google password.
Your organization
The organization name, its members and their roles and teams, invitations that have been sent (the invited email address, who sent it, when it expires), and the plan it is on.
Usage
The rows in section 02, per member and per day, together with derived counts such as sessions, and, where the agent reports them, non-content activity signals such as lines added or removed and commits.
Billed usage from your own vendor account
If an owner adds your organization's Anthropic Admin API key on the settings page, we read your Claude Console's usage and cost reports on your behalf every hour, so that billed truth can replace our estimates. The key is verified once, then stored encrypted (AES-GCM) and never shown again beyond its last four characters. An owner can clear it at any time. It is your organization's key, used only to read your organization's usage.
Machines
One row per linked machine, holding what section 02 lists plus the time of its last push and a hashed copy of that machine's push credential. Credentials are stored hashed, never in the clear.
Billing
If you subscribe, Stripe holds your payment details, and we hold your Stripe customer and subscription identifiers, the plan, the seat count and the state of the subscription. No card number, and no billing address, ever reaches a Kibble form or a Kibble server. Checkout and the billing portal are Stripe's own pages.
Logs
Our server keeps ordinary operational logs (request paths, status codes, timestamps, and the IP address the request arrived from) for a short period so that faults and abuse can be investigated. The dashboard carries no analytics product and no third-party tracker at all. The marketing page and the blog count visits with PostHog, without cookies and without an identifier that survives the day, which section 09 describes in full. There is no advertising pixel on either site.
04Why we hold it
- To provide the product you asked for: the account, the dashboard, the rollups, the alerts. Under the GDPR, performance of a contract.
- To take payment: subscriptions and invoices, through Stripe. Performance of a contract, and a legal obligation for tax records.
- To keep the service working and safe: operational logs, rate limits, backups. Our legitimate interest in running a service that stays up and is not abused.
- To write to you about your account: invitations, receipts, and notices that matter, such as a change to these documents. Performance of a contract. We do not send marketing email to an address that reached us through a Kibble account.
We do not sell personal data, we do not share it with advertisers, and we do not use it to train machine learning models.
05Who else touches it
| Who | What for | Where |
|---|---|---|
| Hetzner | The server and the database that run the dashboard. | Germany |
| Sign-in, and the web fonts both of these pages load. | Global | |
| Cloudflare | Serving usekibble.com, and holding the nightly database backup in R2 object storage. | Global |
| PostHog | Counting visits to the marketing page and the blog, without cookies. Not present on the dashboard. | United States |
| Stripe | Taking payment and holding payment details, if you subscribe. | Global |
| Anthropic | Read only, with your organization's own Admin API key, if an owner added one. | United States |
| An SMTP mail provider | Delivering invitations and account email. | Depends on the provider |
Otherwise we disclose personal data only where the law requires it, and, if Kibble is ever sold or transferred, to the acquirer, who would be bound by this policy until it is replaced by one no less protective. You would be told before that happened.
06Where it lives, and for how long
The dashboard, its database and its backups run on a virtual server rented from Hetzner in Germany. A backup is taken nightly, kept fourteen days on the server, and copied to Cloudflare R2 object storage. Data in transit is encrypted with TLS.
If you are in the European Economic Area or the United Kingdom, the services in section 05 that operate outside it do so under the transfer mechanisms in their own terms, which for each of them are the European Commission's standard contractual clauses.
- Usage history: on the free plan, the last 30 days. Older rows are deleted by a job that runs every night, so what a free account can see and what the server still holds are the same month. On Pro, history is kept for as long as the organization exists.
- Account and organization records: for as long as the account exists.
- Backups: a deletion works through the backups as they roll over, within 30 days.
- Billing records: kept as long as tax law requires, which in Japan is seven years.
Ask us to delete your account and we delete the user record, the membership, the machines and every usage row attached to them. Write to hello@usekibble.com and we will act within 30 days.
07Who can see what, inside your organization
Kibble is for visibility, not surveillance, and the product enforces the difference:
- An owner sees the whole organization: totals per person, team, model and repository.
- A manager sees the teams an owner assigned them, read only.
- A member sees themselves only.
- Machines are visible to their owner only. The only screen that lists a person's devices is that person's own. Everyone else, owners included, sees a count.
Nobody in your organization, at any role, can see a prompt, a file or a line of code through Kibble, because we never receive one.
08Your rights
You can ask us to give you a copy of the personal data we hold about you, correct it, delete it, hand it to you in a portable form, restrict what we do with it, or object to a use we base on legitimate interest. Write to hello@usekibble.com. We answer within 30 days and do not charge for a reasonable request.
Some of this data reaches us because your employer asked us to collect it. Where we hold it as a processor for your organization, we will point a request at the organization's owner and help them answer it.
If you are in the EEA or the UK you may complain to your local supervisory authority. In Japan you may contact the Personal Information Protection Commission.
09Cookies
The marketing page and the blog set no cookies. They count visits with PostHog in its cookieless mode: no cookie is written, nothing is placed in local or session storage, and no identifier follows you between visits or off the site. PostHog's servers turn each request into a hash of that day's secret salt, your IP address, your browser's user agent and the hostname, and the salt is thrown away every night, so tomorrow you are counted as somebody new. What we get is aggregate: pages viewed, where the visit came from, which links were clicked, and the browser's own performance timings. There is no session recording, no advertising pixel and nothing sold or handed to an advertiser.
The dashboard sets three cookies, all of them necessary and none of them used for tracking or advertising: a session cookie that keeps you signed in, a cookie holding your language choice (kibble-locale), and one holding your light or dark preference. There is nothing to consent to and no banner to dismiss, on either site.
10Children
Kibble is a tool sold to businesses. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child's data has reached us, write to us and we will delete it.
11Security
Sign-in is delegated to Google. Both credentials that reach us, the browser session and each machine's push credential, are stored hashed. Your vendor API key is stored encrypted. The database is not reachable from the public internet. Traffic is TLS only. No system is perfect: if a breach ever affects your data, we will tell you and the relevant authority without undue delay.
12Changes
If we change this policy we will change the date at the top, and for anything that materially affects you we will email the address on your account before it takes effect. Continuing to use Kibble after that date means the new version applies.
Questions about any of it: hello@usekibble.com.