Privacy Policy

1. Summary

Kellet is a self-imposed content blocker. This policy describes what data the service collects, why it is collected, how long it is kept, and how you can review or delete it. It also names the company behind Kellet and how to reach us (section 15).

Kellet is operated by 7578776 CANADA INC., a federally incorporated Canadian company. In this policy, "Kellet", "we" and "us" mean that company.

Kellet does not sell personal data and does not run third-party advertising. The activity your agent records - the sites you visited, the apps you used, and the content it blocked - is kept in your own account. It is not shared outside the service, except with an accountability partner you invite and the processors listed in section 9.

If Kellet is installed on a Windows computer that more than one person uses, it records activity on every Windows user account on that computer, not only the account of the person who installed it, unless the account holder turns an account off. Section 3 explains this.

Separately from the agent, this public website uses Google Analytics, and only if you accept the cookie banner. It runs only on our public marketing pages, it counts page views with no account identifier, and it never runs inside the signed-in app. It never receives your activity data, your rules, or anything an agent uploaded. See section 6.

2. Data we collect

Account data - the email address you register with, a hashed password, and profile fields you choose to add. If you sign in with Google, we also receive your Google profile name and picture (section 4).

Device metadata - the name you give each device, its enrollment status, its last-seen time, and identifiers the agent reports, such as the Windows MachineGuid, the device hostname, and the operating-system name and version (section 3).

Activity data - for each enrolled device, the browsing events, application usage, and blocked-content events the agent uploads, along with the time they occurred. Browsing events include the domain, the full URL and the page title of the pages visited. Application usage includes the title of the foreground window (section 3).

Installed-software inventory - for each device, the applications found on it: application name, publisher, version, executable path, install location and install date (section 3).

Captured images - the only images Kellet may store are a heavily blurred frame kept when on-screen detection blocks something and, if you turn on file scanning, a blurred thumbnail of a flagged file. Both are off unless you turn them on. There is no remote or on-demand screenshot or camera capture: Kellet cannot be asked from the app to photograph a screen or a camera, and the service has no way to request it.

Configuration data - the blocking rules, category preferences, and guardrail settings you configure.

Settings history - a record of every change made to your account's settings, rules, schedules, devices and partner permissions: what changed, its value before and after, when, who made the change (you, a partner or steward, a Kellet administrator, or one of your devices), and the IP address and browser or app the change came from. It also records when each of your devices received a new configuration. Email addresses in it are stored only as a one-way hash. We use it to investigate problems and to establish or defend legal claims. It is not shown in the app, and your partners cannot see it.

3. What the Kellet agent records on your device

The Kellet agent is software you install on your own device. To block content a browser extension cannot reach, it runs with elevated privileges and inspects the device's web traffic and activity. This section describes what it records.

HTTPS inspection (Windows). The Windows agent installs a local root certificate on the computer and uses it to decrypt the device's HTTPS web traffic, so it can check each page against your rules. For pages it inspects, it records the domain, the full URL and the page title. Certain hosts are left encrypted and are not decrypted or inspected: operating-system and update services, and vendors whose software pins its own certificate, such as Microsoft, Apple, Mozilla, cloud storage, messaging and game services. Apart from that bypass list, general web traffic, including banking, health and webmail sites, may be decrypted and inspected, though every reasonable effort is made to avoid decrypting banking and health information. A host on the bypass list is decrypted only when one of your enabled block categories lists it.

Application usage. The agent records which applications you use and for how long, including the title of the foreground window. Window titles are part of your activity and are visible to you and to any accountability partner you invite.

Installed software. The agent reports the applications installed on the device, with the name, publisher, version, executable path, install location and install date of each.

Device identifiers. The agent reports a stable per-machine identifier (the Windows MachineGuid), the device hostname, and the operating-system name and version.

Shared computers. On Windows the agent runs as a system service, and the root certificate it installs applies to the whole computer. It records activity on every Windows user account on that computer and reports it to the account Kellet is enrolled to, so if other people use the computer, their activity on their own Windows accounts is recorded too, not only the activity of the person who installed Kellet. The account holder can turn an individual Windows account off on the device's page; Kellet then stops recording and reporting that account's activity, although its blocking still applies to it. Before installing Kellet on a computer other people use, the account holder must have their agreement, as the Terms (section 5) require.

Android. When the Kellet Android app is available, the Android agent records the resolved hostnames, the full address-bar URLs and the page titles of the sites visited, and the list of apps installed on the phone. The same rules in this policy apply to it.

4. Account, sign-in and how you reached us

Sessions and sign-in. When you sign in, we record the IP address and browser user agent of each session. We also record the IP address and user agent of the request that created your account, and the IP address of the request in which you accepted the Terms and Privacy Policy, along with the version you accepted and the time. An IP address is personal data; we keep these as a security and fraud record and confine them to our internal admin tools.

Signing in with Google. If you create or access your account by signing in with Google, we receive and store your Google profile name and profile picture, together with the Google account identifier used to sign you in.

How you reached us. When you first arrive at the website, we capture basic marketing-attribution information carried in the link you followed: campaign tags (UTM parameters), the host of the site that referred you, and the landing page path. If the link carries an advertising click identifier, such as gclid, gbraid, wbraid, msclkid or fbclid, we use its presence to record which marketing channel sent you. We store the resulting channel, campaign, referrer host and landing path against your account at sign-up. We do not store the full landing URL, the full referrer, or the raw click identifiers.

5. Why we collect it

We use account and device data to authenticate you and route agent uploads to the right account.

We use activity data to show you your own history and to enforce the rules you have configured.

We use configuration data to serve the correct rule set to your enrolled agents.

We use sign-in, session and acceptance records to secure your account and to prove which terms you agreed to.

We use marketing-attribution information to understand which channels bring people to Kellet. It is not used to build an advertising profile.

6. Website analytics

This public website uses Google Analytics to count visits and see which pages help people most. It runs only on our public marketing pages, it is the only third-party analytics on the site, and it never runs inside the signed-in app. It is not connected to your account, and it is not connected to anything your enrolled devices do.

Nothing loads until you accept. If you decline the cookie banner, or simply ignore it, the Google Analytics tag is not placed in the page and no analytics cookie is set. If you accept and later change your mind, tracking stops.

Exactly what it collects, and nothing beyond it: the marketing pages you visit and their titles; the site that referred you here, if any; how long you spend on a page; whether you are a first-time or returning visitor; your approximate location, at country and city level, derived from your IP address, which is not itself retained; and your device type, browser, operating system, screen size, and language.

Page views are the only thing this reports. There is no click tracking, no scroll tracking, no form-content capture, and no session recording. The page address is cleaned before it is sent, so query strings and any token in a URL are removed: your name, email address, and account identifier are never sent. A cookie stores a randomly generated visitor number so that repeat visits can be told apart from new ones; it does not identify you.

What Google Analytics never receives is anything the blocking agent produced. Your browsing history from enrolled devices, blocked-content events, application usage, stored frames, and your rules stay inside the service and are not sent to any analytics provider.

Advertising features and ad personalisation are switched off, so none of this is used to build an advertising profile or shared with ad networks. Google acts as a data processor here, and its own handling is governed by its policies. If you would rather not be counted, decline the banner.

Signing in with Google is separate from analytics. When Google sign-in is available, the Google Identity Services script loads on the login and register pages so the sign-in button can work. That is a functional part of signing in, not analytics, and the cookie banner does not gate it: it loads whatever you chose on the banner, and only on those two pages.

7. Email and notifications

Email engagement. When we send you email, we record whether it was delivered, opened, clicked, or bounced, and any complaint if you mark a message as spam. We use this to keep our mailing list healthy, to keep our messages working, and to stop sending to addresses that bounce.

Push notifications. Push notifications are delivered through Firebase Cloud Messaging, a Google service. A notification may name the site or app that was blocked and the device it happened on, so the alert is useful at a glance. It does not include the page title or anything you searched for.

Invitations. When you invite an accountability partner, or when a steward is invited to supervise an account, we store the invitee's email address so we can send and track the invitation.

Cancellation feedback. If you give a reason when you cancel, we store that feedback.

8. Data we do not collect

Classification of what is on your screen happens locally on the device. Frames that are not flagged are not uploaded, and there is no remote or on-demand screenshot or camera capture; see section 2 for the blurred images that may be stored.

We do not use third-party advertising, and no analytics provider other than the one named in section 6.

We do not collect biometric identifiers, physical location beyond what is inferable from routine network metadata, or the contents of files that were not flagged by the agent.

We never see or store your card number. Payments are handled by Stripe, and only the plan, status, and the last four digits of the card are returned to us.

9. Who processes your data, and where it is stored

Kellet relies on a small number of third-party processors to run the service. Each one receives only the data it needs for its role.

Amazon Web Services (AWS) stores our files and images (Amazon S3) and sends our transactional and notification email (Amazon SES). Both run in AWS's US East (Ohio) region, in the United States.

Stripe processes payments. We never see or store your card number; see section 8. On Android, Google Play processes purchases made in the app.

Google provides Google Analytics on this marketing website (section 6), Google Identity Services for signing in with Google (section 6), and Firebase Cloud Messaging for push notifications (section 7).

Sentry receives technical error reports so we can find and fix faults. These are stored in Sentry's EU region, in Germany. They describe the fault, not you: web addresses outside Kellet, domain names, email addresses and sign-in tokens are removed before a report is sent, and a report never contains your browsing activity, your rules or a stored image.

Your account, device, activity and configuration data are stored on servers in Nuremberg, Germany, operated by Hetzner.

This means your data is stored and processed outside Canada, and some of it - file and image storage, email, payments and some Google services - is processed in the United States. While your data is held in another country it is subject to the laws of that country, and may be accessible to its courts and law-enforcement authorities under those laws.

10. How we protect it

Traffic between you and Kellet is encrypted in transit with TLS. Passwords are stored only as salted hashes and are never recoverable, by us or by anyone else.

Access to your activity data requires your own authenticated session. Nobody else reads it unless you invite an accountability partner. A partner you invite sees your activity; what you choose is only what they are allowed to manage, not how much of your activity they see.

Administrative access to production systems is limited to the people who operate the service, and card details never reach our systems at all.

No safeguard is perfect. Kellet is early-access software, and we do not claim that our systems cannot be breached or that our software cannot fail.

11. If something goes wrong

If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you and report it to the Office of the Privacy Commissioner of Canada, as required by PIPEDA. We will tell you what happened, what information was involved, and what you can do about it.

We keep a record of breaches of security safeguards involving personal information, whether or not they meet that threshold.

If you believe your information has been mishandled, contact us first. You also have the right to complain to the Office of the Privacy Commissioner of Canada.

12. Retention

Account data is kept for as long as your account is active. When you delete your account, it is deleted straight away (see section 13).

Your activity history (flagged items, web history, app usage, the device timeline and notifications) is kept for as long as your account is open, whatever your plan.

Your settings history (section 2) is kept for as long as your account is open, and for two years after you delete it (section 13).

Any image Kellet stores, such as a frame captured with a detection or a thumbnail of a flagged file, is deleted automatically 30 days after it was captured. The record it belonged to stays in your history; only the image is deleted.

Your data, including data you have deleted, may be retained in backup snapshots for up to 90 days before those snapshots expire.

13. Access and deletion

You can delete your account at any time from your Profile page. Deleting it removes your account, all of your web and activity history, any images Kellet stored, and your other personal data from Kellet, cancels your subscription, and releases every device on the account so Kellet can be uninstalled from it.

Some records are kept after that, because the law requires it or because they are held by another company. Payment records held by our payment processors (Stripe, and Google Play for purchases made through Android) are retained for as long as billing, tax and legal obligations require. Technical data already sent to the error-reporting and analytics providers described in sections 6 and 9 is kept under those providers' own retention schedules.

Your settings history (section 2) is kept for two years after you delete your account, so that we can establish or defend legal claims about what was set on your devices, and is then deleted. It is held under a one-way hash of your email address, not the address itself.

Backup snapshots can keep deleted data for up to 90 days before they expire, as described in section 12.

14. Children's privacy

Kellet is intended for adults and is not directed to children. You must be at least the age of majority where you live (18 in most places) to create a Kellet account, as the Terms require.

We do not ask a visitor's age, so we rely on account holders meeting the age requirement set out in the Terms.

The account holder is responsible for every device they install the Kellet agent on. If anyone else uses an enrolled device, the account holder must have the legal authority to install Kellet on it and the agreement the law requires, as set out in the Terms (section 5). The account holder controls the account and any data it holds.

If you believe a child has given us personal information without the consent required, contact us (section 15) and we will delete it.

15. Contact

Kellet is operated by 7578776 CANADA INC., a federally incorporated Canadian company, at 2967 Dundas St. W. #262D, Toronto, ON M6P 1Z2, Canada.

Questions about this policy, and requests to access, correct or delete your data, can be sent to info@kellet.app or through the contact page.

This policy applies to the Kellet web app and the Kellet blocking agent. Third-party services those tools depend on, including the processors listed in section 9, are governed by their own policies.