privacy

effective 2026-09-23 · plain words, no tricks, and the plain words are the policy.

who we are

the deepkut platform (my.deepkut.app and deepkut.app) is operated by Doll House Agency, Inc., a company in the United States. For anything in this policy: privacy@deepkut.app. We are the data controller for the platform. The agent, the software that holds your library, runs on your hardware, under your control; whatever it stores there is yours, not ours, and this policy doesn't need to cover it because we never see it.

what we store

This is the complete list. It is the whole database, not highlights:

• your email address, whether you've verified it, and when the account was created
• a password hash (argon2id), never the password itself
• login sessions: a hashed session id and its expiry
• the name you gave your librarian, if you named it
• your agent's registration: the name and URLs it reports, its software version, which optional features that build has, when it last checked in, and when it first reported an out-of-date version, if it did
• pairing records: short-lived codes used to connect an agent to your account
• your waitlist email and whether you confirmed it, if you joined the waitlist
• one-time email tokens (verify / reset / waitlist links): stored hashed, single-use, and they expire
• a short-lived install token, if you've run the setup wizard: stored hashed, used once to pair your first box, and it expires
• your subscription or purchase status: whether you're on Plus, since when, and references to the matching record at our payment processor (Lemon Squeezy), not your card number, which never touches us. If you were granted free access instead of paying, that's recorded too (by whom, and a note).
• a record of each payment notification our payment processor sends us, kept the way a receipt is. the raw copy can carry more than your email: whatever name, billing address, or other custom field the processor attached to that notification comes along with it. see "how long we keep it" below for exactly how long the raw notification itself sticks around versus the reference numbers.
• short-lived rate-limit counters: some are keyed by your IP address combined with the email or account you used, some by your IP address alone, and some by the email or account alone. All exist to keep bots and mail-bombers out, and they age out on their own.
• the signing keys we use to sign session and pairing tokens: not tied to any account, hold nothing personal, and rotate over time

what we never store

• your media files: they never pass through our servers, not even to stream
• your library contents: tracks, artists, albums, tags, playlists, samples, stems
• your listening history or library searches
• what your agent acquires, or from where

All of that lives in your agent's own database on your own hardware. When you press play, your browser talks straight to your agent. We couldn't peek if we tried: that's the architecture, not a promise we have to remember to keep.

why we process it (legal bases)

• running your account. email, password hash, sessions, agent records: necessary to perform our contract with you (the terms)
• billing. subscription/purchase status and the references above: necessary to perform our contract with you (giving you what you paid for) and to meet our own accounting obligations
• the waitlist. your consent, given by double opt-in; withdraw it any time with the unsubscribe link in every waitlist email (unsubscribing deletes the record)
• security. rate-limit counters, server logs, backups: our legitimate interest in keeping the service up and accounts safe
• legal compliance. where the law requires us to keep or hand over something

cookies & trackers

One cookie: the session cookie that keeps you logged in (strictly necessary: no banner needed because there's nothing to consent to). No analytics, no trackers, no third-party scripts, no ad tech, no fingerprinting, no CDN fonts. Nothing on this site phones anywhere but here, and your own agent.

We don't respond to "Do Not Track" or Global Privacy Control signals for the honest reason that there is nothing they could turn off: we don't track anyone to begin with.

email

We email you to verify your address, reset your password, confirm a waitlist spot, and, if you're on the waitlist, to tell you about launch. That's it. No marketing lists you didn't ask for, and no sharing your address with anyone except the one Pushover alert described under "sharing" below. Waitlist mail always carries a working one-click unsubscribe, and unsubscribing deletes your waitlist record outright. Mail goes out through our own mail server (no third-party email marketing service sees your address). And if you write to us, that correspondence sits in our ordinary mailbox like any other email, kept as long as the conversation is relevant.

ip addresses & logs

Your IP appears in short-lived rate-limit counters (they keep bots off the login and signup forms) and in ordinary web-server logs. Both age out on their own. We don't build profiles from them, and neither does anyone else: no third party receives them.

where your data lives

On a server we rent from Linode (Akamai) in the United States. Nightly backups go to machines we operate, also in the United States, transferred over encrypted connections and stored on access-controlled servers. If you use deepkut from the EU, UK, or anywhere else, your data is processed in the US: by using the platform you're sending it here. We apply the same protections to everyone: the short list above, encryption in transit (TLS), tight access controls, and only the narrow sharing described next.

sharing

We do not sell, rent, or trade your personal data, and never have. No advertisers, no data brokers, no analytics companies. The parties that legitimately touch data covered by this policy: our hosting provider (Linode/Akamai, as our processor), our own backup machines, Lemon Squeezy, our payment processor (you pay them directly on their checkout page; we get back a purchase reference, never your card number), and Pushover, which we use to alert ourselves the moment someone joins or confirms the waitlist. That one alert includes the raw email address: it exists so a human notices signups in real time, goes nowhere else, and is the only case where a waitlist address leaves our own servers. If a law-enforcement demand ever compels disclosure, we'll comply only as legally required, and there's very little here to disclose.

how long we keep it

• login, session, agent, pairing, and subscription/entitlement data (whether you're on Plus and since when): until you delete the account, then it's gone immediately along with the account itself
• the payment-notification ledger is the one exception to "until you delete the account": each notification our payment processor sends us is kept the way a receipt is, as our own accounting and audit trail, separate from the subscription record above and not tied to your login. Deleting your account detaches your email and account id from every notification already matched to that account; it doesn't erase the notifications themselves. A notification we could never match to any account keeps the address it arrived with regardless of any account deletion, because that address is the only way a human can still link a real payment to some account by hand. The raw notification itself is more temporary than the ledger entry: if it hasn't yet been matched to an account we keep it in full for up to 90 days so a human can still resolve it by hand; anything else, we've already recorded within a day of receiving it (that's true even when it still needs a human, like a sold-out plan or a config we hadn't set yet), and 30 days after that we erase the raw copy and keep just the reference numbers.
• sessions and one-time tokens: they expire and are useless after; tokens are single-use
• rate-limit counters: hours, except the per-address email caps (the waitlist, and the shared account cap covering the existing-account notice, password resets, and both verify-link resends), which remember for 24 hours
• server logs: rotated out within about two weeks
• backups: deleted data disappears from live systems immediately and falls out of the backup rotation as backups expire, within about three months at the outside; backups are only ever used for disaster recovery, never to resurrect deleted accounts

deleting your data & your rights

There's a delete account button in settings. It's immediate, it asks for your password, and it removes your account, sessions, tokens, agent registrations, and your subscription/entitlement records. The one thing it doesn't erase is the payment-notification ledger (see "how long we keep it"): it detaches your email and account id from every notification already matched to your account, so those entries can no longer be linked back to you. A notification that was never matched to any account isn't touched by this at all, and keeps the address it arrived with, because a human may still need it to work out whose payment it was. Your library is untouched, because it was never here. Waitlist: the unsubscribe link in any waitlist email deletes your record.

You can also email privacy@deepkut.app to ask for a copy of your data (it's the short list above: we'll send it in a readable format), to correct something, or to have us delete anything the buttons don't cover. This is a human reading a mailbox, not an automated portal: we aim to answer within 30 days, usually much faster. We'll verify it's really you (typically by replying to the address on the account) before acting.

If you're in the EU or UK, these are your access / rectification / erasure / portability / objection rights under the GDPR, and you also have the right to complain to your local supervisory authority. California residents: we don't sell or share personal information as those terms are defined in the CCPA, so there's nothing to opt out of; the access and deletion paths above are open to everyone regardless of where you live.

if something goes wrong

If a security breach ever affects your personal data, we'll email you promptly and without undue delay, tell you plainly what happened and what was involved, and notify authorities where the law requires it.

kids

deepkut isn't directed at children. You must be 13 or older to have an account. We don't knowingly collect personal data from anyone under 13. If you believe a child has an account, email privacy@deepkut.app and we'll delete it.

changes

If this policy changes we'll update this page and its effective date; anything material gets an email to account holders before it takes effect. We will never quietly weaken it.

contact

privacy: privacy@deepkut.app
anything legal: legal@deepkut.app
copyright notices: dmca@deepkut.app (see terms for the DMCA process)