In short
- Kettu runs on your own computers. Your sessions, code and files stay on your devices, and each agent you use talks only to its own provider. Kettu’s services never see them: when you connect from another network, the relay passes them on end-to-end encrypted, unable to read them.
- Kettu’s apps and this website collect no analytics or telemetry.
- A Kettu account is optional. Account sign-in is not available yet. When enabled, the account service keeps your email, login method and signed-in desktop apps and browsers.
- You can delete your account, and what the account service keeps with it, from your account page at any time.
The desktop app
Kettu keeps your sessions, settings and history on your computer. It goes online only to:
- check for updates and download them from GitHub;
- read the theme catalog from GitHub;
- download an agent you choose to install, from where it is published, such as npm, GitHub or its vendor’s site;
- publish an artifact you choose to share, to the Cloudflare account you connect, with your own API token;
- sign in to your Kettu account and check it, if you choose to sign in;
- connect to the Kettu relay while it is signed in and Use the Kettu relay is on, so your devices can reach it from any network.
Those services see your IP address and what is asked for, as with any download, and Cloudflare holds what you publish.
The agents you use send your prompts, code and files to their own providers, such as Anthropic for Claude Code or OpenAI for Codex, under those providers’ terms. Kettu does not store, read back or forward the agents’ credentials or yours for GitHub; Git and GitHub actions run with your own tools and accounts.
With your permission, the usage page reads only what usage needs from the agents’ local logs: tokens, models, times, sessions and working folders, never what was said. Diagnostics are written only when you export them, contain no keys, and stay with you unless you send them to someone.
An artifact page your agent made may load libraries and fonts from public CDNs (cdnjs, jsDelivr, unpkg, esm.sh, Tailwind CSS and Google Fonts) when you open it.
Your other devices
When you pair a phone or a browser with your computer, everything between them is end-to-end encrypted. Over a network you set up, such as the same Wi-Fi, a VPN or an SSH forward, they connect directly, with no Kettu server in between, and the web client is served by your own computer. A pairing link carries its code after the #, which your browser sends neither to this website nor to app.kettu.sh.
Connecting from any network
To reach your computer from any network, you can open the web client at app.kettu.sh, which connects through the Kettu relay. Both run on Cloudflare, and both work only while your computer and the browser are signed in to the same Kettu account.
- app.kettu.sh only serves the web client’s files. In the browser’s storage for app.kettu.sh, which this website cannot read, the web client keeps the key that identifies it to your computers, the computers it reaches, your drafts, its own settings and its sign-in. It keeps no conversations.
- The relay connects the browser, or another of your devices, to your computer and passes on what they exchange, end-to-end encrypted, so it cannot read your sessions, code or files. It sees which computer is online, the account each connection belongs to, when connections start and end, the addresses they come from and how many bytes pass. It keeps no log of connections and writes none of this down; Cloudflare processes each connection’s IP address, as it does for this website.
- The account service counts the browser as one of your signed-in devices, as it does a desktop app.
Kettu serves the code of the web client at app.kettu.sh, so using it means trusting that code with what you see there. The page your own computer serves comes from your computer instead.
Push notifications are not available yet. This page will say what they handle before they launch.
Your Kettu account
Account sign-in is not available yet. Email delivery has not been configured, and GitHub and Google sign-in are not enabled. The sign-in page shows only methods the account service makes available. There are no subscriptions or payments on this website.
The account pages support email-code sign-in and signing the desktop app and the web client at app.kettu.sh in through your browser. When sign-in is available, Kettu’s account service, which runs on Cloudflare, keeps:
- Your account: your email.
- Login methods: which method you use, its verified email and when it was last used.
- Signed-in desktop apps and browsers: each one’s name, system, architecture and version, and when it signed in and was last used.
To keep sign-in safe, the service stores sign-in codes for 10 minutes and counts of attempts per email address and IP address for up to an hour. Codes and sign-in tokens are stored only as hashes. When email delivery is enabled, the delivery service receives your address and the message. When enabled, Cloudflare Turnstile checks requests before a sign-in code is sent.
The account service never receives your sessions, code or files.
The iPhone app
The app keeps on your phone the key that identifies it to your computers, in the Keychain; the computers you paired; a copy of recent sessions, so you can read them offline; and what you share into Kettu until it is sent. Photos and files you attach or share go only to your computer.
- Camera: to scan a pairing code and to take photos you attach.
- Face ID: iOS checks it; the app only learns whether it passed.
- Local network: to reach your computers.
The app has no analytics, ads or tracking, and no third-party code that collects data.
TestFlight and the App Store
Apple distributes the iPhone app. When you test it through TestFlight, Apple gives us what TestFlight gives every developer: the feedback and screenshots you send, crash reports, your device model and iOS version, and, if we invited you by email, your name and email address. We use them only to fix problems and to reach you about the test, and delete them when you ask. From the App Store, Apple shares crash and usage data with developers only if you allowed it in your iPhone’s settings. How Apple itself handles data is in Apple’s privacy policy.
This website
kettu.sh is hosted on Cloudflare, which processes your IP address and each request to serve the pages and protect the site. The site runs no analytics or trackers, and its fonts come from kettu.sh itself.
When you sign in, the site sets __Host-kettu_session to keep you signed in. It lasts 30 days from your last visit and is removed when you sign out. Page scripts cannot read it, and it is never used for anything else.
In your browser’s storage it remembers your language, your light or dark choice, the sign-in method you last used and whether you signed in here before, so the header can show your account; none of this is sent to us. Other sites it links to, such as GitHub, follow their own policies.
Your choices
What Kettu keeps on your devices stays there, so you remove it there: unpair a device, or uninstall the apps.
On your account page you can sign out a desktop app or a browser, remove a login method while keeping at least one, and delete your account. Deleting it removes your account, login methods and app sign-ins. Nothing on your own devices is affected.
To have us delete TestFlight feedback or an email you sent, or for any question about privacy, write to privacy@kettu.sh.
Changes
When this page changes, so does the date at the top, and changes that matter are noted in the release notes.