Privacy policy
Last updated: October 16, 2026
This policy covers the kwatch website (kwatch.dev), the account portal and
the license service at api.kwatch.dev. kwatch is operated by Abdelrahman
Ahmed ("we"). Contact: [email protected].
kwatch runs in your own cluster. The free Community edition needs no account, and without a license key it never contacts the license service.
What we collect
| Data | When | Why |
|---|---|---|
| Email address | You sign up or sign in | To create your account, send sign-in links and send license notices (for example, a license about to expire) |
Session cookie (kw_session) | You sign in | To keep you signed in. It is strictly necessary; we store only a hash of it |
| License usage: hashed cluster ID, cluster proof hash, instance public key, kwatch version, node count, last renewal time | A licensed kwatch activates or renews | To bind one license to one cluster, prevent key sharing and show the cluster on your account page |
| License event log: activations, moves, renewals that failed, emails sent | License changes | To enforce transfer and trial limits and investigate abuse |
Trial records: a one-way hash of your email and, for work email domains, the domain name (for example acme.com) | You start a trial | To limit trials to 2 clusters per account or per company domain |
| IP address | Any request to api.kwatch.dev | Rate limiting and abuse prevention. The last IP that activated or renewed a license is kept on its activation record |
We never receive workload names, logs, secrets, alerts or any other content
from your cluster. The cluster ID is a one-way hash of the kube-system
namespace UID, and the raw UID never leaves your cluster.
The website does not use analytics or advertising cookies.
Telemetry
kwatch sends an anonymous weekly ping containing a hashed cluster ID and the
kwatch version, so we can see which versions are in use. It is separate from
licensing and contains no personal data. Turn it off with
telemetry.enabled: false or KWATCH_TELEMETRY=false.
How long we keep data
| Data | Kept |
|---|---|
| Account, licenses and activation records | Until you delete your account |
| Sign-in links | 15 minutes, single use |
| Sessions | 30 days, or until you sign out |
| Rate-limit counters | A few hours to a day |
| License event log | 180 days, keyed by license ID only |
| Trial records (email hash, company domain) | Kept after account deletion so deleting an account cannot reset the trial limit |
How we use data and legal bases
We use data only to provide the account and license service, send the emails described above, prevent fraud and abuse, and keep the service secure. For people in the EU, UK and similar jurisdictions, our legal bases are performing our contract with you (accounts and licenses) and our legitimate interests in preventing abuse and securing the service (rate limiting, trial limits, event log).
We do not sell your data and do not share it for advertising.
Processors
| Processor | Role |
|---|---|
| Cloudflare | DNS, the API at api.kwatch.dev, its database, and the Turnstile bot check on the sign-up form |
| Resend | Delivers sign-in and license emails |
| Render | Hosts the website |
These providers may process data outside your country, including in the United States, under their own data protection terms.
Your rights
You can access, correct, export or delete your data. To delete your account, sign in and use Delete account on the account page. This removes your account, sessions, licenses and activation records. For other requests, email [email protected]. If you are in the EU or UK, you may also complain to your data protection authority.
Children
kwatch is a tool for operating Kubernetes clusters and is not directed at children under 16.
Changes
We will post changes on this page and update the date above. Material changes will be announced on this site.