Kex privacy policy

Effective date: 6 October 2026. This policy covers the Kex desktop application, its optional modules and services at kex.eu.com. Kex is developed and operated by Krzywy. For privacy questions or data requests, use the contact form or contact Krzywy on Telegram.

Kex is developed and operated as a private project based in Germany by Kacper Kreft (Krzywy). For privacy questions and requests, you can email admin@kex.eu.com without a Telegram account. This contact also covers data held by Kex services, not only files stored on your computer.

Updated 28 October 2026: clarified the operator, computer identifiers, reCAPTCHA, privacy requests and the limits of existing deletion procedures. The Google data sharing and Limited Use commitments remain unchanged.

Update, 12 October 2026: clarified public and private beta updates and release notifications. The Google data sharing and Limited Use commitments below remain unchanged.

Purposes and legal bases

The Kex operator processes connection and security logs to provide and protect its services, relying on the legitimate interest in availability, abuse prevention and diagnosis (GDPR Article 6(1)(f)). Data needed to carry out a service you request, such as a cloud account or an update-access request, is processed where necessary to perform that service or take steps at your request (Article 6(1)(b)). Optional newsletter delivery and background developer messages rely on consent (Article 6(1)(a)); technical abuse-prevention records are separate. Accepting these terms or granting an OAuth scope is not blanket consent for other uses. These bases do not remove separate requirements for accessing information on your device. Providing desktop software does not make the operator controller of all correspondence stored locally or exchanged directly with your provider.

Optional release newsletter

Update, 18 October 2026: added the optional, confirmed newsletter described in this section.

If you subscribe, Kex stores your email address, selected language and subscription/confirmation times on its server to email you about new public versions. Subscription requires a confirmation link valid for 24 hours. Unconfirmed requests are removed after seven days. The Kex operator and its hosting and email provider, OVH, process this information to operate and deliver the newsletter; it is not sold or used for advertising. Each email has an unsubscribe link: confirming that choice removes your address and queued deliveries from the active list. Server backups may retain earlier records until replaced. Request limits use a keyed hash of the requesting IP for up to one hour; ordinary website connection logs follow the website rules below. Newsletter data is separate from Gmail API data and subscribing does not grant access to your mailbox.

Public and private beta updates

Public releases are offered to all supported installations. Private beta offers are restricted to installation IDs approved for testing. Kex sends its installation ID and version when checking for updates. While online, it can keep an HTTPS request open to learn that a release or notice has changed, then fetch the signed offer. This does not send your messages or email content. Connection metadata and installation records are handled as described below. Downloading an update requires your choice in the app. An optional request for private beta access sends the name and message you enter, installation identity and version to the operator; the operator may receive it through the administrative Telegram bot.

Data used by the desktop application

Kex connects to the accounts and services you configure, such as Telegram, TeamTalk and mail providers. It processes account identifiers, connection settings, messages and media needed for the features you use. Account credentials and sessions are stored in the local encrypted vault or protected provider storage. Settings, diagnostic logs, downloads and exported files may also be stored in the portable application folder or a location you choose; not every local file is encrypted.

Gmail, Microsoft 365 and other mail accounts

The optional mail module accesses your email address, folders or labels, message headers (including senders, recipients, subjects and dates), message bodies and read status. Downloaded MIME messages may also contain attachment data. This data is used to display and refresh your mailbox, read messages, compose and send messages with attachments, reply, mark messages as read, move messages to Trash and restore them. Optional notifications and automatic reading announce new mail through your configured speech output.

Gmail uses Google authorization for these mail features. Mail module 1.0.14 and earlier use gmail.modify; module 1.0.15 adds permanent deletion and requests https://mail.google.com/ instead. Google verification of this broader permission is pending. Microsoft 365 uses delegated Microsoft Graph permissions Mail.ReadWrite, Mail.Send and User.Read, plus offline_access to maintain authorization. Google and Microsoft passwords are entered on their authorization pages, not collected by Kex. Access and refresh tokens are stored in the encrypted local vault. IMAP/SMTP passwords or app passwords are stored there when you choose that account type.

Ordinary mail reading and sending connects directly from your device to your mail provider over encrypted connections. It does not route your mailbox through the Kex update server. To restore your workspace after a restart, Kex saves loaded message headers, folder lists, open message contents (including available inline images and attachment names), drafts, account configuration and navigation positions in the encrypted local vault. Message bodies and attachment data are fetched when needed; Kex does not download every message body merely to list a folder.

The version with permanent deletion uses https://mail.google.com/ to immediately and permanently delete the individual messages you select, without first moving them to Trash. This action cannot be undone. Confirmation is enabled by default and can be disabled in the mailbox options. Moving messages to Trash and restoring them remain separate actions. Read-only access cannot change read status or move messages to Trash, send-only access cannot display a mailbox, and gmail.modify cannot permanently delete messages. Previously authorized mailboxes need a new Google consent to gain the broader permission; refreshing a token does not grant it. Permanent deletion is not available in older releases using only gmail.modify.

Kex shares, transfers or discloses Google user data in the following circumstances. These disclosures apply to Gmail account information, message data and authorization information as described below.

Google: Kex sends authorization requests and mail operations directly to Google. When you send a message, Google receives its recipients, content and attachments to deliver it. Reading, read-status changes and Trash operations are also processed by Google.
The recipients you choose and their mail providers: sending or replying shares your sender identity, message content and included attachments with those recipients through the mail delivery services involved.
The Kex operator, Krzywy, and the hosting provider used for Kex cloud storage: only if you choose a cloud backup that includes your mail account, its saved account data may be uploaded, including authorization tokens, drafts, cached headers and saved open messages. Backup keys are managed by the cloud service, so these backups are not end-to-end encrypted against the operator. Ordinary mailbox use does not upload your mailbox to Kex cloud storage.
Support reports: if you include Google data in a report or attachment, Kex stores the submitted information on its support server for developer access through an authenticated portal. Since 28 October 2026, Telegram receives only a generic notification and the report location, not its contents, contact details, IP address or attachments. The link alone does not authorize access. Older reports forwarded before this change may still exist in Telegram and require separate removal. Ordinary Gmail use does not upload your mailbox to support.
External image and website operators: opening a message in the HTML view can load images from addresses supplied by its sender. Those servers receive your IP address and the requested image URL, which may contain a tracking identifier and reveal that you opened the message. Opening a link sends its URL and normal connection information to the destination website through your browser. Kex does not send Gmail authorization tokens to these sites.
Your selected local tools and destinations: screen readers or speech engines receive the text Kex asks them to speak. Copying, exporting or saving mail data makes it available to the destination or software you select; any cloud processing by those tools depends on their settings and policies.

Google user data is not sold, shared with advertising networks or data brokers, used for advertising or credit decisions, or used to train general-purpose AI models. Other disclosures are limited to necessary security investigations or applicable legal obligations, as permitted by the Google API Services User Data Policy. Kex does not give the developer routine access to your mailbox for reading messages.

Kex's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Human access to Google user data is limited to your explicit consent for specific data (for example, a support attachment), security investigations, applicable legal requirements or other cases permitted by that policy.

Optional backups and support submissions

If you choose to export a backup or use Kex cloud backup, the included account data can contain credentials, authorization tokens, saved drafts, cached mail headers and saved open messages. For older cloud backups, the cloud service manages backup keys; do not assume that those copies are inaccessible to the service operator. Backups are separate copies and removing a mailbox does not remove earlier backups. Starting with Kex 0.16.0.13, new cloud backups and their component lists use a separate user password. That password is kept only in the local encrypted vault and is not sent to the server. The operator cannot recover it or decrypt these new copies using the older account backup key. The server still receives the backup name, upload time, automatic-backup flag and encrypted file size. Older copies remain unchanged unless you confirm their conversion. Losing the password can prevent recovery of these new backups; a weak password or a compromised computer can undermine their protection.

When you send feedback, logs or attachments, the developer receives the information you submit and optional contact and diagnostic details. Reporting attempts to redact sensitive information, but attachments may contain personal data. Review them before submission and do not include passwords, login codes, authorization tokens or a complete account vault. Reports and attachments stay on the Kex support server; the developer signs in to read or download them. Telegram receives a generic notification and a link, without report contents or attachments. Administrative beta requests and device approvals are separate bot functions described in their own sections.

Automatic mail configuration

When you choose automatic IMAP/POP3 setup, Kex requests provider settings from Thunderbird's ISPDB service using only the domain of the email address. That service receives the domain and ordinary connection information, such as your IP address; Kex does not send the full email address, passwords, authorization tokens or message contents to it. Server availability checks connect to the configured mail services without signing in. Downloaded POP3 message bodies and headers are encrypted locally in the data folder; local ordering indexes and read/Trash flags are not message content. The separate POP archive is not included in selective account/cloud backups; preserve the complete data folder when moving an installation.

Website, updates and cloud services

The website initially uses a supported language from your browser preferences. If you choose a language manually, that choice is saved in this browser's local storage. It is not sent to the Kex update server as an installation identifier. You can remove the saved choice by clearing this website's data in your browser.

Website form protection: download, contact and newsletter signup forms use Google reCAPTCHA v3 on submission. Google receives connection and browser/device signals for abuse prevention and may set the _GRECAPTCHA cookie. Kex sends the resulting token for verification, not the form text, email address, attachments or Gmail mailbox data. Under the Google Cloud terms applicable to reCAPTCHA Customer Data from 2 April 2026, Kex is the controller and Google acts as a processor under the Cloud Data Processing Addendum. This protection is separate from Gmail authorization and is not permission to use mail data for other purposes.

Web and update requests expose your IP address, request time, requested path and client information to the server. Update records associate the installation ID with the Kex version and first/last contact times. Older clients use a random profile installation ID. Newer clients derive a Kex-specific pseudonymous computer ID locally from the firmware UUID, falling back to the Windows installation identifier if necessary. Raw firmware and Windows identifiers are not transmitted. The resulting ID is not anonymous: Kex can associate it with update history, beta access and approved device records. Migration and background-agent behavior are explained below. Optional cloud accounts additionally process registration, authentication, device/session information and the backups you upload.

The public website does not embed advertising or third-party analytics scripts. Hosting and mail delivery providers process data for their respective services. Telegram handles generic support notifications as well as the separately described beta requests and device administration. It no longer receives newly submitted support report contents or attachments through automatic forwarding. Processing locations and contractual safeguards must be assessed separately for each provider; HTTPS alone is not an international-transfer safeguard.

Retention, removal and access controls

Local account configuration, authorization tokens, drafts and saved mail workspace data can remain across restarts until you remove the mailbox or the corresponding local data. Closing a message is not a guarantee that every cached copy has been erased. Removing a mailbox from Kex does not delete mail on your provider's servers. Revoke Google access in Google account connections; Microsoft users can revoke application access through their Microsoft account or organization administrator. Revocation prevents further authorized access but does not erase existing local copies or backups.

You control local logs, downloads and exported backups. Cloud backups remain until deleted or replaced through the backup controls. Managed local report archives, feedback records and their uploaded attachments are checked daily for deletion after 90 days from their last modification. This task does not delete forwarded Telegram copies, administrative backups, installation records or other operational logs; those require separate manual deletion or backup rotation. For access, correction or deletion of data held by the Kex operator, use the contact details above and identify the relevant account or submission without providing credentials. Requests may require identity verification. Deletion of active data may not immediately remove copies in operational backups or data retained for security or legal obligations.

Existing retention controls have separate scopes. Managed local support reports are checked daily after 90 days from their last modification. This does not remove Telegram copies, installation history, cloud accounts or server backups. The web server currently rotates nonempty Apache logs daily and keeps 14 rotated archives; this is a rotation count, not a guarantee of erasure after exactly 14 calendar days. A request to erase server data must be handled separately from deleting the portable folder. We do not claim that every copy disappears immediately.

Inactive public update records are checked daily and removed after 365 days without contact. This period preserves update diagnostics across long gaps between launches while limiting inactive records. Beta-listed installations, named developer records, device registrations, identity migrations and beta requests are excluded from this automatic cleanup so access and identity links are not silently removed. Those separate records remain subject to individual privacy requests and separate retention decisions. The check does not delete cloud accounts, backups or report files.

Your choices and policy changes

Mail authorization, support uploads and cloud backup are optional. You can revoke provider access and remove local data. Disabling the background agent does not delete the update registry or stop identity migration while Kex is open. Removing a mailbox, revoking OAuth access, deleting a cloud backup and closing a cloud account are separate actions. Privacy requests can cover device registration, legacy ID aliases, version history, reports and cloud data; identify the relevant account or report without sending credentials.

You have the right to access and correct your personal data and, where the GDPR conditions apply, to erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your situation, and to direct marketing at any time. Consent can be withdrawn without affecting earlier lawful processing. Unsubscribe using the newsletter link; disable the agent in Settings, Behavior. You can also email admin@kex.eu.com. We respond without undue delay, within one month; a necessary extension of up to two further months will be explained within the first month. Identity checks are limited to what is needed where there are reasonable doubts. You may complain to the Polish data protection authority, UODO, or another competent EU supervisory authority. Policy changes are published with their date; publication alone does not replace consent where required.

Optional developer messages

Versions that include the optional developer-message agent ask before enabling it. If you agree, a separate process can start with Windows and display plain text messages from the Kex developer in a dialog with an OK button, even when Kex is closed. You can disable it in Settings, Behavior. The agent does not run remote commands or read your Telegram messages, mail, passwords or audio.

The agent sends the installation ID, a random device ID, computer name, language, client version and contact times to the Kex server. The server stores a hash of its separate device credential and message delivery and confirmation records. The administrator approves receiving devices and uses a Telegram bot to send messages and view device registration and delivery details. A delivery record does not prove that a person has read the message.

Unconfirmed messages stop being delivered after seven days. The server removes message records after a further 90 days while the service is operating. Device registration can be removed on request through the contact form. Local credentials and cached message text are protected with Windows DPAPI for the current Windows user, separately from the Kex vault. Legacy versions store them under data/developer-agent; newer versions use LocalAppData/Kex/computer-identity; the diagnostic log does not contain credentials or message text.

Newer clients use a Kex-specific pseudonymous computer ID derived locally from the system firmware UUID, or from the Windows installation identifier when firmware identity is unavailable. Raw hardware identifiers are not sent to Kex. Older profile IDs are migrated using a separate device credential; the server keeps compatibility aliases and transfers beta access, report names, version history and queued developer messages. Without a previously approved credential, the existing device approval in the developer bot is required before transferring access. Registration for this migration can run while Kex is open even if the optional background agent is disabled. Migration credentials and the agent preference are shared by Kex copies in the same Windows account, stored under LocalAppData and protected with DPAPI. You can request deletion of device registration, compatibility mappings and version history through the contact form.

Kex server services use infrastructure supplied by Contabo. Kex mail delivery uses OVHcloud, including the release newsletter and configured cloud security emails. These providers handle hosting or mail data for the corresponding service; this does not mean they receive every local conversation or mailbox in Kex. Provider headquarters do not by themselves establish the location of a particular server, mailbox, backup or support access. The exact contracting entities, selected regions and processing agreements must be confirmed from the relevant service contracts.