What this site keeps.

Each chat turn is recorded as counts only: number of messages, token counts and response time. The text of your messages is not stored by default.

Transcripts are kept only if Kavin turns on logging to debug the model. If that happens, this page will say so.

Messages are checked for prompt-injection patterns before they reach the model. A flagged turn is counted, not saved. Facts about Kavin's work come only from sources he approved. It is an AI version of Kavin, not Kavin in real time.

The conversation on your screen is kept in your browser's sessionStorage, so the home page and the full chat show the same one. It clears when you close the tab.

When email delivery is set up, your name, email address, the kind of message you picked and your message are sent to Kavin's inbox through Resend and used only to reply to you. They are not stored in a database on this site, and the server never logs what you wrote.

When delivery isn't set up, the form sends nothing. It tells you so, keeps your text on your screen, and offers direct ways to reach Kavin.

Spam protection uses a hidden honeypot field, a minimum time to fill the form and rate limits. If Cloudflare Turnstile is enabled, Cloudflare processes that challenge.

One cookie, kai_session, holds a random identifier for your chat session so rate limits can apply per session. It is set when you send your first chat message and expires after 30 days. This site sets no analytics or advertising cookies.

If you press play in the Drake Station, Spotify's player sets its own cookies under spotify.com, including an identifier that lasts a year, and Spotify's privacy policy applies to them. Nothing from Spotify is loaded or set before you press play.

The opening animation leaves one note in your browser's sessionStorage so it plays only once per visit. It clears when you close the tab.

Requests are counted per IP address and per chat session over short windows to keep the service available. The counters expire on their own.

• Resend delivers contact-form emails, when delivery is set up.
• GitHub provides public repository data for the contact page. It is fetched by the server, not by your browser.
• Spotify plays the Drake Station on the home page, loaded only when you press play. Until then nothing is requested from Spotify; after that, Spotify's player runs in the page and Spotify's own privacy policy and cookies apply to it.
• The model runs on a server Kavin operates for this site. Chat messages are not sent to a third-party AI provider.
• The web host that serves this site handles every request and may keep standard access logs, which include IP addresses, for a limited time.
• Upstash Redis, when it is configured, stores the rate-limit counters (a short-lived key per session or network address and a count, never message content). Without it the counters live in the server's memory.
• Fonts are served from this site, not loaded from a font service.

Email kmohanad@uwaterloo.ca.