Privacy
Privacy Policy
Effective 2026-05-07
Kismet is a developer tool. We try to collect the minimum personal data needed to operate the product, and to be specific about what that data is and where it goes. This policy explains both.
For an engineering-level explanation of how telemetry, your AI provider key, and your Blueprint code are handled, see Data & Security.
1.Who we are
Kismet is operated by Individual Entrepreneur Artem Tarasov, registration № 72930421, registered office at 002, 5 Deghatan str., Yerevan, Republic of Armenia (“Kismet,” “we,” “us”). Kismet is the data controller for personal data described in this policy. Contact: legal@kismetai.io.
Kismet is an independent product. It is not affiliated with, endorsed by, or sponsored by Epic Games, Inc. Unreal Engine and Blueprint are trademarks of Epic Games, Inc.
2.What this policy covers
This policy applies to:
- The Kismet plugin for Unreal Engine (the “Plugin”) when it sends telemetry, error reports, or bug submissions to our servers.
- The Kismet website at kismetai.ioand the authenticated dashboard (the “Site”).
The Plugin also calls AI providers (currently Anthropic) directly from your machine using your own API key. That communication is covered by your provider’s privacy policy, not this one. See §8.
3.Personal data we collect
3.1 Account data
When you create a Kismet account on the Site, we collect:
- Your email address (required).
- An optional display name you choose.
- If you sign in with a third-party identity provider (e.g., GitHub), the provider’s user ID and any profile fields they expose for our scopes.
- A password hash if you set a password (we never store passwords in plaintext).
3.2 Plugin installation data
When you authorise the Plugin to talk to your account, we collect and link to that account:
- A machine identifier generated locally and stored in
~/.kismet/machine_id(a random UUID — not your hostname or hardware serial). - Your operating system family (Windows, macOS, Linux), Unreal Engine version (e.g., 5.7), and Plugin version.
- A bearer token hash (SHA-256) used to authenticate the Plugin. The plaintext token exists on our servers only briefly, between the moment you claim a device code in your browser and the moment the Plugin polls for it (a window of seconds), then it is deleted.
This metadata is required for the Plugin to identify itself to your account; it cannot be opted out of without disconnecting the Plugin.
3.3 Plugin telemetry
The Plugin sends usage telemetry to your account. Telemetry is split into four categories that you control independently in Settings → Telemetry:
- Runs— agent-run transcripts: the model used, your initial prompt, the assistant’s replies, the names and arguments of tools the agent called, token counts, duration, and computed cost in USD. The actual contents of your Blueprints are redacted before storage. See §4.
- Tool calls — granular per-tool metrics: tool name, success/failure, duration. Used to debug agent behaviour.
- Errors — warnings and errors logged by the Plugin: a category, message, source file and line, and a stack trace.
- Crashes— if the Unreal Editor crashes while the Plugin is loaded, a crash report including the signal type, call stack, the editor’s crash-context XML, and the last ~32 KB of the editor log.
Each category can be disabled independently. With all four off, no run, tool, error, or crash data leaves your machine. A small set of essential events (plugin loaded / unloaded, last-seen timestamp on your machine row) is always sent so the dashboard knows the Plugin is connected.
Whether or not telemetry is sent to our servers, the Plugin also writes a local-only file at <Project>/Saved/Logs/KismetAI-telemetry.jsonl for your own debugging. That file stays on your disk; it is not transmitted unless you attach it to a bug report.
3.4 Bug reports
If you submit a bug report from the Plugin or the Site, we collect: the description you write, a session identifier, and any telemetry snippet you choose to attach (capped at ~1 MB). Bug reports do not respect the per-category telemetry toggles — sending a bug report is implicit consent to share the contents you wrote. Avoid pasting secrets into bug descriptions.
3.5 Demo and contact requests
If you fill in the demo or contact form on the Site, we collect the fields you submit (name, work email, optional company, role, team size, and use-case description), the form’s source page, and your browser user-agent string (used for spam triage). We do not store your IP address against the form record. Your IP is briefly processed by our rate-limiting layer (Upstash; see §7) to prevent abuse, but it is not written to the demo or contact tables.
3.6 Waitlist data
If you join the waitlist via the sign-in page, we store your email address and the timestamp of your submission. We do not log your IP address against the waitlist record. Waitlist records are deleted no later than 12 months after submission or when you create an account, whichever comes first. Legal basis: consent (the checkbox on the waitlist form).
3.7 Cookies and similar technologies
The Site uses a small number of strictly-necessary cookies and does not use third-party analytics, advertising, or tracking cookies:
- Authentication cookies (set by Supabase Auth) keep you signed in.
- kismet_landingis a session cookie that pins you to the marketing site when you click “Back to kismetai.io” from inside the dashboard.
3.8 What we do not collect
We do not collect, and our Plugin does not transmit:
- Your AI provider API key. The Plugin stores it locally and uses it to talk to the provider directly. It never passes through Kismet servers.
- Your Blueprint or C++ source code. Tool-result payloads that contain Blueprint contents (T3D, describe-graph dumps, edits) are redacted before storage on our servers. See §4.
- Your Unreal project files. Beyond the Blueprint asset path of a run target (which is a string like
/Game/AI/MyBlueprint), we do not receive your project contents. - Special-category data (health, biometric, religious, political, etc.). Please do not put such data into prompts, bug reports, or demo forms.
- Data from users we know to be under 18.
4.Blueprint redaction
The agent loop reads and edits Blueprints on your machine. The full tool input/output (including the underlying Blueprint T3D text) is visible to the AI provider, since it is needed for the agent to reason about your graph. It is not visible to us.
Before any agent message is written to our database, our telemetry ingestion endpoint removes the body of any tool_result block whose tool was read_blueprint, write_blueprint, or edit_blueprint, replacing it with a redaction marker. We keep the agent’s intent (which tool it called, with what arguments) so we can investigate failures, but the Blueprint bytes themselves are dropped at the boundary.
The same is not true of crash reports and editor log tails — those may contain incidental file paths, asset names, or fragments of serialised data. We do not parse them for content; we read them only when investigating a specific crash you have asked us to look at.
5.How we use personal data
We use the data described in §3 for the following purposes:
- To run the service — authenticate your account, issue and validate Plugin device tokens, deliver the dashboard, serve the auto-updater manifest.
- To compute and display your usage and cost — tokens, runs, models, and USD spend on your dashboard.
- To debug and improve Kismet — investigate errors, crashes, and failure patterns; reproduce bugs you report.
- To respond to you — reply to demo, contact, and support messages; send transactional emails (sign-in links, account-deletion notices).
- To prevent abuse — detect and stop automated sign-ups, scraping, and rate-limit violations.
- To comply with the law — respond to lawful requests, enforce our Terms, defend ourselves in disputes.
Legal bases (where GDPR/UK GDPR applies): performance of contract for service operation; legitimate interests for debugging, abuse prevention, and product improvement; consent for any future marketing communications.
6.AI training
We do not use your prompts, the assistant’s replies, or any Plugin telemetry to train, fine-tune, or evaluate AI models — ours or anyone else’s. We do not permit third parties to use this data to train their models. The only exceptions are:
- Content you explicitly report to us as feedback or as part of a bug report;
- Content flagged for security or abuse review (used to investigate the specific incident, not to train models);
- You explicitly opt in.
We may compute aggregate, de-identified statistics (e.g., “average tokens per run by model”) for our own product analytics. We do not attempt to re-identify de-identified data.
7.Sharing and recipients
We share personal data only with vendors that operate the service on our behalf, under written terms that restrict their use of the data:
- Supabase, Inc. — managed Postgres, authentication, and serverless-functions hosting. Stores all account, telemetry, and bug-report data described above.
- Vercel Inc. — hosts the Site and processes ordinary HTTP-request metadata (IP, user agent, path) in its access logs. Vercel also collects anonymised web-vitals performance data (page load timing, route, country, anonymised IP) via Speed Insights for our own performance monitoring; no cookies are set, no cross-site identifiers are used, and the data is not sold or used for advertising.
- Upstash, Inc. — hosted Redis used to rate-limit abuse-prone endpoints (login, plugin device-code start/poll, demo and contact forms, password set). Upstash briefly processes your IP address as a rate-limit key and a counter that expires within minutes. We do not store any persistent personal data in Upstash.
- Cloudflare R2 — stores Plugin release archives (no personal data).
We may also disclose personal data:
- To a successor entity in connection with a merger, acquisition, financing, or sale of assets;
- To government, regulatory, or law-enforcement authorities when we are legally compelled, or to enforce our Terms or protect our rights;
- With your explicit consent.
We do not sell your personal data and we do not allow it to be used for cross-context behavioural advertising under U.S. state privacy laws.
8.AI provider relationship (BYOK)
Kismet uses a bring-your-own-key model. The Plugin calls Anthropic directly from your machine using the API key you provide. From a data-protection standpoint:
- Your direct relationship with Anthropic governs whether and how Anthropic processes your prompts and code. Their policies apply, not ours, to that traffic. See anthropic.com/legal/privacy.
- Your API key is not transmitted to or proxied through Kismet servers and is not logged by us.
- We are not a sub-processor of Anthropic in respect of your prompts. Anthropic is not our sub-processor for the prompt traffic either.
When the Plugin sends usage telemetry to us (separately from the call to Anthropic), the Blueprint-redaction rule in §4 applies.
9.International transfers
Kismet operates from Armenia. Our hosting providers (Supabase, Vercel, Cloudflare) operate primarily from the United States and European Union. By using Kismet you understand your data may be stored or processed in those jurisdictions. Where required by EU/UK law we rely on Standard Contractual Clauses with our processors.
10.Retention and deletion
Account data, telemetry, and bug reports are retained for the life of your account. Run transcripts, events, error logs, and crash reports do not auto-expire.
Demo and contact-form submissions are deleted no later than 12 months after submission unless they have led to an ongoing customer relationship.
Account deletion. You can request deletion at any time from Settings → Account. We mark the account for deletion and immediately revoke all Plugin tokens. Hard-deletion runs on a monthly schedule, so the actual purge happens within roughly 30 to 60 days. During that window you can sign in and cancel the deletion. Once purged, the cascade removes your profile, machines, runs and run messages, events, error logs, crash reports, and tokens.
We may retain a minimal record of the deletion event itself (e.g., for fraud or legal-defence purposes) after the underlying account is gone.
11.Your rights
Depending on where you live, you may have rights to access, correct, port, delete, or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. You can exercise most of these from the dashboard (Settings → Account). For anything else, write to legal@kismetai.io and we will respond within 30 days.
If you are in the EU/UK and unhappy with our response, you may complain to your local data-protection authority. If you are in California, you have additional rights under the CCPA/CPRA; we do not sell personal data or share it for cross-context behavioural advertising.
12.Security
We use industry-standard measures to protect personal data, including row-level security on all user-data tables, hashed credentials and Plugin tokens (SHA-256), TLS in transit, encrypted storage at rest with our hosting providers, and least-privilege administrative access. See Data & Security for the technical details.
Because Kismet is currently operated by a sole proprietor, administrative database access is held by the operator alone and is not delegated to anyone else. The operator accesses stored data only when necessary for support, abuse investigation, security incidents, or legal compliance. We are working on per-query audit logging for that access; until it is in place we ask you to take this disclosure as the honest description of our current setup.
To report a vulnerability, write to legal@kismetai.io with subject “security”. We acknowledge reports within five business days.
13.Children
Kismet is not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, write to legal@kismetai.io and we will delete it.
14.Changes to this policy
We will update this page when our practices change. The effective date at the top of the page reflects the last change. Material changes will be announced in the dashboard or by email at least 14 days before they take effect.
15.Contact
For privacy questions, data-subject requests, vulnerability reports, or anything else legal: legal@kismetai.io.
Postal address: Individual Entrepreneur Artem Tarasov, 002, 5 Deghatan str., Yerevan, Republic of Armenia.