Kong Reviews

Privacy

Last updated 26 October 2026.

Using Kong Reviews without an account

The website's public pages work without signing in. Planning or auditing on the website, and the MCP tools in your AI app, need a free account. When you or your AI assistant ask a question, the text you send (for example a product description or PRD) is used to work out the answer and then discarded. It is not stored.

To audit an app that's already built, the files you add (or the files of a GitHub repo you name, or the home page and response headers of a website you name) are read on our server only to find which services the app uses, then discarded. Nothing from them is stored. To audit a private repo, you can install the Kong Reviews GitHub App on the repos you choose: it can only read them. We keep the ids and account names of your installations so we can read those repos when you ask; each read uses a token from GitHub for that one repo that lasts an hour and isn't stored. Disconnect in the Audit tab forgets them, and uninstalling the app on GitHub removes its access. Paste environment variable names, not their secret values.

Kong Reviews reads PRDs with keyword rules on its own servers. It does not send your text to an AI provider. If that ever changes, this page will say so first.

If you sign up for the Showcase digest (on the Showcase or the Newsletter page), we email the address a link to confirm it and keep nothing until you open it. Then we keep the address, whether you chose daily or weekly, the last day we sent you, and a random token for the unsubscribe link. The address is used only to send the digest, through Resend, our email provider, never for anything else. It isn't tied to an account, so it stays until you unsubscribe: every digest has a one-click unsubscribe link, which deletes the address.

If you use "Request a vendor", we store the vendor name you type, and your account if you are signed in, so we can see which services people want added.

If you arrive from a link we posted that carries utm_source and utm_campaign tags (for example from LinkedIn or our newsletter), we add one to a daily count for those two tags. Your browser keeps the two tags for 30 days, and if you then create an account in the same browser, we add one to that campaign's sign-up count. We store only the counts: no ids, addresses or cookies.

Our server logs record each request's method, path, status and duration, but not its contents. Your IP address is used in memory for rate limiting and is not stored. AI apps may send a one-line summary of the task (task_intent); we log it with email addresses, links and long numbers removed, to learn what people use Kong Reviews for.

With an account (saved stacks)

Saving stacks needs an account. You can sign up with GitHub or GitLab, or with your email address and a 6-digit code we email you (no password). The website and your AI app use the same account. Then we store:

  • With GitHub: your GitHub account id, username and display name. Sign-in asks GitHub for no permissions beyond your public profile, so we can't see your repositories, and GitHub doesn't give us your email address.
  • With GitLab: your GitLab account id, username and display name. Sign-in asks GitLab only to read your profile (the read_user permission). We don't keep the access token, and we don't store your GitLab email address.
  • Connected sign-ins. You can connect GitHub, GitLab and email to one account, so any of them opens it. If you connect one that already had its own account, we ask before merging the two: its saved stacks, bills and connections move to this account and the other account is deleted.
  • With email: your email address and the name you give us, if any. The address is how you sign in, and it becomes your alert email unless you choose another. Sign-in codes are stored only as one-way hashes and expire after 10 minutes. The same code also signs you in to Changes (community review). If the address is already your confirmed alert email on a GitHub account, signing in by email opens that account.
  • Your saved stacks and audits: the name you give each one, the plan or audit inputs (services, plans, user numbers and requirements), the costs when you saved it or last updated its users, its share link, whether alerts are on, which alerts we have already sent for it, and any bills you add to it (month, service and amount). Bills you add without a stack are kept on your account the same way. For a subscription you add, we keep its name, monthly amount, start month and where its bills go, and record its bill each month until you stop or delete it. If you forward an email to your private bills address, our email provider (Resend) receives it and we read its text once to find the bill, the same way as a pasted invoice; we keep the bill and, for your list of recent emails, its sender, subject and when it came, not the email itself. When you paste an invoice, we keep only the bill read from it, not the invoice text. If the site is set up with an AI model for reading, the invoice text is sent to that model provider (OpenRouter or Anthropic) for this one reading. A PDF invoice is read in your browser: the file never reaches us, only its text, as above.
  • Billing accounts you connect: the read-only key you give us (for OpenAI, Claude, Vercel, Stripe, AWS or DigitalOcean), encrypted when stored, its first and last few characters so you can tell which key it is, which saved stack its bills go to (or none), and when it last synced. We use the key only to read what the account was charged each month, once a night and when you press Sync Now, and save those monthly totals as bills on that stack, or on your account when it has none. Disconnect deletes the key straight away; the bills it added stay unless you choose to remove them too.
  • Your alert email, if you add one: the address, when you confirmed it, and a random token for the unsubscribe link. We also keep which kinds of alert you chose in Settings → Notifications. The address is used only to send the confirmation link, the alerts you turned on and a test email when you ask for one, never for marketing, and it is sent through Resend, our email provider. Every alert has a one-click unsubscribe link, and Change in Settings → Email (or on My Stacks) replaces the address.
  • Likes: which Showcase products and Build Library builds you liked, and when. Everyone sees how many likes something has, never who liked it; you see your own under Settings → Likes. They are deleted with your account.
  • Builds you share to the Build Library: the saved stack you chose (its services, plans, user numbers and requirements), the project name, description and kind of app you give, the name and links you want it credited to, and when you ticked the contribution agreement and which version. All of this except the agreement is public on the build's page. You can edit or delete it at any time, and it is deleted with your account.
  • Flags: when you flag someone's shared build, the reason, any details you add, and that it was you, so one person counts once. The author never sees who flagged it; our admins do, to review it.
  • Sign-in records: the name and return address of each AI app you connect, and your access tokens. Tokens are stored only as one-way hashes and expire (access after 1 hour, refresh after 30 days).
  • Activity: while you're signed in (on this website, through an AI app, or with an emailed code), each sign-in and each tool you use: the tool's name, the time, whether it was the website or which AI app, and whether it worked, never what you typed or what came back. For sign-ins we also keep your browser's user agent (its name, version and operating system). Our admins use this to see how Kong Reviews is used and to help you if something goes wrong, and can add a private note to your account. It is deleted with your account.
  • Website sign-in: when you sign in on this website, one cookie (kr_session) keeps you signed in for up to 30 days. It holds a random value we store only as a one-way hash, and is deleted when you sign out.

Where it's kept, and who sees it

Everything runs on DigitalOcean in New York, USA, in an encrypted PostgreSQL database. We don't sell or share your data, and there are no ads. To count visits we use Plausible Analytics, which sets no cookies and stores no personal data or IP addresses: it records the page address (without its query string, except campaign tags such as utm_source), what the page was about (for example which vendor, service or Showcase startup, the tab, and list filters such as a category, but never what you type into a search), the referring site, your browser, device type and country, and a few events such as planning or saving a stack, never their contents. The campaign tags of the link that brought you are kept in your browser's local storage for 30 days, so later events are credited to it; they never leave your browser except with those events. The admin section isn't counted. The only cookie is the sign-in cookie above, set only if you sign in on the website. The website loads its fonts from Google Fonts, which sees your IP address when it serves them.

Share links and README badges contain your plan or audit inputs (services, plans, user numbers and requirements), so anyone you send a link to, or who sees the badge, can see them.

Deleting your data

  • Ask your AI assistant to delete a saved stack (delete_saved_stack) or your whole account (delete_account). Deleting the account removes your GitHub link, your alert email, every saved stack and your activity record straight away.
  • Or sign in on this website and use the Account page: it lists the AI apps you connected, lets you disconnect each one, and has a button to delete your account.
  • To stop an AI app using your account, disconnect it on the Account page or in that app. You can also revoke Kong Reviews in your GitHub settings under Applications.

Contact

Questions about your data, or a request we should handle for you: email [email protected].