knownAs.dev privacy policy

Version 1.2 · Effective date: 17 October 2026

1. Who we are

knownAs.dev is operated by Authecity Systems LLC, a Minnesota limited liability company, 1650 West End Blvd., Suite 100, St. Louis Park, Minnesota 55416, USA ("we", "us").

We are the controller of the personal data described here.

Contact for anything about your data: privacy@knownas.dev

Who the service is open to: during the private beta, people anywhere except in the European Union or the European Economic Area (the EU countries plus Norway, Iceland and Liechtenstein), Switzerland or mainland China, or in a country or region under comprehensive United States sanctions (the beta addendum has the detail).

People in the United Kingdom can join once we have appointed our UK representative, who will be named here. Before we open to people in the EU or the EEA, we will appoint an EU representative and name them here too.

2. What this policy covers

the website at knownas.dev;
the console at console.knownas.dev;
the knownAs.dev API;
the agent identities you create: their names, addresses and public profiles.

3. The information we collect

Category	What	Where it comes from
Account	Your email address, and a name or display name if you give one	You, when you sign up
Sign-in and credentials	Single-use sign-in links, sessions, and API keys. We store only one-way hashes of links, sessions and keys, never the secrets themselves. We keep the names you give your keys	Created when you sign in or make a key
Your agent identities	Each agent's name (its address, e.g. `your-agent.knownas.dev`), display name, description, contact email and service addresses	You. Each agent's public profile is published on the internet by design. See section 5
Domain verification	Each domain you ask to verify, the record we asked you to publish, and the dates of each check. We read the record through two public DNS services (Cloudflare and Google), which see only the record's name, not who you are	You, when you start a check in the console; then our hourly re-check
Security and audit records	A record of actions on your account and agents. For each: when, what, and which credential. At the time of the action, also the IP address and browser type	Created automatically as you use the service
Technical logs	Request logs, which include IP addresses	Created automatically
Your agreement to our documents	Which version of these terms and this policy you accepted, a fingerprint (SHA-256) of the exact text, when, and from which IP address	Created when you sign up or accept an update
Your plan	If you buy one: the identifiers Stripe gives your customer record and subscription, the plan's status, its number of seats, yearly or monthly, and when the current period ends. For accounts that existed when paid plans started: a founder mark (the date the account was created), the founder allowance and its end date. Which plan reminders we have sent you. No card details, billing address or amounts	Stripe, when your plan starts or changes; and us
Payment details	Your card, billing name and address, any tax ID you add, and your invoices and receipts. You enter them on Stripe's pages, and Stripe holds them; we never see your card number. We give Stripe your account's email address and its identifier (for example `acct_…`) so that it can link your payment to your account	You, on Stripe's pages
Early access	Whether you asked to be invited to test new features, and when. Off unless you turn it on	You, in the console
Waitlist	Your email address, and a name if you give one	You, if you join the waitlist on knownas.dev
Messages you send us	Whatever you write to our addresses	You
Website visits	Through our own, self-hosted analytics (Umami): pages viewed, the referring page, browser and device type, screen size, language, and approximate location (country and region) derived from your IP address at the time. It sets no cookies and does not store your IP address. Visits are grouped using a one-way identifier computed from your browser details and a secret that changes regularly, so they can be counted without storing your IP address. It honours your browser's Do Not Track setting	Automatically, when you visit knownas.dev
Mail delivery problems	If a message we send to an address bounces or is marked as spam, a record so that we stop sending to it	Our email provider

We do not collect card details (Stripe does), precise location, or special-category data. We do not look inside your agents: we never see their conversations, prompts, or data.

4. Why we use it, and our legal basis

Purpose	Legal basis (GDPR / UK GDPR)
Providing the service: your account, sign-in, and running your agents' identities	Contract: it is needed to provide what you signed up for
Keeping the service secure: audit records, abuse and fraud prevention, rate limits, protecting the shared `knownas.dev` namespace	Legitimate interests: a secure service that others cannot abuse
Sending service messages: sign-in links, security notices, changes to these documents	Contract, and legitimate interests
Taking payment for a plan you buy, and keeping your plan in step with Stripe	Contract
Keeping invoices and payment records	Legal obligation: tax and accounting law
Inviting you to test new features, if you turned on early access. Never marketing, and every invitation has a one-click way to turn it off	Consent. Turn it off at any time in the console, or with the link in any invitation; it stops at once
Inviting you from the waitlist	At your request, to take steps before a contract
Understanding how many people visit the website, in aggregate	Legitimate interests
Keeping records of what you agreed to	Legal obligation and legitimate interests
Stopping mail to addresses that bounce or complain	Legitimate interests: not sending unwanted mail

We do not sell your personal data, share it for advertising, or use it to train AI models.

We do not currently use your data for research or statistics. If we ever do, it will be only in aggregate form that identifies no person or agent. We will update this policy first and give you a way to opt out.

5. What is public

Your agents' public profiles are public on purpose. That is what the service provides. Anyone on the internet can read an agent's name, display name, description, service addresses and contact email at the agent's address (/.well-known/agent.json). Put only what you are happy to be public into a profile. When you delete an agent, its profile is removed from public view at once.

What your agents publish about you, the owner. Every one of your agents' public profiles also says:

each domain you have verified, and when it was verified and expires;
that your email address was verified, and when. The address itself is never published;
the date your account was created.

It says nothing else about you: not your name, not your email address. A verification that lapses or that you withdraw disappears from every profile. Verifying a domain is always your choice: nothing about a domain is published unless you start a check and it passes.

6. Who we share it with

We share personal data only with service providers who process it for us, under contract:

Provider	What for	Where
Amazon Web Services	Hosting, databases, storage, and sending our emails	United States (Ohio)
IONOS	Hosting our own mailboxes, e.g. privacy@ and ops@	United States
Our self-hosted analytics	Website visit counts (no cookies, no IP addresses stored), on our own server at Amazon Web Services	United States (Ohio)
Stripe	Taking payments for plans: its checkout and billing pages, cards, subscriptions, invoices, receipts and payment emails, tax calculation, and fraud prevention. For fraud prevention and its own legal duties, Stripe decides how it uses the data itself, under its own privacy policy	United States, and other countries where Stripe operates
Anthropic	An AI assistant (Claude) that helps us build and operate the service, used under Anthropic's consumer terms with model training switched off for our account. See section 12	United States

We may also disclose data if the law requires it, or to protect the safety and security of our users, the service or the public. We will tell you where the law allows.

7. International transfers

We are based in the United States. You give us your data directly when you sign up and use the service, and it is stored in the United States, with the providers in section 6. We do not send it on to other countries.

If you buy a plan, Stripe processes your payment details in the United States and in other countries where it operates, under its own safeguards for international transfers.

If that changes, for example if we store data elsewhere or use a provider in another country, we will put a lawful transfer mechanism in place first and describe it here.

8. How long we keep it

Data	How long
Your account and agent identities	Until you delete them, or ask us to
After you ask for deletion	Your account is switched off at once, and erased from our systems within 30 days, except where the law requires us to keep something longer (see below). Backups age out within 35 days, as the last row says. If you have a plan, it is set not to renew (terms of use, section 9)
Your plan record, founder allowance and early-access choice	For the life of your account. Deleted when your account is erased. Early access is removed as soon as you turn it off
Your payment details at Stripe	For the life of your account. When your account is erased, we delete your customer record at Stripe, which removes your card, billing address and tax ID
Invoices and payment records	Kept by Stripe, in our Stripe account, for as long as tax and accounting law requires. They are not deleted when your account is erased. An invoice shows the billing name, address and email address it was issued to
Security and audit records	The record of what happened is kept, because it protects everyone. When your account is erased, your email address, IP addresses, browser details and any domain you asked us to check are removed from those records. For everyone, IP addresses in them are shortened and browser details removed after 90 days
Technical logs	Up to 90 days
Sign-in links	20 minutes, or until used
Sessions	Until they expire or you sign out
Domain verifications	For the life of your account, including ended checks, so you can see their history. Deleted when your account is erased, and the domain is removed from the security records too
Waitlist entries	Until 14 days after we invite you, or at most 12 months if we do not. Deleted at once if your account is erased
Invitations	An unused invitation, including one we withdrew, keeps the address it was sent to until it expires (14 days), and is then deleted. A used one keeps no address: only which account it created, and who issued or approved it
Records of what you agreed to	For the life of your account, and then 6 years as proof: the period in which a claim about the agreement can be brought under Minnesota law. When your account is erased, the IP address in them is removed
Addresses that bounced or complained	Kept so that we never mail them again. If your account is erased, the address is replaced by a scrambled fingerprint (a keyed hash), which still stops the mail without keeping the address
Backups	Rolling backups are overwritten within 35 days. We never restore erased data

Where the law requires us to keep data longer, for example records of what you agreed to, or what we need to establish or defend a legal claim, we keep only that data, only for as long as required, and use it for nothing else. Everything else is erased on the timetable above.

The name your agent used (e.g. your-agent) is held for 30 days after deletion, without any contact details, so that nobody can immediately re-register it to impersonate your agent.

9. How we protect it

Encryption: in transit (HTTPS everywhere) and at rest (every database, file store, queue and message topic).
Hashing: sign-in links, sessions and API keys are stored only as one-way hashes.
Administration: access requires multi-factor authentication, and every administrative action is recorded in a tamper-evident log.
Audit records: the application itself cannot alter them.
Least privilege: each part of the system can reach only what it needs.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

10. Your rights

Depending on where you live (including the UK, the EU, and US states such as Minnesota and California), you may have the right to:

access your data, and receive a copy in a portable format;
correct it;
delete it;
restrict or object to our use of it;
withdraw consent where we rely on it;
not be discriminated against for exercising these rights.

How to use them:

In the console: download your data, or delete your account. The download includes your plan record. Your card details and invoices are held by Stripe: see and download your invoices under Manage billing.
Or email privacy@knownas.dev from your account's address.

We answer within one month. We may need to confirm the request comes from you.

If you are in the UK or EU, you can also complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put things right first.

11. Automated decisions

Some decisions in the service are made automatically, by fixed rules that we wrote and can explain, not by AI models. They exist to protect the shared knownas.dev namespace and the people who rely on it:

Control	What it decides	The logic, in plain words
Name checks	Whether a requested agent name is allowed	Refused if it is a platform name, imitates a protected brand (including lookalike spellings and brand-plus-word names), or breaks the naming rules
Invitation check	Whether a new account can be created	Allowed only with a valid invite
Rate limits and quotas	Whether a request goes ahead, and whether an agent is suspended for exceeding its account's quota	Counts requests and identities against published limits
Plan allowance	Whether an identity is suspended because the account holds more than its allowance	From the day paid plans start, the allowance is one free identity, plus your paid seats, plus any founder allowance. When a plan ends, has fewer seats, or a payment fails, the newest identities beyond it are suspended; paying brings them back, oldest first (terms of use, section 9)
Mail suppression	Whether we send email to an address	We stop if mail to it bounced or was marked as spam

None of these is profiling, and none uses AI. Their effect is on your use of the service, not on your legal rights. Still, you can always:

ask for a person to review any automated decision;
be told the reason for it, and the data it relied on;
correct that data, and have the decision looked at again;
contest it.

Write to privacy@knownas.dev. We do not use automated decision-making or profiling for marketing, pricing, or anything that affects your access to employment, credit, housing, insurance, education, healthcare or legal services.

12. Artificial intelligence

We want to be plain about where AI is and is not involved.

What is true today:

The service does not use AI to analyse your data, or to make any decision about you. The automated controls in section 11 follow fixed rules.
We do not use AI for "consequential" or "significant" decisions about anyone: employment, credit, housing, insurance, education, healthcare, legal or essential services. We use no high-risk AI system, as those laws define it.
We never use your data to train AI models, ours or anyone else's. Model training is switched off on our account with Anthropic, the provider of the AI assistant we use (Claude), so our use of it does not train its models.
We offer no AI chatbot or other AI system that interacts with you. Everything you read from us was written or approved by a person. If you ever ask whether you are dealing with an AI, we will answer honestly.
Your agents are yours. knownAs.dev gives your AI agents an identity. We do not see or process what your agents say or do, their prompts, or their data.

The AI we use to run the service:

We use an AI assistant, Anthropic's Claude, working under our direction, to help build and operate the service.
When it helps operate it, for example investigating a fault or a failed sign-in, it may see personal data such as account email addresses and security records, as one of our staff would.
It works under the same access controls and records as we do, only for the task in hand, and never to make decisions about you.
The people who direct it are trained to use it responsibly.

Our promises about the future:

Nothing new without telling you first. Before any feature uses AI on your data, we will update this policy and email account holders. We will say what data it uses, why, and which provider runs it.
Your consent for new uses of data we already hold. We will not start using data we already hold for AI training, or for any new AI purpose, without first asking for and receiving your agreement. A changed policy alone is not enough.
An opt-out for any AI feature that uses your data, wherever the law requires one, and wherever we reasonably can otherwise.
Labels on anything an AI produces or says to you, if we ever offer an AI chatbot, assistant or AI-generated content to users.
One feature we may add: sorting agents' public descriptions into categories for aggregate statistics, using an AI model. Only the category would be kept, never the description, and the provider would not keep the text either. It would be announced first, as above.

13. Regional notes

These notes add to the rest of this policy for people in particular places. Several of these laws apply only to organisations above size thresholds that we do not meet today. We honour these rights for everyone anyway.

UK, EU and EEA (UK GDPR / GDPR):
- Our legal bases are in section 4, and your rights are in section 10.
- You have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (Art. 22). Section 11 explains our automated controls, and how to get a person to review them.
- You may complain to your supervisory authority; in the UK, the ICO.
- The service is not yet open to people in the EU or EEA. People in the UK can join once our UK representative is named in section 1.
EU AI Act: we deploy an AI assistant internally (section 12). We provide no AI system that interacts with you or generates content for you. If we ever do, we will tell you that you are dealing with an AI, and label AI-generated content, as Article 50 requires. We use no prohibited practice and no high-risk AI system.
California (CCPA/CPRA):
- The categories we collect, and why, are in sections 3 and 4.
- We do not sell or share personal information, as those terms are defined, and we do not use sensitive personal information to infer characteristics.
- We do not use automated decision-making technology to make significant decisions about consumers.
- You may exercise your rights to know, delete, correct and not be discriminated against through section 10, directly or through an authorised agent.
Colorado (the Colorado AI Act, and the Colorado Privacy Act): we deploy no high-risk AI system and make no consequential decisions using AI. We offer no AI system intended to interact with consumers. If that changes, we will disclose it as the law requires.
Minnesota (the Minnesota Consumer Data Privacy Act): if a decision was made by profiling you, you may question the result, be told the reason and the data used, correct inaccurate data, and have the decision re-evaluated. We do not profile you. The process in section 11 is available for any automated decision.
Utah (the Utah Artificial Intelligence Policy Act): we provide no generative AI that interacts with you. If you ask whether you are interacting with AI, we will tell you truthfully, and any future AI chat will say so clearly at the start.
Other US states with comprehensive privacy laws (such as Virginia, Connecticut, Texas and Oregon): the rights in section 10 are available to you, including appeal. If we decline a request, you may appeal by replying to our decision, and we will answer within the time your state's law allows.

14. Cookies and browser storage

We use no advertising or tracking cookies.

The console keeps your sign-in session and a setting or two in your browser's storage. That is strictly necessary for it to work, and it is never used to track you.
The website's analytics set no cookies.
Stripe's checkout and billing pages are Stripe's, not ours. Stripe uses its own cookies there, for security and fraud prevention, under its own policy.

15. Age

knownAs.dev is for people 18 and over. You confirm this when you sign up. If we learn that we hold data about someone under 18, we delete it.

16. Changes to this policy

If we make a material change, we will email account holders at least 14 days before it takes effect, and ask you to accept the new version. Each version is dated, and we keep a record of which version you accepted.

17. Contact

Authecity Systems LLC 1650 West End Blvd., Suite 100 St. Louis Park, Minnesota 55416, USA

privacy@knownas.dev. For security issues: security@knownas.dev.