What we collect
Your email address. It is how you sign in and how we reach you. If you sign in with Google or GitHub we also receive the name and avatar on that account. We only accept an address the provider has verified.
What you draw. Models, concepts, relations, folders, comments and their edit history. This is the content of the product, and it belongs to the workspace it was created in.
What your agents do. Koncept exposes an MCP server, so an AI agent can read and write your models on your behalf. Those writes are stored exactly like a human's, attributed to the API key or the account that authorised them.
Operational records. API keys are stored as SHA-256 hashes, never in the clear. Our infrastructure providers keep ordinary server logs, which include IP addresses.
We do not use advertising trackers, we do not sell anything to anyone, and we do not use your models to train machine-learning systems.
Who else processes it
Running Koncept means a handful of companies necessarily touch your data. This is the complete list.
Convex stores the database and runs the backend, in the EU (Ireland). Cloudflare serves this website and the application, manages DNS, and forwards mail sent to our addresses. Resend delivers the transactional email we send you: sign-in links and workspace invitations. GitHub stores our encrypted database backups. Google and GitHub also handle sign-in, if you choose those buttons rather than an emailed link. Stripe will handle payment when paid plans open; it is not active today, and we never see your card details.
How long it lasts
Sign-in links expire after 15 minutes and work once. A session lasts up to a year, and ends after 30 days without use.
Deleting a workspace is reversible for 30 days. Access is cut immediately; after the window closes, every model, every revision, every comment and every key belonging to it is permanently erased. There is no copy left behind.
Deleting your account erases your identity, not your team's work. Your name and email are removed. Models and comments you wrote stay in the workspaces they belong to, credited to Deleted account, so that one person leaving does not destroy what a team built together. If you want that content gone too, delete it before deleting your account, or ask the workspace owner.
Backups are kept for 30 days and then expire on their own. A deletion therefore takes up to 30 days to disappear from every backup, which is the normal cost of being able to recover from a mistake.
Getting your data back
Settings → Danger zone → Export everything downloads every model in a workspace as one JSON file, archived ones included, in the same format a single model exports in. No request, no waiting, no asking us.
The same page is where you transfer a workspace, leave one, delete one, or delete your account. We built the export to sit above the deletion buttons on purpose: "delete everything" is only a fair offer when "take everything with you" is right next to it.
Your rights
If you are in the EU or the UK, the GDPR gives you the right to access your data, correct it, delete it, take it elsewhere, and object to how it is handled. The export and deletion tools above cover most of that without involving us at all. For anything they do not cover, write to us and we will answer.
Children
Koncept is a tool for work and is not directed at children under 16. We do not knowingly collect their data.
Changes
If this page changes in a way that affects you, we will say so here and update the date at the top. We will not quietly broaden what we do with your data.
Contact
Write to [email protected]. A person reads it.