Privacy Policy

Last updated: November 8, 2026

Komla is a desktop application developed and operated by Tafjord Invest AS ("we", "us", "our"), a company registered in Norway. This policy explains what data we collect, why, and how we handle it. Komla never sends us your code, files, project names, or AI agent conversations.

1. Data We Collect

App telemetry (always on):

• To count installs and active users, Komla sends a one-time install ping and a daily heartbeat containing: app version, operating system, CPU architecture, the name of the AI agent you have selected, and whether it is the first heartbeat of the week and of the month (so we can count weekly and monthly active users without an identifier). When you have not opted in to usage analytics, these contain no identifier — they are counted, not linked to you or to each other.
• When you add an SSH host, Komla reports where in the app you started (for example the Tips menu) with your app version, operating system, and CPU architecture, on the same anonymous basis. It never sends the host's name or address.
• Every report above, and the opt-in reports below, also says whether Komla is an official build downloaded from our website or one built from its source code.
• Komla checks for updates and in-app announcements. These requests carry no personal data beyond what any web request includes (such as your IP address).

Usage analytics (opt-in):

• Komla asks whether you want to share usage analytics. Only if you agree, Komla adds a random, app-generated telemetry ID to the telemetry above and sends a daily usage summary: workspace counts by state, counts of workspaces, agent tabs and quick commands created, project setup adoption, sandbox (Lima VM) usage, terminal shell type, and AI utility request counts. It also reports which agent you picked during setup and the first time you use an integration (agent notifications or MCP tools).
• You can change this at any time in Settings → Privacy. Turning it off deletes pending usage data on your device and stops the telemetry ID from being sent.

Error reports:

• When Komla encounters an unexpected error or a process crash, it sends an error report containing the error message, up to 10 lines of stack trace, app version, platform, architecture, and selected agent. Before sending, Komla removes your home directory, username, hostname, email addresses, URL credentials, and common API token formats. You can turn error reporting off in Settings → Privacy.

AI utilities:

• Komla's AI utilities generate workspace names, descriptions, and branch names from the prompts you give a new workspace, and generate commit messages from your staged diff when you ask for one. With the default "Komla managed" provider, this text is sent through a Komla-operated service to OpenRouter, which routes it to a model provider. We do not store this text, and we only use providers that do not train on your data. The contents of untracked files are never included in commit message requests.
• Workspace naming is on by default; branch naming is off by default; commit messages are only generated when you request them. You can turn these off or use your own OpenAI-compatible provider in Settings → General → AI Utilities, in which case requests go directly to that provider.

Remote control, SSH, and voice:

• Remote control is off by default. When you turn it on, your paired devices connect to your computer, or to your SSH hosts, over your own Tailscale network. Komla runs no relay, so terminal output, input, and workspace data don't pass through our servers. If you turn on phone notifications, your computer sends them to your phone browser's own push service (for example Apple's or Google's), encrypted so only your phone can read them; they never include terminal output.
• SSH workspaces connect directly from your computer to hosts you configure. Nothing passes through our servers.
• Voice input is transcribed entirely on your device. Komla only downloads the speech model from our download server.

Feedback and contact (user-initiated):

• If you submit feedback in the app, we receive your description, optional email address, up to three optional screenshots, and system information (app version, platform, OS version, selected agent).
• If you use our contact form, we receive your name, email address, and message.

Website:

• We measure website visits with Umami in cookieless mode, and record which ad campaign or referral brought you to the site (for example UTM parameters or an ad click ID).
• If you ask us to email you a download link, we use your email address to send that one email and briefly keep it to prevent duplicate sends.

2. Emails

We send the emails you ask for, such as a download link, and occasional product announcements to people who join our announcement list from our website or contact form. Every announcement includes an unsubscribe link, and unsubscribing is permanent unless you sign up again yourself. We do not send third-party marketing.

3. How We Use Your Data and Legal Bases

• Opt-in usage analytics — your consent, which you can withdraw at any time.
• Always-on app telemetry, error reports, security and abuse prevention, ad conversion measurement, and keeping the records of earlier license purchases — our legitimate interest in operating, improving, and promoting Komla.
• AI utilities, feedback, and support — to provide the feature or answer you asked for.

We do not sell or rent your personal data.

4. Service Providers

• Cloudflare — hosting, database, file downloads, email (Cloudflare Email Service). Privacy Policy.
• OpenRouter — AI utility inference with the Komla-managed provider. Privacy Policy.
• Umami — cookieless website and app analytics, self-hosted by us. Our servers forward your IP address and browser user agent to it so it can count unique visitors; Umami does not store IP addresses.
• Google Ads — measuring whether ads lead to downloads. Its website tag may set cookies.
• GitHub — a private repository where our team receives and tracks feedback submissions (including screenshots), contact messages, error reports, and operational alerts. Privacy Statement.
• Agent Inbox — a private inbox run by us, where our team receives feedback submissions (including screenshots), contact messages, error reports, and operational alerts.

Several of these providers are based in the United States and may process data there. Where data leaves the European Economic Area, we rely on the safeguards in each provider's data processing terms, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework. Our Umami analytics instance is hosted in Europe.

5. Data Storage & Retention

• If you bought a license for an earlier version of Komla, we keep that record (email, license key, plan, purchase details) in a Cloudflare D1 database, so we can honor it if paid features return and for as long as accounting obligations require. Ask us through the contact form to have it deleted.
• Announcement list entries are kept until you unsubscribe; we keep the unsubscribed address only to make sure we don't email it again.
• Telemetry is not stored in our own database; Umami keeps aggregated analytics events.
• Feedback, contact messages, error reports, and alerts are kept in our private GitHub repository and our Agent Inbox until we no longer need them.
• Our servers keep short-lived operational logs, which can include IP addresses and email addresses, under Cloudflare's log retention.

If you request deletion of your personal data, we will remove it within 30 days.

6. Cookies and Local Identifiers

Our Umami analytics runs in cookieless mode — no cookies or local storage are set by that script. The Google Ads tag may set cookies or similar identifiers to attribute ad clicks and conversions. The desktop app only stores a random telemetry ID in its local settings, and only sends it if you opt in to usage analytics.

7. Your Rights

Under the GDPR and applicable Norwegian law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict processing, including processing based on legitimate interest.
• Withdraw consent at any time, without affecting earlier processing.
• Receive your data in a portable format.
• Complain to the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

To exercise any of these rights, contact us.

8. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. If a change materially affects data you have consented to share, we will ask again in the app.

9. Contact

Tafjord Invest AS
Contact us