1. Who we are and what this policy covers
WhiteTR Technology ("we") makes Kubby and runs kubby.tech. We are the data controller for the personal data described here. This policy covers the Kubby desktop application, its update checks and downloads, and the website, including the contact form and the e-mail announcements.
2. The short version
- Your cluster data never reaches us. Kubby talks to your clusters directly from your computer; kubeconfigs, cluster names, logs, resources and credentials stay there.
- Kubby only asks kubby.tech whether a newer version exists. It collects no usage statistics or other telemetry, and you do not register with us to use it.
- The website sets no cookies and uses no advertising or tracking tools.
- We do not sell personal data and do not use it for advertising.
3. What we process and why
| Activity | Data | Purpose | Legal basis |
|---|---|---|---|
| Update checks | A request for the latest release file on kubby.tech: IP address, time and the requested file, in the web server logs | Tell Kubby about new releases | Legitimate interest |
| Downloads | Version downloaded, download counts per version; IP address used for the request, not stored | Deliver installers and count downloads | Legitimate interest |
| Contact form and e-mail | Name, e-mail, company, subject, your message | Answer your request | Legitimate interest |
| Spam protection on forms | Signals from your browser processed by Cloudflare Turnstile | Keep automated abuse out | Legitimate interest |
| E-mail announcements | The e-mail address you subscribe with, the consent text and the times of sign-up and confirmation | Tell you about new versions, features and security fixes | Consent (confirmed by e-mail); withdraw any time with the link in each e-mail |
| Support | What you send us, for example screenshots or log excerpts you choose to share | Solve your problem | Legitimate interest |
| Website operation | Server logs: IP address, browser, page, time | Security and troubleshooting | Legitimate interest |
| Visit statistics | Cookieless totals (pages, referrers, country); no IP address stored | Improve the website | Legitimate interest |
4. What we do not receive
Kubby does not send us your kubeconfigs, cluster names or addresses, Kubernetes resources, logs, events, Helm values, Argo CD data, notes, audit log or credentials. The local Kubby account (password, two-step verification, recovery codes) stays on your computer.
When you use Ask Kubby, your questions and the cluster context the model reads go from your computer directly to the AI provider you chose, with your own account; they do not pass through our servers. See the AI Transparency Policy. News feeds in Notifications are fetched by Kubby directly from their publishers, who see your IP address like any website does.
5. Cookies and similar technologies
kubby.tech sets no cookies. It keeps one entry in your browser's storage: your choice in the cookie notice ("kubby.consent"), so the notice does not come back on every page. Visit statistics come from Umami, a cookieless tool we run on our own server; it loads only after you choose "Accept all" or allow statistics under "Customize", stores no IP addresses and does not follow you across sites. You can change your choice at any time with "Cookie settings" at the bottom of every page. Fonts and images load from our own server. Only when you start filling in a form (contact or e-mail announcements) does the page load Cloudflare Turnstile, which checks that a person is sending it; Turnstile does not use cookies for tracking.
6. Who receives data
We use these service providers, bound by contracts that limit use to our instructions:
- Hosting Dünyam (Türkiye): the server for kubby.tech, the installers and the update files;
- Supabase: database and server functions for the contact form, e-mail announcements and the download counter;
- Resend: sending e-mails;
- Cloudflare: DNS, network protection and Turnstile;
- authorities where the law requires it.
7. International transfers
Some providers process data outside Türkiye or the European Economic Area. Where they do, we use the safeguards required by law: standard contractual clauses under the GDPR and the standard contracts or other means under article 9 of the KVKK, notified to the Personal Data Protection Authority where required.
8. How long we keep data
- Contact requests: 2 years after our last exchange;
- E-mail announcements: until you unsubscribe;
- Download counts: as totals per version;
- Server logs: 14 days; statistics are kept only as totals.
9. Security
Access to personal data is limited to people who need it and protected by strong authentication. Data is encrypted in transit and at rest with our providers. In Kubby, imported kubeconfigs are files in your Windows profile, behind your Kubby sign-in; Argo CD tokens and AI keys are kept in Windows Credential Manager. None of them is written to logs.
10. Your rights
You can ask for access to your data, correction, deletion, restriction, portability and object to processing based on legitimate interest; where we rely on consent you can withdraw it at any time. Under the KVKK (article 11) you also have the right to learn whether your data is processed, its purpose and recipients, and to claim compensation for unlawful processing. Write to [email protected]; we answer within 30 days. You may also complain to your data protection authority; in Türkiye this is the Personal Data Protection Authority (KVKK).
11. Children
Kubby and kubby.tech are not aimed at children, and we do not knowingly collect their data.
12. Changes to this policy
We update this policy when our services change. The date at the top shows the latest version; material changes are announced on this page and, where appropriate, in Kubby.
13. Contact
WhiteTR Technology, Turkey. E-mail: [email protected]