Kaption Privacy Policy
Version 2.0 • Effective date: 31-05-2023 • Last updated: 31-08-2026
Kaption AI, LLC ("Kaption", "we", "our", or "us") is committed to protecting your privacy and ensuring the confidentiality and security of your personal information.
This Privacy Policy outlines our practices for collecting, using, maintaining, and disclosing your information when you use the Kaption browser extension, the Kaption apps for macOS, Windows, iOS/iPadOS and Android, and our websites. By accessing or using our services, you agree to this Privacy Policy.
Browser Extension
Chrome, Edge & Firefox
Kaption Apps
macOS, Windows, iOS & Android
AI Assistant Access
Optional, and zero-retention
What this covers
This section applies to every way you use Kaption directly: our browser extension for Chrome, Edge and Firefox, the Kaption apps for macOS, Windows, iOS/iPadOS and Android, and the Kaption assistant you message on WhatsApp. The extension and the apps share the same design and the same privacy model — your conversations stay on your device.
🔒 Local-first by design
Your messages stay on your device. Kaption stores your WhatsApp history in encrypted storage on the device you are using — inside your browser for the extension, inside the app for our desktop and mobile apps — so that search, transcripts, analytics and AI assistant access work without ever uploading your conversations.
- • No message content is stored on Kaption's servers.
- • Audio you choose to transcribe is sent for processing and discarded once the transcript is returned.
- • Your content is never used to train AI models, and never sold or licensed.
- • You can export or erase your local data at any time from within the product.
🔐 App Lock (Face ID / Touch ID)
Our iOS, iPadOS, macOS and Android apps let you require Face ID, Touch ID, or your device passcode to open Kaption ("App Lock"). This uses Apple's and Google's own on-device authentication systems (LocalAuthentication on Apple platforms, BiometricPrompt on Android):
- • Kaption never receives, sees, stores, or transmits your face, fingerprint, or any other biometric data. Your device's operating system performs the match entirely on-device (inside the Secure Enclave on Apple devices) and returns Kaption only a yes/no result.
- • No biometric data is created, retained, shared with any third party, or sent to Kaption's servers, because Kaption's app is never given access to it in the first place.
- • App Lock is off by default and is a screen lock only — it does not itself encrypt your data.
- • You can turn App Lock on or off at any time in Settings.
Processed to deliver a feature you asked for:
- Audio you transcribe: sent to Kaption's own transcription servers, or to one of the AI processing providers named below when our own capacity is unavailable; returned as text, then discarded
- Text you translate or summarise: processed on request by one of the AI processing providers named below, not retained
- Messages you choose to analyse: when you run an AI analysis on a chat export you imported, only the messages in the date range you select are sent for analysis, and only for as long as the analysis takes. The export itself stays on your device.
- Your WhatsApp number: used to identify your subscription and licence
Data We Collect (Analytics Only):
- Usage Analytics: How often features are used
- Technical Information: Browser or operating system, app and extension version
- Performance Data: Processing times, error rates
- No Personal Content: Absolutely no message or conversation data
How We Use This Data:
- Improve performance and features
- Monitor for bugs and technical issues
- Optimize AI processing accuracy
- Ensure service reliability
WhatsApp Account Responsibility
Kaption AI, LLC is not responsible for any actions taken by WhatsApp/Meta against your account.
- • We do NOT incentivize or encourage automated message sending
- • We do NOT promote bulk messaging or spam
- • All our features are designed to minimize the risk of your phone number being blocked
- • However, we cannot eliminate this risk entirely - WhatsApp's policies are strict
- • Possible actions by WhatsApp include: account suspension, phone number blocking, feature restrictions, or permanent bans
- • Use of Kaption is at your own risk
- • WhatsApp's Terms of Service apply to your use of their platform
Kaption lets you connect your own AI assistant — Claude, ChatGPT, an IDE agent, or any MCP-compatible client — to your WhatsApp through the Model Context Protocol (MCP). This section explains exactly what that connection can and cannot do.
Nothing is enabled by default. MCP access is off until you turn it on, and you can revoke it at any time from within Kaption.
Your assistant cannot send messages immediately
There is no direct "send now" capability. Your assistant can read, search, organise, label, schedule and draft. A draft is only placed in your compose box for you to review and send yourself. If you ask the assistant to create a scheduled message, the Kaption extension will send it automatically at the time you selected unless you cancel it first. Conversations you have locked in WhatsApp are excluded entirely and are never returned to an assistant.
Everything runs on your device
Your messages live in encrypted storage on your own device, and every assistant request is executed there. Kaption's servers never hold your conversations — they are only the phone line, never the filing cabinet.
Two ways to connect
Local connection. You run our helper on your own computer. It listens only on 127.0.0.1 — your own machine, unreachable from the internet — and is protected by a 32-byte token stored with owner-only permissions. Web pages cannot connect to it. The first time an assistant connects, Kaption asks you to Allow or Deny, and sessions expire after 7 days. In this mode no Kaption server is involved at all: your data never leaves your computer.
Cloud connection. For assistants that cannot reach your machine, requests travel through our relay, which passes them to Kaption running on your device. This relay:
- stores nothing. No message, transcript, contact, media file, or tool result is written to any database, disk, or log. Requests and responses exist only in memory while in transit and are discarded immediately.
- cannot act alone. It holds no copy of your data and no ability to read WhatsApp. If Kaption is not connected on your device, every request fails — there is nothing for the relay to answer from.
- does not know who you are by phone number. Your connection is routed by an irreversible cryptographic fingerprint of your number, not the number itself.
- stores only the security and routing state required for the connection — OAuth client and grant records, cryptographically hashed access and refresh tokens, a single-use connection token valid for 60 seconds, and one-time login codes. It never stores message content, transcripts, contacts, media files, or tool results.
Access requires you to authorise the assistant through a one-time code sent to your WhatsApp number, and the authorisation is re-checked on every single request.
Media
Attachments are only transferred when your assistant explicitly requests a specific file. Ordinary searches and message lists never carry image or audio data.
What we measure
We record which tool was used and whether a search term was present — never the search term, never the parameters, never the content. This tells us that "search ran 40 times today" and nothing about what was searched.
Verifying our claims
Every deployment of the cloud relay is recorded in a public, tamper-evident chain with cryptographic signatures, published at mcp.kaptionai.com/transparency. Deployments can only be made by our automated build system, never by hand. You do not have to take the statements above on trust — the record is public.
Website & Infrastructure
For our general platform services, we collect minimal information necessary to operate and improve our services.
Data We Collect:
- Technical Information: Device type, browser, operating system
- Usage Analytics: Anonymous usage data and trends
- Communication: Email when you contact us for support
- Billing: Payment information for premium services (processed securely)
How We Use This Data:
- Provide, maintain, and improve our services
- Monitor usage trends and optimize performance
- Respond to customer inquiries and provide support
- Comply with legal obligations
Data Security Standards
We implement industry-leading security practices to protect your information:
- Encryption: Data at rest is encrypted using AES-256 standards.
- Transmission: All data in transit is protected via TLS/SSL encryption.
- Access Control: Strict identity and access management protocols.
- Monitoring: 24/7 infrastructure monitoring and threat detection.
While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet is 100% secure.
Data Retention & Storage
Kaption is local-first. Where your data lives, and for how long:
- On your device: Your WhatsApp history is kept in encrypted storage on the device you use Kaption on, for as long as you choose to keep it. You can export or erase it at any time.
- On our servers: No message content. Audio sent for transcription is processed and discarded once the transcript is returned.
- With our AI processing providers: Nothing is retained. Content is sent to return a result and is not kept by us or authorised to be kept by them — see AI Processing Providers above.
- AI assistant (MCP) requests: Nothing is retained. Requests pass through in memory only; short-lived security tokens expire within 60 seconds.
- Analytics: Anonymous usage data is retained for up to 12 months.
Upon account deletion or subscription cancellation, we will delete your data within 30 days, except where retention is required by law.
No Data Analysis Policy
We do not analyze, investigate, train, or test our AI models with your personal audio or chat conversations. Your privacy is our priority.
AI Processing Providers
Transcription runs first on inference servers that Kaption operates. When our own capacity is unavailable, and for translation, summaries and chat analysis, the request is handled by one of a small, fixed set of AI infrastructure providers acting as our data processors:
- Google — transcription
- Groq — transcription, summaries, translation
- DeepInfra — transcription, translation, chat analysis
- Cerebras — summaries, translation
What reaches them: only the audio, text or messages you chose to process, and a language hint. We send no name, no phone number, no contact list and no account identifier alongside it, so the content arrives without anything that identifies you.
What they may do with it: return the result, and nothing else. They are engaged as processors, are not permitted to use your content for their own purposes, and are not authorised by us to retain it or to train models on it. Kaption itself retains none of it — the content exists only for the seconds the request takes.
Third-Party Websites
Our service may contain links to third-party websites. We are not responsible for their content, privacy policies, or practices.
🇪🇺 GDPR (European Union Users)
If you are located in the European Economic Area (EEA), you have certain data protection rights. Our legal basis for processing your data depends on the product:
- Contract: Processing necessary to provide the Service you requested.
- Legitimate Interest: Processing for security, fraud prevention, and service improvement.
- Consent: Processing where you have given explicit permission (e.g., connecting an AI assistant via MCP).
Your GDPR Rights:
- • Right to access, update, or delete your information
- • Right of rectification (correcting inaccurate data)
- • Right to object or restrict processing
- • Right to data portability
- • Right to withdraw consent at any time
🇺🇸 CCPA (California Users)
Under the California Consumer Privacy Act, California residents have the following rights:
- • Right to Know: Request disclosure of what personal data is collected.
- • Right to Delete: Request deletion of your personal data.
- • Right to Opt-Out: We do NOT sell your personal information to third parties.
- • Right to Non-Discrimination: You will not be denied service for exercising your privacy rights.
International Data Transfers
Your information may be transferred to, and maintained on, computers located outside of your state, province, or country where data protection laws may differ. By using our Service, you consent to this transfer. We use Standard Contractual Clauses (SCCs) and other approved mechanisms to ensure your data remains protected.
Meta Platform Compliance
The Kaption WhatsApp assistant (our bot) integrates with the WhatsApp Business API. This Privacy Policy is hosted at a public, accessible URL without geo-restrictions and is listed in our App settings. We only process Meta Platform Data as described here, never for advertising or profiling, and never sell or license it.
Data Breach Notification
In the event of a security breach that results in the unauthorized access, disclosure, or loss of personal data, Kaption AI will:
- Notify affected users without undue delay (typically within 72 hours for GDPR compliance).
- Provide information about the nature of the breach and recommended protective steps.
- Coordinate with relevant regulatory authorities as required by law.
Children's Privacy
Our Service is not intended for use by children under the age of 18. We do not knowingly collect personally identifiable information from children. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us so that we can take necessary actions.
Policy Updates
We may update this Privacy Policy from time to time. Changes are effective when posted on this page. You are advised to review this policy periodically.
Use of Cookies
Kaption AI uses cookies and similar tracking technologies to track activity on our Service and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier.
Types of Cookies We Use:
- Essential Cookies: Necessary for the operation of our Service (e.g., authentication, security).
- Preference Cookies: Used to remember your preferences and various settings (e.g., language, theme).
- Analytics Cookies: Used to track information how the Service is used to make improvements.
Managing Cookies:
You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.
For more information on how to manage cookies, visit your browser's help pages:
Get in Touch
If you have any questions or concerns about this Privacy Policy, please contact us:
Your Rights
- Request access to your personal data
- Correct inaccurate information
- Request deletion of your data
- Object to processing of your data
- Request data portability