kosa8 runs on your machine. Your work stays there.

01The short version

• kosa8 has no telemetry, no crash reporting and no analytics in the software. Your sandboxes, files, commands, images, snapshots, prompts, audit logs and MCP tool calls stay on your machine.
• The 14-day trial is recorded only on your computer. Nothing is sent to start it or to run it.
• If you buy a licence, the software talks to Polar (our merchant of record) to activate and revalidate your key, and reports aggregate usage counts once a day so metered billing works. Set KOSA8_OFFLINE=1 or use a signed site licence and none of that happens.
• The website sets no cookies and uses Cloudflare's cookieless Web Analytics.
• We do not sell personal data, share it for advertising, or use it to train models.

02The software

What stays local. kosa8 runs sandboxes as microVMs on your own hardware. Everything it creates and records, including the sandboxes, their disks and snapshots, container images, the audit log in ~/.kosa8, your configuration and any secrets you give the credential broker, is stored on your machine. We have no copy and cannot see it.

The MCP server. kosa8 mcp serve runs locally and talks to the kosa8 daemon on the same machine, and the MCP gateway runs the servers you add on your machine too. The tool calls your AI agent makes, their arguments and their results never reach kosa8.

The trial. On first launch kosa8 writes the start date of your trial to ~/.kosa8/license.json. The trial is enforced from that file. No network request is made for it.

Licence activation and checks (paid licences only). When you run kosa8 license activate, the software sends your licence key, kosa8's Polar organisation ID, and your computer's hostname (as the activation's label, so you can tell your machines apart in Polar's customer portal) to Polar's API at api.polar.sh. After that it revalidates the key with Polar at most about once a day, sending the key and the activation ID. Polar answers with the key's status, plan and expiry, and kosa8 caches that answer in license.json.

Usage reports (paid licences only). Some plans include metered items such as overage. To bill them, the daemon reports usage at most once every 24 hours to kosa8's billing endpoint (a Cloudflare Worker), which checks your key with Polar and records the figures against your Polar customer account. A report contains only your licence key and aggregate counts for the period: forks, peak concurrent forks, snapshots, restores, sandbox runs and overage hours, plus the period's start and end and whether your audit log verified. It never contains image names, container or sandbox names, commands, file paths or file contents. The counts come from the audit log on your machine, and kosa8 usage shows exactly the figures that are reported. Without a paid licence key nothing is reported.

Offline and air-gapped use. With KOSA8_OFFLINE=1 set, kosa8 refuses every outbound call (licence checks, usage reports, image and model downloads) instead of attempting it. A signed site licence (Enterprise and Government) is verified locally and never contacts Polar or us.

Downloads. The installer and release binaries are served from GitHub Releases, and on first use kosa8 fetches its guest VM image from the same place unless one is already installed. GitHub receives your IP address and request details when you download. We see only GitHub's aggregate download counts.

03Connections you choose to make

Some features connect to services you pick, with credentials you supply. kosa8 is not a party to these connections and receives none of the data. The service you connect to handles it under its own terms.

• The kosa8 assistant (kosa8 ai). If you set ANTHROPIC_API_KEY, your prompts, the conversation, and the tool results the assistant reads are sent directly from your machine to Anthropic's API under your own Anthropic account. Without a key it uses a local model gateway on 127.0.0.1, and nothing leaves your machine.
• Local models. kosa8 model pull downloads model weights from Hugging Face. Serving and running models is entirely local.
• Images and registries. Pulling or pushing an image or model contacts the registry you name, such as Docker Hub or GitHub Container Registry. kosa8 search queries Docker Hub.
• Snapshot push and pull. kosa8 remote push and kosa8 remote pull move snapshots to and from a Cloudflare R2 bucket in your own Cloudflare account, using access keys you configure. kosa8 does not operate that bucket and cannot read it. Snapshots can be encrypted before they leave your machine.
• Audit forwarding. If you configure it, audit records are forwarded to the SIEM or log endpoint you specify.
• Your agents' traffic. Network access from inside a sandbox, including model API calls the credential broker forwards for your agents, goes to the destinations you allow. It does not pass through kosa8's servers.

04The website

Hosting. kosa8.com is hosted on Cloudflare Pages. As with any web server, Cloudflare processes your IP address, browser user agent, the pages you request and similar request data to deliver the site and protect it from abuse.

Analytics. We use Cloudflare Web Analytics. It does not use cookies or fingerprinting and gives us aggregate figures such as page views, referrers, countries and page load times. It does not identify individual visitors to us.

No cookies. The site sets no cookies. The small game on the site saves your progress (points and trophies) in your browser's local storage under kosa8.play and kosa8.achievements. That stays in your browser and is never sent to us. You can clear it with your browser's site data controls.

Third-party content. Some pages show a Product Hunt badge image loaded from api.producthunt.com, so Product Hunt receives your IP address and browser details when those pages load. Links to LinkedIn, X, Skool, Udemy, GitHub, Polar and our documentation take you to sites with their own privacy policies.

05Email and the newsletter

The newsletter and launch list use double opt-in. When you enter your email address on the site, it is sent to our Cloudflare Worker, which emails you a confirmation link through Resend. Nothing is stored on our side at that point: the link is a signed token that expires after seven days. Only when you follow it is your address added to our mailing list at Resend. Every email has a one-click unsubscribe link. We use the list only to send the kosa8 newsletter and product announcements, such as the launch email.

Writing to us. If you email contact@kosa8.com, Cloudflare Email Routing delivers it to our inbox and we keep the correspondence to answer you and to keep a record of what was agreed.

06Buying kosa8

Polar is our merchant of record. Checkout, payment, tax, invoices, receipts and licence keys are handled by Polar (polar.sh). Polar and its payment processors collect your name, email address, billing address, tax details and payment information under Polar's privacy policy. We never see your full card details.

What we receive. Polar sends our billing Worker signed notifications about orders and subscriptions. These include your name, email address, the products you bought, amounts and dates, and the subscription's status. The Worker may keep a copy of these events in Cloudflare's key-value storage for up to 12 months as a billing record. When an order is paid, it emails you a welcome message with activation instructions and sends us a note with your name, email address, product and amount, both through Resend. We use this information to provide and support what you bought, handle refunds and disputes, and meet our accounting obligations.

07Who processes data for us

• Cloudflare: website hosting, web analytics, email routing, and the Worker that runs our billing and signup endpoints.
• Polar: merchant of record for purchases, subscriptions and licence keys, and the store for usage records.
• Resend: sends confirmation, purchase and newsletter emails, and holds the newsletter list.
• GitHub: hosts the installer, release binaries and guest images.

Anthropic, Hugging Face, container registries and your own Cloudflare R2 account receive data only when you connect to them yourself, with your own account or credentials, as described in section 03. They are not our processors for that data.

08How long we keep it

• Billing events in our Worker's storage: up to 12 months, then deleted automatically. Markers that stop the same webhook being processed twice: 3 days. Markers that stop the same usage period being billed twice (a hash of customer, meter and period): 90 days. Rate-limit counters, keyed by a hash of the licence key: about 2 hours.
• Purchase, subscription and usage records at Polar: for as long as your account exists, and afterwards for as long as tax and accounting law requires.
• Newsletter list: until you unsubscribe or ask us to delete your address.
• Correspondence: as long as needed to deal with your request, and afterwards where we have a legal or contractual reason to keep it.
• Website and Worker request logs and analytics: kept by Cloudflare under its standard retention periods. Analytics are aggregate.
• Data on your machine, including license.json, the audit log and your sandboxes, is under your control. Delete ~/.kosa8 to remove it.

09Why we are allowed to

Where the GDPR or similar laws apply, we rely on: performance of a contract for licence activation, licence checks, usage metering and purchase emails; consent for the newsletter, which you can withdraw at any time by unsubscribing; legitimate interests in running a secure, reliable website and understanding aggregate site traffic; and legal obligation for keeping tax and accounting records. Under India's Digital Personal Data Protection Act, 2023, we process personal data for the specified purposes you consent to or for the legitimate uses the Act permits, such as when you voluntarily provide data for a purchase.

10Your rights

Whatever your location, you can ask us what personal data we hold about you, ask for a copy, and ask us to correct or delete it. Email contact@kosa8.com. We may need to confirm your identity first, and we aim to reply within 30 days. Records that Polar holds as merchant of record can also be managed through Polar.

European Economic Area, United Kingdom and Switzerland (GDPR). You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. You can also complain to your local data protection authority.

California (CCPA/CPRA). You have the right to know what personal information we collect, use and disclose, and to request its deletion and correction. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for any purpose that would give you a right to limit it. We will not discriminate against you for exercising these rights. An authorised agent can make a request on your behalf.

India (Digital Personal Data Protection Act, 2023). You have the right to a summary of the personal data we process and the processing activities, to correct, complete, update or erase it, to withdraw consent, to nominate another person to exercise your rights if you die or are incapacitated, and to grievance redressal. Send grievances to contact@kosa8.com. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

11Children

kosa8 is a developer tool for professionals and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

12Security and transfers

Licence keys and usage reports are sent only over HTTPS, and the software refuses redirects that would downgrade them to plain HTTP. Our Worker verifies the signature on every billing notification before it records anything. kosa8 operates in India and the United States, and our processors may handle data in the United States and other countries. Where the law requires it, these transfers are covered by the processors' data protection terms, including standard contractual clauses.

13Changes

If what the software or the site collects changes, we will update this page and its effective date before the change ships. If a change is material, we will also say so in the release notes and, where we have your email address for that purpose, tell you by email.

14Contact

kosa8 is the controller of the personal data described here and is registered in India and the United States. For any privacy question, request or grievance, email contact@kosa8.com. A person reads it.

Effective 15 October 2026