Security Policy

Version: 1.0 Effective date: 2026-08-13 Applies to: kttouk (កត់ទុក) "Personal Capture Platform" version 0.1.0 — desktop application, optional self-hosted backend, and MCP servers.

1. Overview

kttouk is a personal capture platform: a desktop-first app for capturing tasks, notes, screenshots, voice, clipboard text, and bookmarks, with optional AI-based organization.

This policy describes how kttouk protects the data you create in it, across the three components that make up the product:

kttouk is designed to be local-first. Your main database lives on your own computer. Nothing is sent anywhere unless you configure it to be (sync to your backend, or a cloud AI provider for AI features).

2. Encryption

2.1 At rest

• Your primary database (kttouk.db) and the app's key-value store are encrypted with SQLCipher (AES-256) before being written to disk.
• The database encryption key is derived from the OS keychain (Credential Manager on Windows, Secret Service on Linux) with a local fallback key file. A database key file ({db}.db.key) is also written alongside the database so external tools such as the MCP server can open the same database.
• A lost/reset encryption key never silently bricks the app: an undecryptable file is quarantined as .undecryptable-backup rather than deleted, and the recovery notice is surfaced in-app before any fresh start.

2.2 In transit

• All desktop↔backend and MCP↔backend traffic uses HTTPS/TLS when talking to a production-configured backend.
• Local-only traffic (MCP stdio mode, local Ollama on localhost) stays on your machine's loopback interface.

3. Data flows and who can access your data

The desktop app performs no network communication unless a sync server, AI provider, or calendar provider is configured by you.

4. Access control

4.1 Your local data

• Local access to your captured data is as protected as the OS account that runs the app. Anyone with access to your OS user account can launch kttouk; the on-disk database is additionally encrypted so it cannot be read by another user or by file recovery tools without the key.
• kttouk does not implement multi-user accounts on the desktop app — it is a single-user, single-device product. Optional backend accounts (email or Google/GitHub OAuth) exist only to support synchronization.

4.2 Backend API security (self-hosted backend)

• Production startup refuses to boot unless real SECRET_KEY, FIELD_ENCRYPTION_KEY, and METRICS_TOKEN values are configured (placeholder values are rejected).
• Passwords are stored as PBKDF2-HMAC-SHA256 hashes (600,000 iterations); password length is bounded (8–128 chars).
• JSON Web Tokens (PyJWT) are used for API authentication; refresh-token and OAuth flows are protected against CSRF via signed, bound state parameters.
• CORS is restricted to a small explicit allow-list of app origins.
• WebSocket connections require authentication, and room membership is validated per request.
• Global search is scoped to the requesting user's own data and workspaces.
• Login and sensitive endpoints are rate-limited.
• SQLAlchemy parameterized queries are used throughout — no string-built SQL.

5. AI processing

• AI features are opt-in and can be fully disabled.
• AI provider choice is yours: Ollama keeps all AI processing on your device; OpenAI, Gemini, and Claude send the content you explicitly use with AI features to that provider's cloud.
• When a cloud provider is selected, the app shows an in-settings disclosure ("External AI provider active") that captured content may be sent to that provider.
• Your AI API key is stored locally in your encrypted key-value store and used only by the desktop app to reach the provider.

6. Third-party service providers

Third parties receive your data only in the flows above that you enable:

• A self-hosted sync backend you operate.
• A cloud AI provider you choose (OpenAI, Google Gemini, Anthropic Claude) — governed by their privacy policies and terms.
• A CalDAV calendar provider you configure for calendar sync (e.g., your own CalDAV server).

kttouk has no advertising network, no analytics provider, and no data brokers. We do not sell, rent, or share your personal data with anyone for commercial purposes.

7. Retention, export, and deletion

• Local data: stored on your device until you delete it. The desktop app provides Import/Export backup of local data.
• Sync data: retained on the sync backend for as long as your account exists. You can request a data export and delete your account from the backend (see the Data Privacy Policy).
• Deletion: deleting an entity in the app removes it from your local database. Deleting your backend account removes your backend-stored data.

8. Vulnerability reporting

We take the security of kttouk seriously. To report a security vulnerability:

• Email: [email protected]

Please include a description of the issue, affected versions, and a minimal reproduction. We will acknowledge within 5 business days and coordinate a fix and disclosure.

9. Compliance and best practices

kttouk follows secure-by-default engineering practices:

• Local-first storage so the smallest possible amount of data ever leaves your device.
• Minimal collection: no telemetry, no analytics, no passive clipboard capture.
• Standard, vetted crypto primitives (SQLCipher/AES-256, PBKDF2, SHA-256).
• Dependency and framework hygiene (maintained libraries only).
• Sanitization of uploaded file names/extensions and defense-in-depth against path traversal, SSRF, IDOR, and injection classes in the optional backend.

10. Contact

For questions about this policy or kttouk security, contact:

• Email: [email protected]

We will review and update this policy as the product changes. Material changes will be reflected by a new version number at the top of this document.