Privacy policy
Last updated: 2026-10-04
kumo is a plugin for the Unreal Engine editor and a desktop app. This policy covers both, and explains exactly what data leaves your machine, and what stays on it.
There are three separate pipelines, and mixing them up is the most likely way to misread this page:
- Crash and error reporting from the plugin and the desktop app — optional, opt-in, anonymous.
- Subscription and account data — only if you subscribe. Necessarily not anonymous, because a subscription belongs to somebody.
- This website and the downloads — analytics, the support form, and the desktop app’s update checks, covered at the end.
If you never subscribe, pipeline 2 does not apply to you at all: no account exists, and nothing in it is collected.
Who we are
Section titled “Who we are”“We” is the publisher of kumo and the seller of the subscription, and the data controller for everything described here:
Max Ludovico Hofer, sole trader, Italy. Postal address and codice fiscale available on request from admin@fabbricaelettrica.com. Contact: admin@fabbricaelettrica.com.
1. Crash and error reporting
Section titled “1. Crash and error reporting”Opt-in only
Section titled “Opt-in only”The plugin and the desktop app send anonymous crash and error reports to help us fix bugs, and only if you opt in. A consent checkbox is shown on the login screen; your decision is recorded the first time you click a Connect button, or when you toggle the checkbox yourself. Until then, nothing is sent. Change it any time under Editor Preferences → kumo → Telemetry. The desktop app asks the same question on its sign-in screen and records the answer in the same project setting, so one answer covers both.
If you decline, kumo makes no network call to our telemetry endpoint — the feature becomes a no-op.
What is sent when you opt in
Section titled “What is sent when you opt in”| Field | Example |
|---|---|
| Plugin or app version | 1.0.0 |
| Unreal Engine version (plugin only) | 5.8.0 |
| Operating system | Windows 11 / macOS 14.4 / Linux 5.15 |
| Anonymous install ID | Random UUID generated once per install |
| Error type and message | ImportError: No module named 'requests' |
| Stack trace | Only frames from kumo’s own code |
| Build configuration | Development / Shipping |
Install IDs are generated locally, are not tied to your identity, and cannot be used to identify you across projects.
What is never sent
Section titled “What is never sent”- Source code (
.cpp,.h,.py,.cs, Blueprint assets, and the rest) - Chat conversations with the AI assistant
- Tool outputs (files written, search results)
- File paths outside of kumo’s own install directory
- File contents from your project
- API keys, OAuth tokens, or environment variables
- Your real name, email, username, or other identifying information
- Any data from projects where the plugin is disabled
The outbound telemetry code scrubs paths and credential-shaped strings before sending each event. If a scrubbing rule misses something, we treat that as a security bug and fix it immediately.
Where it goes, and for how long
Section titled “Where it goes, and for how long”Error reports go to Sentry, routed to Sentry’s EU data centre and stored there. Retention is 30 days, after which events are deleted automatically. We keep no copies elsewhere.
We use it only to find and fix bugs. We do not build behavioural or marketing profiles, do not track what you do with the plugin, do not train AI models on it, and do not sell or share it with anyone beyond that provider. We do collect technical performance data — function timings and code-level profiles — strictly to find performance bugs in our own code. That is profiling of our code, not of you.
If you revoke consent, the install ID is cleared the next time the plugin runs.
2. Subscription data
Section titled “2. Subscription data”This section applies only if you subscribe to the paid Project Wiki and Integrations features. Using the rest of kumo creates no account and none of the data below.
A subscription cannot be anonymous: somebody is paying, somebody has to be told before they are charged again, and a refund has to reach the person who paid. So the goal is not “collect nothing” — it is to collect the least that makes those three things work, and to say plainly what that is.
What we hold
Section titled “What we hold”| Data | Why it is needed |
|---|---|
| Email address | To send the renewal and trial-ending notices the law requires, and to reach you about a failed payment. |
| Paddle customer and subscription id | To match a payment to an entitlement. Opaque identifiers, not names. |
| Subscription state, plan, period end, trial end | To decide whether your features are unlocked and when, and to size your account correctly — the studio plan covers a whole company on one subscription, so the plan says what the billed quantity cannot. |
| Seat records | To tell your machines apart, and to size how much the service will issue for your account. It is not a headcount and nothing here caps how many people use a subscription. A seat label is whatever you type; we never fill it in from your computer’s name. |
| A log of entitlement tokens issued and refused | To answer “what did this machine have, and when” if access is ever disputed. |
| Billing events received from Paddle | To apply your payments correctly and to prove what we were told. |
| Your membership of each studio we host for you | So the studio knows who may read what. Each studio knows you by a name derived for it alone, never your account id, with the projects you are in, your roles there and the invitations sent to you. Your email address is shown to the studio’s members as your name: the address you were invited at, or your verified address. If you ask us to erase your data, all of it is deleted from every studio we host. |
What we deliberately do not hold
Section titled “What we deliberately do not hold”- No device or hardware identifiers. No MAC address, no machine fingerprint, no hostname, no OS username. Entitlement is decided from a signed token, which needs none of them.
- No payment details. No card number, no bank account. These go to Paddle and never reach us.
- No IP address log. We never write your address down — not against your account, not anywhere. To stop one machine requesting tokens thousands of times we keep a counter, labelled with a one-way keyed digest of your network rather than with the address itself. That counter is deleted after 1 day. (The hosting provider in front of our service keeps its own connection logs, as every web service does; that is theirs, not ours.)
- No usage tracking. We do not record which features you open, how often you use the Wiki, or what you build with it.
The entitlement token stored on your own machine carries only an opaque account id, an opaque seat id, the feature names, and the relevant dates. It contains no email address and no name. On macOS and Linux it is written owner-only, because it is a credential.
Who processes it
Section titled “Who processes it”| Processor | Role | Where |
|---|---|---|
| Paddle | Merchant of record — takes the payment, handles VAT and sales tax, issues invoices, hosts the cancellation portal. | EU / US |
| Supabase | Hosts the entitlement database and the service that issues tokens. | EU region |
| Transactional email provider | Sends the renewal and trial-ending notices. | To be named here before the first such email is sent. |
Paddle is the merchant of record, which means Paddle holds its own copy of your billing records under its own legal obligations — invoices and tax records, typically for years. That copy is outside our control, and deleting your data from our systems does not and cannot delete theirs. Saying otherwise would be a promise we are not able to keep.
How long it is kept
Section titled “How long it is kept”- The verbatim billing payloads Paddle sends us: 90 days, then the payload is deleted and only a SHA-256 digest of it remains. The digest lets a dispute still be settled — Paddle produces their copy, we hash it and compare — without us holding the personal data inside it.
- The token issue/refusal log: 400 days, then deleted. It carries no name, email or address.
- The rate-limit counters described above: 1 day.
- Account, subscription and seat records: while the subscription exists, and removed when you ask.
- A studio we host for you, with everything in it: while anybody in it has a subscription. Once nobody does, it is read-only for 30 days, then switched off for 90 days, and then deleted — its files, its members’ accounts on our file server and our records of it. Its owners are emailed when it turns read-only, when it is switched off and 14 days before it is deleted, and it is never deleted before that last email has gone out. A subscription at any point before then brings everything back. We keep only that the studio existed and when it was deleted, and the billing tombstones described above.
Your rights
Section titled “Your rights”You can ask us to show you what we hold, correct it, export it, or delete it. Write to admin@fabbricaelettrica.com.
Two honest caveats about deletion:
- Cancel first. While a subscription is live we still need the account to keep your features working — deleting it would break the product you are paying for. Cancel through the Paddle portal (no need to contact anyone), then ask us to delete, and we will.
- A small tombstone survives. For each billing event we keep the event’s identifier after erasure, with the payload deleted and the link to you cut. This is not a loophole: Paddle re-sends events for days after a delivery fails, and if we forgot the identifier a re-send would be treated as new and would recreate the account you just asked us to delete. What remains says “an event with this id was handled”, and nothing about who it belonged to.
3. This website and the downloads
Section titled “3. This website and the downloads”- Hosting. The site and the desktop app’s downloads are served by Cloudflare, which necessarily sees your IP address to deliver them and keeps its own connection logs, as every web host does. We keep no log of who downloaded what.
- Update checks. The desktop app fetches a small file naming the current version shortly after it starts and every six hours, and downloads an update when there is one. These requests carry no account, no identifier and nothing from your projects; we do not log them. The MSI build for IT departments does not check for updates at all.
- Analytics. Pages load Umami Cloud to count page views and a small number of link clicks in aggregate. It runs in a web worker, it does not set advertising cookies, and it does not follow you to other sites. No account or identity is involved, and we never join it to anything in section 2.
- The support form. The feedback form sends what you type — your message, and the name, email and attachments you choose to include — to the same Sentry project as the error reports, in the EU. It sends nothing until you press submit, and nothing else on the site does.
Local log files
Section titled “Local log files”Independently of any consent, Unreal Engine writes its usual .log files under
your project’s Saved/Logs/ directory. They are local files that do not leave
your machine. The plugin does not send their contents anywhere.
What the AI sees
Section titled “What the AI sees”kumo is the adapter, not the AI. Your prompts and the tool results go to whichever AI service you signed in with, under that service’s own privacy policy — kumo does not change what they see, and cannot make a service more or less private than it already is.
Changes to this policy
Section titled “Changes to this policy”If we materially change what crash reporting collects, the consent checkbox re-appears on the sign-in screen so you can review the change before it takes effect.
Subscription data works differently, because it is not consent-based: it is the minimum needed to perform the contract you entered into and to meet the disclosure obligations that come with it. There is no checkbox to withdraw, because withdrawing it would mean ending the subscription — which you can do at any time from the customer portal. If we materially change what a subscription collects, subscribers are told by email before it takes effect.
Questions
Section titled “Questions”Max Ludovico Hofer, sole trader, Italy. Postal address and codice fiscale available on request from admin@fabbricaelettrica.com. Contact: admin@fabbricaelettrica.com.
Related: subscription terms · refund policy · pricing · how telemetry works in the editor