Kladi

Privacy Policy

Last updated: October 10, 2026

Kladi is an outliner for notes, ideas, and plans, operated by Gendy. This policy explains what data Kladi handles, where it is stored, and how to delete it. Questions: max@gendy.co.

Your outline

Your notes live in your browser or desktop app. If you sign in, they are also stored in your own account on our hosted backend (Supabase) so the same outline is available on your other devices. They are not shared with other users unless you explicitly create a share link.

Account data

Signing in stores your email address and a session token. That is the whole account record. Kladi does not run advertising, does not sell data, and does not share your data with third parties for their own purposes.

Connecting your AI

You can connect an AI client such as Claude Code, Codex, or a browser chat to Kladi through its MCP server at https://kladi.app/api/mcp. The connection is started by you and approved on Kladi's consent screen, where you choose whether the AI may read, write, or delete. The AI client receives an access token for your account only; you never paste a password or token into a chat.

When your AI reads or changes your notes, that content is sent to the AI client you connected and is processed under that provider's terms. Kladi does not send your notes to any AI provider on its own. To disconnect, remove the server from your AI client; to revoke the token on our side as well, email max@gendy.co.

Connected services

Kladi can connect to Slack, Google Calendar, Gmail, and Dropbox. Every connection is optional, is started by you, and can be disconnected at any time from Settings → Integrations.

When you authorize a service, the authorization code is exchanged for an access token by a serverless function that holds our client secret. The resulting token is handed back to your app and stored with your own account data. We do not keep a server-side copy of your tokens, and no Kladi operator reads the content of your connected accounts.

Slack specifically

Kladi connects to Slack as you (a user token), not as a bot. It requests:

• search:read — find your mentions and direct messages for the Slack inbox.
• channels:read, users:read — show channel names and author names.
• channels:history, groups:history, im:history, mpim:history — read a message you open or capture, and build its permalink.
• chat:write — post a bullet you chose to send, under your own name.

Slack content is fetched on demand, shown to you, and kept only in memory — except for a message you explicitly capture, which is saved into your outline like any other note. Slack content is never sent to other Kladi users and is never used to train any model.

AI assistant

Kladi's assistant runs on the Anthropic API using an API key you supply. When you send it a request, the relevant part of your outline — and, if you ask it to look something up, the Slack or calendar content it retrieves — is sent to Anthropic to produce the reply. Anthropic processes it under their own terms. If you never use the assistant, nothing is sent there.

Retention and deletion

• Disconnecting an integration deletes its stored token and cached content from your app.
• Deleting a note deletes it from your synced account data.
• To delete your entire account and its data, open Settings → Account → Delete account. Deletion is immediate and cannot be undone. If you cannot reach that screen, email max@gendy.co and it will be removed within 30 days.

Security

All traffic uses HTTPS. Tokens and secrets are never written to logs. Client secrets exist only as server-side environment variables.

Changes

Material changes to this policy will be posted on this page with a new "last updated" date.