Docs
What the servers do.
Local-first does not mean there are no servers. It means the servers are deliberately dumb about you. Here is their entire job.
A stateless pass-through
When you talk to the coach, the request passes through our server to the model and the reply comes back. The server does not keep the message or the reply. It is a relay, not a filing cabinet.
The few operational tables
| What | Why |
|---|---|
| Account and auth | So you can sign in and your plan is known. Provided by Supabase, hosted in the EU. |
| Aggregate usage counts | Message tallies for fair use and billing. Never the content. |
| Referrals | So earned free months attach to the right invite. |
| Personas | The compact archetype summary, not traceable to your data. |
| Subscriptions and promos | Your plan and any promo links. |
The WHOOP token
When you connect WHOOP, the access token is held in an on-device, httpOnly cookie and used to fetch your data straight to you. Kata does not keep a copy of your WHOOP data on its servers. See WHOOP.
The operator cannot read your data
This is not a promise, it is an architecture. Your logs, chats, memory and photos are namespaced per account and stored only on your device; they are never sent to or stored on our infrastructure. There is nothing for an operator, or an attacker who reached our servers, to read.