Report a problem
Email privacy@kartykk.com with the steps to reproduce the problem, the app version if you have it, and whether a box is involved. Machine-readable contact: security.txt.
- Do not access or change other people's data.
- Do not disrupt the API or anyone else's devices.
- Give us time to look at the report before publishing it.
This page does not promise a reply time, a bounty, or public credit.
Account and app
- Connections to api.kinokora.com use HTTPS.
- Account passwords are stored as bcrypt hashes. The hash is not the password.
- An optional four-digit app PIN can lock selected areas on that phone: AI, account, devices, backup and farm helpers. The phone stores a salted verifier, not the PIN. It does not encrypt all farm data, replace the account password, or protect the server account.
- There is no remote recovery for a forgotten app PIN in the current app. Erasing app data on the phone removes the local verifier and the other on-device data.
- A connected box can have its own device access, separate from the app PIN and the account password. Erasing the phone does not wipe the box.
What this page does not claim
- No security certification, audit report, or uptime figure is published here.
- The app PIN is not full-disk encryption and not a replacement for the account password.
- AI answers are not a security control. Treat them as optional assistance that can be wrong.
- Policies on privacy, deletion and data safety are still drafts.