Account deletion boundary

Account deletion is server-driven and auditable:

A request lands in the server-owned accountDeletionRequests ledger; the

client never deletes server data directly.

After OTP re-authentication, the backend deletes the Firebase Auth identity

by calling admin.auth().deleteUser(uid) (deleting the Firebase Auth identity is the terminal step) and erases user-linked Firestore data under a versioned erasure manifest.

The pipeline fails closed: any step that cannot prove erasure stops the

deletion instead of silently continuing, and the manifest records what was and was not removed.

What stays local

Your workspace files and code
Local git operations
Agent tool execution (bash, file reads/writes)

What goes to your provider

Your configured AI provider receives:

Prompts and instructions
Code excerpts from your workspace
Tool output (bash results, file contents, test output)
Document context

kill9 can only be as private as the provider you choose.

Browser inspector

The browser inspector is gated to your configured dev URL. It cannot inspect arbitrary sites.

Data storage

kill9 uses Firebase for cloud data storage (entities, workflows, sessions, documents, mockups). This data is stored under your account.

Settings

Review and control data settings in Settings → Data & Privacy (Cmd/Ctrl+,).

Security and privacy