Usage limits and privacy
- Free
- Solo
- Team
Connected AI apps work on every Kiaro plan, and their requests don’t count towards your AI command allowance. To protect your workspace from an app that misbehaves, Kiaro limits how fast requests can arrive. The limits are the same on every plan.
Limits
| Limit | Allowed |
|---|---|
| Requests per person (anything the app asks Kiaro to read or do, and any other request, such as listing tools, prompts and views or fetching a prompt or a view, except connecting) | 120 a minute |
| Changes per person (creating or editing something, or asking for your approval) | 30 a minute |
| Requests across your whole workspace | 600 a minute |
| Download links across your whole workspace | 30 every 5 minutes |
| Failed sign-ins from one internet address | 120 a minute |
Changes also count towards the per-person and workspace request limits.
Connecting is never limited: the first request an app sends when it connects or starts a new conversation is never turned away by a limit, so a limit can’t stop an app from connecting. The app’s next requests count as usual.
Your plan’s normal limits still apply, for example the number of active clients on the Free plan.
When an app hits a limit
Kiaro tells the app to wait and for how many seconds, with a message such as “Wait 20 seconds, then try again.” Nothing in that request ran, so nothing is half done. When the wait is over, ask your AI app to try again.
If only the changes limit is reached, the app can still read your workspace in the meantime.
The download link limit works the same way: the app is asked to wait a few minutes. See Files.
Failed sign-ins
If more than 120 requests from the same internet address fail to sign in to Kiaro within a minute, Kiaro refuses every request from that address for up to a minute. That includes apps on the same address that are signed in correctly, so a working connection can pause briefly too. This protects Kiaro from floods of bad sign-in attempts.
If the limits can’t be checked
If Kiaro can’t check a limit for a moment, the request is allowed rather than refused, so your AI app keeps working.
What Kiaro records
For each request an AI app makes to use a tool, Kiaro keeps:
- which tool it used, whether it worked and, if not, the kind of error
- the names of the fields it sent, such as “clientId” or “durationMinutes”, but never what was in them
- the ids of the records involved, and the approval if the request waited for one
- how long the request took and which version of the connection protocol the app used
- which person and app made the request, and when
For any other request an app makes, such as connecting, listing the tools, prompts or views it can use, or fetching a prompt or a view, Kiaro keeps only a sample, about one record a minute for the same person, kind of request and result. Each record says only what kind of request it was, whether it was answered or turned away by a limit, how long it took, which version of the connection protocol the app used, which person and app made it, and when. Nothing from the request itself is kept, not even which prompt or view it asked for, and these records are not counted as tool requests anywhere.
These records never keep the contents of a request or its result. They are deleted after 90 days. Kiaro uses them to keep the service reliable and to see how AI apps are used.
When a request is turned away by the request or changes limits, or because the app isn’t allowed to make changes, Kiaro keeps only a sample: about one record a minute for the same person, tool or kind of request, and reason.
Two things are kept for longer than the request itself, because Kiaro needs them to do what you asked:
- Requests waiting for your approval keep what they need to run, and their result, until 90 days after you approved or rejected them, or after they expired. See Approvals.
- Changes an app sends with a retry key keep their result for 24 hours, so if the app sends the same change again within that time, Kiaro gives the same answer instead of making the change twice. After 24 hours the same key counts as a new change, and the stored result is deleted within a day after that.
What is sent to product analytics
Kiaro sends a few events about AI apps to its product analytics, with ids, counts and outcomes only, never names, field values or results:
- when you connect an AI app: the app’s id, its verified web address if it has one, how it registered with Kiaro, whether the connection is new, and whether it can make changes
- when an AI app is disconnected: the app’s id, and whether you or an owner or admin disconnected it
- when you approve or reject a request: the decision, how it ended and which action it was
- when you start connecting an app in Kiaro: which button or setup guide you used, such as copying the server URL or Add to Cursor
- once a day, how many tool requests each person’s AI apps made the day before, and how many of them worked, failed, waited for approval or were refused, how many different tools and apps were used, and the verified web addresses of those apps (such as claude.ai), with any other app counted only as “unverified”
If you have ticked Opt out of product analytics under Privacy & Analytics on your profile’s Account & Data page, none of these are sent for you.