Privacy Policy

Alpha invitation list

The alpha signup is currently for adults aged 18 or older. If you choose to sign up, we collect only your email address, page language, consent version and timestamps. We store a hash of the short-lived email code in the database; the code is temporarily held in the encrypted mail queue and sent through Resend. This does not create a Kinly account or guarantee an invitation. We use your confirmed address only to invite you to the alpha and send essential alpha updates, based on your consent.

Unconfirmed requests are removed after 7 days; confirmed addresses are removed after 12 months unless you remove yours sooner at kinly.mobi/alpha/remove or ask us by email. You can withdraw consent at any time. Removal from the live list may not immediately remove copies already held in encrypted backups; the backup retention period has not yet been finalized.

Information you give us

An account can contain your name, email address, optional phone number and avatar, language and time zone. We store a password hash rather than your password. When you use Kinly, you can add family memberships and roles, invitations, tasks, checklists, routines, shopping lists, and activity records. Some of this content can include personal information you choose to write.

Technical and sign-in information

To keep accounts and the service working, we process authentication tokens, device and app details, IP address, user agent, timestamps, and operational logs. If you register a device for notifications, we store its push token. Notification delivery is still being prepared; availability depends on the app version and device permissions.

If you choose Google or Apple sign-in when available, we receive a provider account identifier and the profile information that the provider makes available, such as a verified email, name, or avatar. Apple may supply a private relay email. We do not receive your Google or Apple password. These sign-in options are not yet enabled for general use.

Why we use information

We use account and family information to provide the service you request: sign-in, shared planning, invitations, and account support. We use technical records to protect accounts, prevent abuse, diagnose failures, and maintain availability. Where applicable, these activities rely on providing the service, legitimate security and reliability interests, legal obligations, or your choice to enable an optional feature.

Who can see or process it

People in a family space can see content and member information according to their role and the app settings. An invitation recipient receives the invitation information needed to join. Do not put information in a shared list that you do not want other permitted family members to see.

We use DigitalOcean for hosting, Resend for service emails, Backblaze B2 for encrypted database backups, and Better Stack for availability monitoring. These providers process data needed for their respective tasks. Google and Apple process sign-in data if you choose their sign-in options after those options are enabled. We do not sell personal data or use it for advertising.

Storage, deletion, and backups

We keep account and shared content while the account or family space needs it, subject to deletion requests and applicable legal or security needs. Access tokens have limited validity and can be revoked. Some records and deleted content may remain temporarily in encrypted backups used for recovery. The off-site backup retention schedule has not yet been finalized, so we cannot state a fixed maximum period for those copies.

To request deletion of your account or personal data, contact us using the address below. We will verify account ownership and explain how shared family content and backups affect the request. The app does not yet offer a self-service account deletion flow.

International processing and security

Our service providers may process information in different countries. If you need details about a specific transfer and its safeguards, contact us. We use HTTPS, access controls, and encrypted database backups, but no online service can guarantee absolute security.

Your choices and rights

Depending on where you live, you may request access, correction, deletion, restriction, or a copy of your data, or object to some processing. Where processing depends on consent, you may withdraw it without affecting earlier lawful processing. You may also complain to a relevant data protection authority. Contact us to exercise these rights; we may need to verify your identity.

Teenagers and younger children

Kinly is intended for adults and teenagers aged 13 or older. It is not intended for children under 13. Additional age and parental-permission rules can apply where you live. If you believe a younger child has provided us with personal data, contact us.

Website cookies and updates

The public information pages do not use advertising cookies. Kinly may use essential session and security cookies on account or email-link pages. We may update this notice as the service changes and will show the new date here. Material changes will be communicated when required.