Kindred - AI Personal CRM

Privacy Policy

Last updated: October 15, 2026

Overview

Kindred ("we", "our", "the app") is a personal relationship management app. We take your privacy seriously. This policy explains what data we collect, how we protect it, and your rights.

Our Privacy Commitment

Kindred is built on a privacy-by-design architecture. Your relationship data — contact names, voice notes, transcripts, relationship insights, and interaction history — is stored in an encrypted database on your device, and is not uploaded to our servers. The key that opens that database is held in your device's hardware-backed secure storage (iOS Keychain / Android Keystore).

Two things do leave your device, and neither carries your relationship records: a small amount of account and operational data needed to run the app (listed under Data we store on our servers), and — only with your explicit permission, and only for the feature you asked for — content sent to OpenAI for AI processing.

Note (October 15, 2026): an earlier version of this policy described your relationship records as being encrypted on your device and then uploaded to our servers as ciphertext. The app has never done this — that data has only ever been stored on your device. This version corrects the description. If we introduce server-side sync in future, we will update this policy and tell you before it takes effect.

Data We Collect

Data you provide

• Account information: Email address and password (for authentication)
• Voice recordings: Audio recordings you make within the app (up to 30 seconds each)
• Contact information: Names, relationship tiers, tags, important dates, and notes you add about your contacts
• Tasks and reminders: Follow-up items you create or accept from AI suggestions

Data processed with your permission

• OpenAI processing: Before Kindred sends personal data to OpenAI, the app identifies OpenAI, explains the categories of data involved, and asks for your explicit permission. Depending on the feature you request, this may include audio, transcripts, notes, prompts, and relevant contact context.
• Transcripts: Voice recordings from AI-backed voice features are sent to OpenAI for transcription. The resulting transcript is stored encrypted on your device.
• AI insights: Transcripts, prompts, notes, and relevant contact context may be sent to OpenAI to produce requested summaries, tasks, contact matches, messages, or coaching responses. AI-proposed changes to relationship records are not saved without your review.

Data we store on our servers

Your relationship records are not among them. Contacts, notes, voice recordings, transcripts, tags, important dates, tasks, interactions and insights are never uploaded — they exist only in the encrypted database on your device. What we do store is limited to:

• Account information: Your email address and authentication credentials, managed by our authentication provider (Supabase Auth).
• Authentication tokens: Session tokens issued when you sign in.
• Device tokens: Push notification tokens for delivering reminders (no sensitive content in push payloads).
• Device registry: When you pair your own devices, a record of each device's name, platform, public key and last-active time, so your devices can recognise one another.
• Feedback you send: The text of any feedback you choose to submit from inside the app.
• AI usage counters: For each AI request, the model name, the feature that made the request, and token counts — numbers only, never the content of the request.
• Anonymous usage statistics: Only if you turn them on. See the section below.

Anonymous usage statistics (opt-in)

If you choose to turn on Anonymous Benchmarks (Settings → Anonymous Benchmarks; it is off by default), Kindred contributes a small set of anonymous numbers about your app usage — such as your network-size range, interactions per week, and how recently you've been in touch with contacts — roughly once per week. These values are rounded into ranges on your device before they are sent, and the format is restricted to numbers from a fixed list: it cannot carry names, notes, transcripts, or any content you've written or recorded. Contributions are combined with those of at least 49 other users before any comparison is shown to anyone, raw contributions are deleted from our servers within 30 days, and turning the setting off stops contributions immediately and requests deletion of your not-yet-combined numbers. Deleting your account also deletes them.

Data we do NOT collect

• We do not collect location data
• We do not collect device contacts or phone book data without your explicit action
• We do not track your browsing activity
• We do not serve advertisements
• We do not sell or share your data with third parties for marketing

How We Protect Your Data

On-device encryption

• Your relationship data lives in an encrypted database on your device (SQLCipher). It is encrypted at rest, so it is unreadable to anything that cannot open it with the key.
• A unique master encryption key is generated on your device and stored in your device's hardware-backed secure storage (iOS Keychain / Android Keystore). The master key never leaves that storage.
• We have zero ability to read your relationship content — not because we hold it as ciphertext, but because we do not hold it at all.
• A breach of our servers would not expose your contacts, notes or transcripts, because they are not there.

Recovery key and device loss

• During setup, you can generate a recovery key. It is shown once, and we do not store it — we cannot show it to you again.
• What it does: it unwraps your master encryption key on a device that still holds your data — for example if the secure-storage entry is lost but the app's database is intact. The wrapped copy it unlocks is stored on your device, not on our servers.
• What it does not do: because your relationship data is stored only on your device, the recovery key cannot retrieve your data onto a new phone. There is no server-side copy for it to restore from.
• Moving to a new phone: your data travels in an encrypted device backup or a direct device-to-device transfer, which carry both the database and its key. It is not included in iCloud Keychain sync.
• If your device is lost or wiped with no backup, your data cannot be recovered by us or by anyone else. If that matters to you, keep device backups switched on, and use the in-app export.

Third-Party Services

OpenAI (Speech-to-Text and AI Processing)

• Only after you grant permission, data needed for the AI feature you request is sent to OpenAI's API over encrypted connections (TLS)
• OpenAI processes this data to produce transcriptions and requested AI results
• OpenAI does not use API inputs or outputs to train its models by default unless the API customer explicitly opts in
• OpenAI may retain API inputs and outputs for abuse monitoring for up to 30 days by default; endpoint-specific exceptions and approved retention controls may apply
• See [OpenAI's Privacy Policy](https://openai.com/privacy)

Supabase (Authentication and Account Data)

• Manages user authentication and stores the limited account and operational data listed under *Data we store on our servers*
• Your relationship records are not stored there
• See [Supabase's Privacy Policy](https://supabase.com/privacy)

Firebase Cloud Messaging (Push Notifications)

• Delivers push notification nudges to your device
• Push payloads contain only generic messages (e.g., "Time to reconnect") — never contact names, transcripts, or other sensitive content
• See [Google's Privacy Policy](https://policies.google.com/privacy)

Push Notifications

Push notifications from Kindred are privacy-safe nudges only. They never contain:

• Contact names
• Transcript content
• Summaries or AI-generated text
• Any personally identifiable information about your contacts

Notification content is loaded in-app after you tap, where it is decrypted on your device.

Your Rights

You have the right to:

• Access your data: All your data is visible within the app
• Export your data: You can export your contacts and interaction history
• Delete your data: You can delete your account and all associated data
• Control AI processing: You can grant or revoke OpenAI processing at any time under Me → OpenAI processing. Revoking stops new data from being sent to OpenAI and disables AI-backed features; typed notes and other local features remain available. AI-proposed changes to relationship records require your review before they are saved
• Manage notifications: You can disable push notifications at any time in your device settings

Data Retention

• Your data is retained as long as your account is active
• When you delete your account, the account and operational data we hold is permanently deleted within 30 days. Local data on your device is cleared once the server confirms deletion
• Voice recordings are stored only on your device, inside the encrypted database. They are not uploaded (audio is sent to OpenAI for transcription only when you request an AI feature and have granted permission)

Children's Privacy

Kindred is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe we have collected data from a child, please contact us.

Usage Analytics

The release that includes Me → Share usage analytics collects limited usage information by default to help us improve Kindred. You can turn it off at any time. Events include screen IDs, feature actions, onboarding steps, capture pipeline stages, counts, durations, app version, operating-system major version, and a broad device class. For example, screen.view with screen: ProfileMain records that the settings screen was viewed. These events never include names, contact IDs, notes, recordings, transcripts, chat messages, precise location, or advertising identifiers.

Events use a randomly generated analytics ID stored on your device. This is pseudonymous, not anonymous: a separate restricted ownership record associates that ID with your account so that only you can request deletion and deleting your account removes analytics from all your devices. We store events in our existing first-party Supabase infrastructure for up to 13 months, with daily retention cleanup. We do not sell usage data or use it for advertising or tracking across other companies' apps or websites.

Turning sharing off stops collection and uploads, clears queued events on your device, and requests server deletion. If you are offline, the deletion request is saved and retried when you reconnect while signed in. Turning sharing back on creates a fresh random ID. Signing out stops collection for that account. Account deletion removes all of that account's analytics identities and events. This setting is separate from optional anonymous aggregate benchmarks and does not enable benchmark contributions or AI processing.

Changes to This Policy

We may update this policy from time to time. We will notify you of material changes through the app or via email. Continued use of the app after changes constitutes acceptance.

Contact Us

If you have questions about this privacy policy or your data:

• Email: privacy@kindredmemory.com
• Website: https://kindredmemory.com/privacy

App Store Privacy Labels

Reviewed 2026-09-12 (BUG-098). These labels are stated against what the app actually transmits, and match the App Store answers in docs/APP_STORE_LISTING.md and the Play Data Safety answers in docs/RELEASE_RUNBOOK.md. Relationship records are not uploaded; what leaves the device is listed under *Data we store on our servers* above, plus content sent to OpenAI when you enable AI processing.

iOS App Privacy (Nutrition Labels)

Data Linked to You:

• Contact info — account name and email address, held by the authentication provider
• User content — voice recordings, transcripts and note text sent to OpenAI for a feature you requested, after you grant permission; and the text of feedback you choose to submit
• Contacts — contact records you keep in Kindred (name, organization, how recently you were in touch) are included as context in those AI requests, after you grant permission
• Identifiers — authentication user ID, push notification token, device-registry entry; random operational analytics ID in the release with usage analytics
• Usage data — content-free operational analytics (default on with a Settings opt-out in the release that includes the toggle), and AI usage counters (model, feature, token counts; numbers only) and, if you turn them on, anonymous benchmark contributions

Data Not Linked to You:

• Diagnostics (crash logs, performance data — no user content)

Data Not Collected:

• Your device address book (importing contacts writes them only to the database on your device)
• Contact photos
• Location
• Browsing history
• Search history
• Identifiers for advertising
• Purchases

Not used for tracking. No data is used to track you across other companies' apps or websites.

App Tracking Transparency

Kindred does not track users across other apps or websites. We do not use the IDFA or any tracking identifiers. The App Tracking Transparency prompt is not required.