Privacy Policy

Kinfolia holds your family's record. That only works if you can trust us with it, so this policy describes plainly what we collect, how it is used, who can see it, and the choices and rights you have.

What we collect

Account data:your email address and, if you use “Continue with Google,” your name and profile photo from Google — used only to create your account, sign you in, and connect you to your family. Family content your family adds: names, relationships, dates of birth and death, birthplaces and current locations (including approximate map coordinates derived from the place names you enter), life stories, photos, voice notes, and contact details (phone and social handles). Technical data: basic logs needed to run and secure the service. Payment details go directly to Stripe and never touch our servers.

Data about relatives who are not members

A family record naturally includes people who have not signed up — relatives, and people who have passed away. You may only add information about a living person if you have their consent (or, for your own minor child, you are their parent or guardian). By adding someone, you confirm this. Any person can ask us to see, correct, or delete the information held about them using the contact below, whether or not they have an account.

Children

Kinfolia is not directed to children and children may not create accounts. A card whose date of birth shows the person is under 18 is treated as a minor automatically: their photo, voice, and contact details are hidden from the wider family and shared only with a parent/guardian in the family or a family admin. We do not store voice recordings of minors at all. If you believe a child's data has been added without a parent's consent, contact us and we will remove it.

Who can see your family's data

Only approved members of your family's space. Each space is private and invite-only — joining requires an invitation and admin approval. No family's data is ever visible to another family, used to train AI models, sold, or shared with advertisers. Contact details are private by default; they are shared only when you explicitly exchange them one-to-one (for example by scanning a relative's QR code), which records a mutual, revocable sharing grant between the two of you, or if you choose to make yours visible to your space. Kinfolia support staff can, in rare cases, enter a space to help — this appears to the family as a visible member and is logged.

Service providers

We use these processors, each under their own security and privacy commitments: Supabase (database, authentication, file storage), Vercel (hosting), Resend (email delivery), Stripe (payments), Google (optional sign-in), OpenStreetMap / Nominatim, to which the place names you enter are sent to place them on the family map, and an AI provider that powers the optional writing helper and the in-app help assistant. When you choose to use those, the text you send is processed to generate a reply and is not used to train models; where the AI runs on our own servers, your text does not leave our infrastructure at all. Some of these providers are located in the United States; where required we rely on standard contractual clauses or equivalent safeguards for international transfers.

How long we keep it, and deletion

Your family's content is kept while the space exists. Deleting a card moves it to trash, from which it is restorable for 30 days; after 30 days it is permanently removed, and its photos and voice files are deleted with it. If a subscription lapses, the space becomes read-only — nothing is deleted and members are never locked out of viewing. A space owner can delete their entire space, and any person can request deletion of their own information, at any time.

Your rights

Depending on where you live (including under GDPR and the CCPA), you may have the right to access, correct, export, or delete your personal data, to object to or restrict its processing, and to withdraw consent. A space owner can export their entire space in a portable format at any time. To make any request — including access, correction, or deletion for a person who is not an account holder — email us at the address below; we respond within the time the law requires. We do not sell or “share” personal information as those terms are defined under U.S. privacy laws.

Security and breach notification

Data is encrypted in transit, files are stored privately and served through short-lived links, and each family's data is isolated at the database layer. No system is perfectly secure; if a breach affects your personal data we will notify you and any regulator as required by law.

Cookies

We use only the strictly-necessary cookies needed to keep you signed in and secure. We do not use advertising or third-party tracking cookies.

Changes & contact

We will post material changes to this policy here and update the date above. Questions or requests: privacy@kinfolia.com.