KinelloGet the app
Get the app

A private hub for one family.

Kinello Privacy Policy

Effective and last updated: October 25, 2026

Policy revision: 2026-10-25-family-brief-opt-in

Kinello is a private, invitation-only family app in the United States. This policy explains what Kinello collects, why it is used, who can receive it, how long it is kept, and the choices and rights available to account holders. Contact: support@kinello.net.

Age and family profiles

Kinello login accounts are for people age 13 or older. A parent or other adult may create an adult-managed family-tree profile for a younger child, elder, or deceased relative. Those profiles do not receive login access. If Kinello learns that a login account belongs to someone under 13, it will delete the account and associated personal data.

Data Kinello handles

  • Account and identity data: email address, authentication-provider identifiers, display name, optional birthday and profile photo, account eligibility attestation, and legal-notice versions accepted.
  • Private family content: family membership and role, invitations, events, celebrations, trips and flight details, shopping lists and audiences, polls, recipes, manually entered meal and produce records, pets, family-tree people and relationships, and the people, notes, dates, and photos members choose to add. Kinello does not analyze meal photos or generate calorie estimates from them with AI.
  • Memories and location: selected photos; photo capture date, time, timezone, and GPS metadata when available; a location taken from photo metadata, device location, search, or manual entry; place names and coordinates; and people tagged in a memory. When a member attaches photos, Kinello reads the earliest photo's capture date and time and turns its GPS metadata into a place name, fills those into the form before it is saved, and shows what it used with a one-tap undo beside it; nothing is saved until the member saves the memory, and the values can be changed or cleared first. Kinello re-encodes uploaded photos, but the date, time, place, and coordinates a member chooses to save with a memory remain in the memory record.
  • City and timezone: a chosen city, its center coordinates, timezone, and whether the member shares that city with family. Kinello does not request an address or continuously track location.
  • Health and fitness data: an aggregate daily step total, local date, timezone, source, and sync time only after the member enables step sharing. Kinello attempts updates when the app opens or resumes and through permitted background work. The operating system, connectivity, battery settings, and health permissions determine when background work runs; updates are not guaranteed hourly or at midnight. Later synchronization can backfill earlier daily totals and update weekly results. Raw step samples, routes, workouts, and other health categories remain in Apple Health or Health Connect and are not uploaded to Kinello. Family step sharing alone does not give an AI provider access. Named aggregate totals may reach an AI provider only when an owner or admin enables AI step insights for the family and that member separately allows AI analysis of their own totals.
  • Communications and AI: family-chat messages and replies, mentions, emoji reactions, pinned and saved messages, links to shared family records, voice notes, photos and files sent in chat, and Kinello answers. Kinello requests microphone access when a member chooses to record a voice note, and camera access when a member chooses to take a photo to send in chat. Sent recordings, their duration, sender, and time are stored in private family storage and shown in family chat. Voice-note audio is not sent to an AI provider or automatically transcribed. Kinello does not record ambient audio when the member is not using the recording control. A member can attach a photo or a file (PDF, Word, Excel or text, up to 10 MB) to a chat message; the photo or file, any words sent with it, its sender, and time are stored in private family storage and shown in family chat, and Kinello reads only the photo or file the member picks. A photo or file in chat is sent to an AI provider only when the member's own message with it includes `@Kinello`. An ordinary family message stays in the family chat unless a member requests the separately opted-in chat catch-up described below. When a member explicitly includes `@Kinello`, that saved message, any photo or file attached to it, and the family records needed to answer it go to an approved AI system; the answer is posted back into the shared family chat for every family member to read. Named step totals are included only under the separate two-key AI-step permission described below. See "AI processing" below for who receives the request and what is sent. Kinello can prepare drafts from an explicit request; records are created only after the member reviews and saves them.
  • Reports and blocks: when a member reports a message or other family content, Kinello stores the reason, any details the member adds (up to 1,000 characters), what was reported, and who posted it. The family's owners and admins can read reports, and the reporter can also choose to send a report to Kinello. Blocks between members are recorded so Kinello can respect them, for example by leaving a blocked member's messages out of the blocker's chat catch-up.
  • Referrals and invitations: a personal Kinello referral code and link, when that link is shared from Kinello, the account that later claims it, and whether the claim came from a Kinello share link or a family invitation. Kinello uses those verified claims to show the sharer an account-to-account referral tree and derived counts of families created and currently active Plus families. Kinello does not learn whom a member selected inside Messages, email, or a social app, and opening a share sheet alone does not create an attribution. A referral link never grants access to a private family. Names in the referral tree are shown only when the viewer and referred account are also members of the same family; otherwise the person appears as "Kinello member." An active Plus-family marker describes a family the referred account created and does not identify who paid.
  • Calendar, camera and photo permissions: Kinello accesses a selected photo, or the camera, only after a member chooses that action, such as taking a photo to send in family chat. Kinello saves a memory photo to the device's photo library only when the member taps Save on that photo. Kinello reads or writes the device calendar only when a member asks to add a family event. Calendar contents are not uploaded as a contact list or background calendar copy.
  • Device and service data: push token, platform, notification preferences, app configuration, and security or service logs needed to operate and protect the service. Some app versions include optional advertising measurement, described below; it is off unless the member turns it on. Kinello also stores first-party activation events (which screen was opened, and which of a fixed list of actions occurred) so the family owner can see whether the family is using the app. These first-party events do not include message text, photo contents, names, or step totals.

Optional product analytics and session recordings

In My settings → Sharing & privacy, you can choose to share app usage with PostHog to help us understand feature use, navigation, and problems. This is optional and off until you opt in on your device. Usage data includes a random device identifier, app/device information, lifecycle events, tabs opened, and fixed feature-action names. We do not send your name, email, family ID, message contents, photos, health totals or precise location as event properties. We do not use this data for advertising or cross-app tracking.

Masked session recordings are a separate optional choice, available when usage sharing is on. They show app navigation and interactions so we can identify confusing flows. Text, typed inputs, images and supported system-picker views are masked. Console logs and network details are excluded from recordings. PostHog processes this optional data in its US cloud. Session recordings are retained for 30 days; product analytics is retained for up to one year under our current plan.

You can turn either choice off in My settings → Sharing & privacy. Turning off usage sharing also stops session recording. Signing out clears both choices on this device. Turning sharing off stops future collection; it does not automatically delete previously submitted data. Contact support@kinello.net for help with deletion requests.

Optional advertising measurement

Advertising measurement is optional and off by default. If you turn it on for this device, Meta and Google Analytics for Firebase receive limited app events and device information to measure which ads bring people to Kinello. This includes app activation and family creation or joining, together with SDK-generated app/device identifiers, advertising identifiers where permitted, app and operating-system versions, and ordinary network information such as an IP address. These identifiers can link activity for advertising measurement; this data is not anonymous.

Kinello does not send family messages, photos, precise or private family locations, health data or step totals to these advertising services. Kinello does not provide your account ID, family ID, email address or name for advertising matching. This integration does not configure personalized-ad audiences.

This choice is separate from PostHog usage analytics and Sentry error reports. You can change each choice in My settings → Sharing & privacy. On iOS, advertising measurement also requires permission in Apple's tracking prompt. Declining does not block Kinello features. Turning measurement off stops future app-event forwarding and resets local analytics state; it does not retract data already received by a provider. Signing out clears the choice on this device, and reinstalling can reset device-local choices.

Meta and Google process received information under their applicable privacy terms, including provider-controlled retention and deletion procedures. See Meta's privacy policy (https://www.facebook.com/privacy/policy/) and Google's privacy policy (https://policies.google.com/privacy). Contact support@kinello.net for help with a privacy request.

Error reporting

Error reports are optional and off until you enable Error reports on this device. When enabled, Kinello uses Sentry's US cloud to diagnose application errors and improve reliability. Error reports include the app version and build, environment, normalized error type and code, a fixed screen label, whether the error was fatal, and a limited stack trace with device and developer filesystem paths removed. Reports do not include raw error messages, family content, names, email addresses, request data, interaction breadcrumbs, screenshots or session recordings. PostHog's optional recordings are controlled separately as described above. This integration reports errors captured by Kinello's JavaScript error handlers; it does not currently collect native crash reports or performance traces.

Kinello receives data from the account holder, other members of the same family, the device and permissions the member enables, Apple or Google authentication if selected, Apple Health or Health Connect if step sharing is enabled, and service providers used to operate Kinello.

Kinello uses data to authenticate members; keep the family hub private; display and synchronize family content; provide requested health, calendar, photo, location, notification, weather, AI, invitation, and referral-tree features; measure verified referral conversions and, when a member turns it on, which ads bring people to Kinello; prevent abuse; troubleshoot failures; meet legal obligations; and respond to privacy requests.

Where European or UK law applies, Kinello relies on performance of the service agreement, consent for optional permissions and health processing, legitimate interests in securing and improving the private service, and legal obligations. Health data is processed only after an explicit step-sharing choice and may be withdrawn at any time.

Health data notice and choices

Daily step totals may be consumer health data. Collection and family sharing are off unless the member affirmatively enables them. AI analysis is a separate two-key choice: an owner or admin enables AI step insights for the family, and each member separately decides whether their own aggregate totals may be analyzed. Neither key overrides the other, and a payer has no authority over a member's personal choice. A member may withdraw AI permission without stopping family sharing, or disable step sharing entirely. More detail is in the Kinello Consumer Health Data Privacy Policy.

AI processing

Kinello sends selected family information to an approved AI system through these features: `@Kinello` in the family chat, when a member explicitly mentions it in a question, text, photo or PDF imports when a member asks it to read a recipe, flight itinerary or event invitation; optional on-demand chat catch-up; and the weekly family newsletter, which is written once a week for each family that has turned it on in family settings.

Which AI system processes it. Production Kinello keeps a short, ordered list of approved AI providers and sends each request to the first one on that list that is available:

  • Kinello's own self-hosted NVIDIA DGX Spark, operated by Kinello in the United States.
  • OpenAI, in the United States.
  • Anthropic, in the United States.

A request goes to one provider at a time, and Kinello may move to the next listed provider when a provider is unavailable or a request fails, so a single question can reach more than one of them in turn. The DGX Spark is operated by Kinello; OpenAI and Anthropic are outside processors. Adding a production provider that is not on this list requires an updated policy before family information is sent there. Kinello asks every provider handling a request not to keep a copy of it, and does not give family content to anyone to train an AI model.

What `@Kinello` sends. The saved family-chat message that explicitly contains `@Kinello`, any photo or file attached to that message, plus the family records Kinello reads to answer it — only records shared with the entire family and available to the requesting member. Private recipes, private memories and custom-audience shopping lists are excluded. Shared memory text, ideas, pet details, plans, recipes, lists and poll results may be read when needed. Chat can analyze records and prepare editable poll, event, reminder or trip drafts. Nothing is created until the requester reviews the draft and taps Create. For follow-ups, Kinello may send that same member's last three explicit `@Kinello` exchanges in this family from the past two hours. An owner or admin can enable longer conversation memory, extending that window to 30 days. Earlier answers are reused only after checking that their source records and permissions still match; otherwise Kinello reads current records again. Ordinary, later or unrelated family messages and private assistant history are not included. A member can forget their own Kinello conversation context in Manage family without deleting family-chat messages. Removing a message, losing membership or a relevant block prevents reuse. Short-lived provenance stores hashes and record-read parameters; it is cleared after the applicable window, while shared chat retains its usual deletion behavior. The generated answer is saved in that same shared conversation and is visible to every member of the family. For a step question, Kinello sends only the first name and aggregate total of members covered by both AI-step keys and current consent versions. A member who shares steps with family but does not allow AI analysis is excluded. When a member explicitly imports a recipe, flight itinerary or event invitation, or requests help drafting a memory, the text, photo or PDF they select is sent to the AI provider to create an editable draft. A PDF selected for an import is limited to one file up to 10 MB and is not posted to chat or stored as a trip attachment. The full selected document, image or text may contain personal details; members should crop or remove details they do not want processed before importing. Kinello does not automatically save or publish the draft. Memory and profile photos are not automatically sent to AI. A photo explicitly selected for memory drafting is processed only for that request; the draft and selected photo remain private until the member reviews the audience and saves.

What chat catch-up sends. This separate feature is off by default. A family owner or admin must enable it, and the requesting member must explicitly agree before each summary. It sends the words of up to 100 eligible shared messages from the last seven days, including words typed with a photo or file. It never sends voice notes, photos or files, and it leaves out deleted messages and messages from members the reader has blocked. The result links to source messages, is shown only to the requesting reader, and is not stored as a chat message or summary history. No background chat summaries are generated. An owner or admin can turn it off in Chat under Ask Kinello / Catch me up. AI providers process these requests under the provider controls described above.

What proactive family help sends. When an owner or admin enables proactive help, cheap database checks look once per local day for relevant changes. AI reviews are limited to two per family per week, at least 48 hours apart; skipped and failed reviews count too. Eligible shared plans, poll results, shared goals and opted-in six-month or one-year memory anniversaries can be included, according to the selected topics. Private or selectively shared records, ordinary chat and photos are excluded. Suggested notes link back to family records. Phone alerts for proactive suggestions require each member's separate opt-in. Requested scheduled reminders are saved calendar items; delivering them to family chat does not send another AI request.

What the weekly newsletter sends. Nothing at all unless an owner or admin has turned the weekly newsletter on in family settings; for a family that has not turned it on no newsletter is written and nothing about that family's week reaches an AI system. A family that has turned it on sends: the family's name, members' first names, how many new memories and completed shopping items there were, and—only when both AI-step keys apply—the combined aggregate steps of opted-in members, how many opted-in members had steps, and an AI-eligible step champion. When richer newsletters are enabled in family settings, Kinello uses the same shared-record readers as family chat to prepare a short briefing. It can read family-shared memory text, titles, places and dates (including an older memory newly shared that week), current shared goals, relevant plans, trip destinations, dates and checklists, the names of upcoming birthdays and other occasions, the first names of members who joined, shopping lists, poll questions and results, and a count of chat messages. It excludes contributions blocked from any current member and rechecks its sources before publication. It does not use a member's conversation memory or create polls, reminders or other records while writing. The newsletter runs on the existing weekly schedule, with at most three AI rounds per attempt and bounded retries. The finished letter is saved for the family and its headline is posted in family chat. Opening the saved report does not call AI again. When there is no useful supported update, Kinello may skip an edition instead of filling it with generic text.

What is excluded from automatic AI processing. Private memories, memory and profile photos, photos and files sent in chat (unless attached to the member's own `@Kinello` message), voice notes, login credentials, and records belonging to another family are not automatically sent. The newsletter still receives only a message count, never chat text. Ordinary shared chat text is processed only through the separate, explicitly requested catch-up feature described above. Import requests process only the source the member selects; they do not search photos, email or files in the background.

Kinello stores a new `@Kinello` question and answer in the shared family chat. Older private Ask Kinello histories are not moved into the family chat and remain private to the account that created them until deletion. AI answers can be wrong and are not medical, legal, financial, or emergency advice.

Family story and collections

The family story brings together memories and past family activity, including completed polls and their results, completed plans, weekly step winners, and weekly family summaries. Each item retains its audience and permission rules. Collections group existing memories; another family member may attach a family-shared memory to a family-shared collection even if they did not create it. This does not grant permission to edit or delete that memory or reveal a private memory. Private collections remain limited to their creator.

When data is disclosed

  • Other members of the same invited family receive only records and fields allowed by the app's family, audience, and consent controls. A custom shopping list is limited to its selected audience. Private memories remain limited to their creator.
  • Supabase provides authentication, database, private file storage, and Edge Function hosting.
  • RevenueCat verifies optional Plus purchases made through Apple or Google. Billing providers receive an opaque payer identifier, product and transaction information, subscription status and device/store information needed to process the purchase. Kinello links verified access to the selected family and retains billing status and operational purchase records to provide access, restore purchases, handle disputes and measure paying-family conversion. Family chat, photos and AI prompts are not sent to RevenueCat. Payment card details are handled by the purchasing store, not collected by Kinello.
  • Vercel hosts Kinello's public invitation and referral landing pages and receives ordinary web-request data such as IP address, user agent, requested page, and time.
  • Expo's notification service and Apple or Google push services deliver notifications only when enabled. A notification can show a family member's first name, the family's name, and a short detail such as a trip's destination or the weekly letter's headline; chat notifications do not show message text.
  • PostHog and Sentry receive optional usage analytics, masked session recordings and error reports only when a member turns them on, as described above.
  • Meta and Google Analytics for Firebase receive optional advertising-measurement data only when a member turns it on, as described above.
  • Apple or Google provides authentication when selected and provides the on-device health store when step permission is enabled.
  • Open-Meteo receives city-search text or saved city-center coordinates needed to return a city, timezone, or weather result.
  • The approved production AI providers listed under "AI processing" above — Kinello's self-hosted DGX Spark, OpenAI, and Anthropic — process explicit `@Kinello` requests, selected recipe/itinerary/invitation imports, opted-in chat catch-up requests, and the weekly newsletter.
  • Authorities or another party may receive data when legally required or necessary to protect members, the service, or others.

Kinello does not sell personal data and does not make family content public. Apart from the optional advertising measurement described above, which shares limited app events and device identifiers with Meta and Google only after a member turns it on, Kinello does not share personal data for cross-context behavioral advertising. Service providers may process data only to provide their contracted service. Data may be processed in the United States and other locations where providers operate, subject to their contractual safeguards and applicable transfer requirements.

Offline access

Kinello keeps an encrypted, account-scoped copy of recently loaded family information on this phone so returning members can read it without internet. Saved records expire after 30 days and may be removed sooner to limit storage. Signing out, changing accounts, or a confirmed access change clears this saved information. Previously downloaded photos and attachments may remain in the app’s device cache until cleared or removed by the operating system. Drafts and unsent chat messages stay on the device until sent or removed; a pending message is sent after the app reconnects and rechecks account access. AI requests, first-time sign-in, family membership changes, and most edits still need an internet connection.

Retention and deletion

Account, family, family-chat (including sent voice notes, photos and files), collection links, legacy assistant-history, referral-link, referral-share, and referral-attribution data is kept while needed to provide the active account, family, or referral-tree feature. Expired invitations, notifications, and operational logs may be retained for security, support, and legal needs. Members may remove individual content and sharing choices in the app.

Family photo storage has a family-wide allowance: 1 GB on Free and 20 GB on Plus. When Plus ends, existing media remains readable and downloadable, but new uploads pause if the family is above the Free allowance. Kinello gives a 90-day grace period and places notices in the family's Activity feed at the start of the grace period and again with approximately 30, 7, and 1 day remaining. A push notification is also attempted when that member has enabled push. After the deadline, Kinello removes only the oldest media needed to bring the family within the Free allowance, starting with content photos before profile, person, or pet photos. The family records themselves remain. Renewing Plus or reducing usage before cleanup cancels the scheduled removal. Transactional email is not currently part of this notice process.

Account deletion removes the login, account-owned private rows, push tokens, consents, step totals, assistant messages, referral links, referral share events, referral attributions involving that account, and uploads, including photos, voice notes and files the member sent in family chat. Messages the member sent stay in the family chat without being linked to the deleted account. Billing and AI-usage records are kept without that link where needed for accounting, disputes and abuse prevention, and deleting the account does not cancel a store subscription. Removing an attribution may also disconnect the deleted account's branch from an ancestor's referral-tree view. Shared family records are transferred to another family member so the family history is not unexpectedly destroyed; the deleting member's attribution is removed where it is not needed. If no family member remains, the family and its records are deleted. Provider backups may retain encrypted copies for a limited disaster-recovery period and are not used as active product data. Account holders can use Account settings in the app or the public Kinello account-deletion page.

Security

Kinello uses encrypted network connections, encrypted mobile credential storage, short-lived signed photo URLs, private storage, authenticated server functions, row-level and per-family authorization, least-privilege database grants, and tests for cross-family access and destructive account operations. No system is perfectly secure. Kinello will investigate suspected incidents and provide legally required notices.

Rights and requests

Depending on location, an account holder may request access, a portable copy, correction, deletion, restriction, withdrawal of consent, or an explanation or appeal of a privacy decision. California residents may also request to know, correct, or delete covered data and may exercise applicable opt-out rights. Kinello does not sell personal data; the only sharing that may count as cross-context behavioral advertising is the optional advertising measurement, which is off unless a member turns it on and can be turned off at any time in My settings → Sharing & privacy. If something is missing from the in-app account export, such as a file attached in chat or a billing record, ask and Kinello will provide it. Washington and Nevada residents may exercise applicable consumer health data rights under the separate health policy.

Use in-app controls where available or email support@kinello.net from the account email. Use the subject "Kinello privacy request" and state the request. Kinello may verify identity before acting and will respond within the period required by applicable law. A member may also complain to their local data-protection authority.

Changes

Kinello will update the date and the relevant consent version when this policy materially changes. Base step sharing and personal AI-step consent have independent versions, so a change limited to AI recipients or AI use does not silently disable family step sharing.

Back to top