Privacy Policy

Kinfolio

1. Overview

Kinfolio (the "App") is a privacy-first personal CRM for friends and family. It is built so that we physically cannot access your notes: the App has no accounts, and everything you write lives on your device (and, if you enable sync, in your own cloud, end-to-end encrypted). The only data that can reach Google on our behalf is crash reports and the strictly opt-in statistics and ad-measurement signals described in section 9. This policy explains what data the App processes and where it lives.

2. Data We Collect

Kinfolio never collects the content of your notes and never sells any data.

• No registration or account is required;
• Nothing you write in the App is sent to our servers by default; the only exception is the opt-in AI server mode described in section 5;
• The App shows no ads and contains no third-party ad-network SDKs. Anonymous usage statistics are collected only if you opt in; crash reports keep the App stable; ad measurement for our own app-install campaigns runs only if you separately opt in (section 9);
• No cross-site tracking and no data brokers. Ad measurement, if you enable it, only attributes installs and conversions of Kinfolio itself — it does not follow you across other apps or build advertising profiles of you.

A few features can move data off the device — only at your explicit request, and only to destinations you own or choose yourself (your own cloud storage, an AI provider used with your own key, or — in the optional Pro AI mode — our stateless AI relay, section 5). They are described below; all of them are optional and off by default.

3. Your Notes Stay on Your Device

Everything you record — people, facts, photos, journal entries, dates, tags — is stored in a local database on your device. The App never uploads it anywhere unless you turn on sync (section 4).

4. Sync Through Your Own Cloud (Optional)

You can sync your data between your devices through your own cloud storage — your personal iCloud or your personal Google Drive app folder. We operate no sync servers and are not part of this path at all.

• Before anything leaves the device, the data is end-to-end encrypted (AES-256-GCM) with a key derived from a 12-word recovery phrase that is shown only to you and kept only in your device's secure storage (Keychain/Keystore);
• Neither we nor the cloud provider can read the content — without the phrase the archive is unreadable;
• Signing in with Google (if you choose Google Drive) is used solely so the App can write to its own hidden app-data folder in your Drive;
• Turning sync off with "start fresh", or deleting the App's data in your cloud, removes the archive.

5. AI Features (Optional)

AI features do nothing until you set them up, and nothing is ever sent in the background. Only the text you explicitly submit — a description of a person, or a request for conversation topics — is sent, and only at the moment you ask. There are two modes:

• With your own API key (e.g. Anthropic or OpenAI): the text is sent from your device directly to that provider, under your own account and that provider's privacy terms. We never see, store, or relay it. The key is kept in your device's Keychain/Keystore;
• In the "Kinfolio server" mode (part of Kinfolio Pro): the text travels through our relay server to OpenAI, which generates the answer. The relay is stateless — it does not store, log, or analyse the content of requests or answers; technical logs contain only timestamps, status codes, token counts and an anonymous subscription identifier (a one-way hash). OpenAI processes the text under its API terms: API data is not used to train models and may be retained for up to 30 days for abuse monitoring, then deleted;
• To prevent abuse, the server mode verifies your Pro subscription (section 8) and applies a daily request limit per subscription.

6. Device Permissions

• Contacts (optional) — only if you start the import yourself. Names, photos, and birthdays of the contacts you select are read once and processed on-device; nothing is sent over the network. You can revoke access in system settings at any time;
• Calendar (optional) — only if you enable the pre-meeting briefing. Events are read on-device to match meeting participants with your people and to schedule a local reminder; no calendar data leaves the device;
• Camera / photo library (optional) — only to set a person's photo. The image is stored in the local database and goes nowhere else (unless you sync — encrypted, to your own cloud);
• Notifications — birthday, keep-in-touch, and briefing reminders are local notifications scheduled on the device itself. No push servers (APNs/FCM) are involved.

7. Backups, Import & Export

Backups are created only at your request. Each backup is a single file encrypted with AES-256-GCM using a password that only you know, and it is stored wherever you choose to send it (a file, your cloud, a messenger). Without the password the backup cannot be read — by anyone, including us. Plain JSON/CSV export and import are likewise manual, user-initiated actions: the App only creates the file and hands it to you.

8. Purchases & Subscriptions

Kinfolio offers an optional Kinfolio Pro subscription (monthly or yearly). Payments are processed entirely by Apple App Store or Google Play under your store account.

• We never see or store your payment details — no card numbers, no billing address;
• Your subscription status is checked on-device against the store and cached locally. The only exception is the optional AI server mode (section 5): to unlock it, the App sends your store receipt reference (an App Store transaction ID or a Google Play purchase token — never payment details) to our server, which verifies it with Apple or Google and issues a temporary access token. The receipt reference is not stored; rate limiting uses only an anonymous one-way hash of it;
• Subscriptions auto-renew until cancelled in your App Store / Google Play account settings; refunds are handled by Apple / Google under their policies;
• Purchases are per-platform: an App Store subscription does not transfer to Google Play and vice versa. See the Terms of Use for details.

9. Crash Reports, Usage Statistics & Ad Measurement

To keep the App stable, understand which features matter and measure our own app-install ads, we use Google Firebase and Google Ads. None of these streams ever contains the content of your notes.

• Crash reports (Firebase Crashlytics) — collected automatically when the App crashes: stack trace, device model, OS version and an installation identifier. Retained by Google for 90 days;
• Usage statistics (Firebase Analytics) — only with your consent (a switch during onboarding; change anytime in Settings → Privacy): which screens and features are used, app version, device model, language. Events carry no note content and no record identifiers; a pseudonymous app-instance ID is used. Retained up to 14 months;
• Ad measurement — only with your separate consent (the "Ad measurement" switch, off by default): Google measures how well our own app-install campaigns perform. On Android this uses the device advertising ID (AAID), shared with Google Ads for install and conversion attribution; on iOS no IDFA is used at all — attribution relies on Apple's aggregate, privacy-preserving SKAdNetwork framework, which reports no user-level data. Consent signals follow Google Consent Mode v2 and stay "denied" until you opt in; withdrawing consent stops the sharing immediately;
• No IDFA, no App Tracking Transparency prompt on iOS, and no data is ever sold. Ad measurement is used for nothing beyond evaluating Kinfolio's own campaigns;
• Firebase data is processed by Google LLC on our behalf under the Firebase Data Processing Terms; for Google Ads measurement Google acts as an independent controller under the Google Privacy Policy. Processing takes place in part on servers in the USA, safeguarded by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

10. Your Rights and Control

Your notes live with you, and you are in full control of them: export a backup at any moment, or delete the App — all local data disappears with it. If sync was on, the encrypted archive stays only in your own cloud, where you can delete it yourself or erase it from the App's settings. We hold none of your notes and cannot read them.

For the telemetry described in section 9 (GDPR): the data controller is the developer named above (contact — section 13). Usage statistics and ad measurement rely on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in Settings → Privacy — collection stops immediately; crash reporting relies on our legitimate interest in keeping the App stable (Art. 6(1)(f)). These streams are pseudonymous — we cannot identify you from them. You have the right to access, rectify or erase this data, restrict or object to its processing, and lodge a complaint with your supervisory authority; Google's automatic retention windows (90 days for crash data, up to 14 months for analytics) apply in any case.

11. Children

The App is not directed at children under 13 and does not knowingly collect personal data from children.

12. Policy Changes

If future versions add features that move data in new ways, we will update this policy before launching them and describe exactly what goes where. The "Last updated" date will be revised accordingly.

13. Contact

Email: hollybyte.com@gmail.com