What We Can and Can't See

You should know exactly what we can and cannot access. No vague language, no fine print. Here is the full picture.

The short answer: we can see your email, your plan, and a small set of pseudonymous numbers about how the app is used. We do not access the content of your relationships. Below is the long answer, in detail.

What our servers can see

This is the complete list of information our servers can read:

• Your email address. Kinu requires an account so your data can be backed up, restored, and synced across devices. We use your email to manage that account and send you important messages, like a password reset.
• Your subscription status. Whether you are on the free plan, Kinu Plus, or Lifetime, so we can unlock the right features.
• Pseudonymous product analytics. Counts like how many people you have added, and which features get used. These are tied to a random support id, never to your name or your content.
• App version and platform. Whether you are on iOS, Android, or the web app, so we can fix issues and keep things compatible.

That is the full list. There are no hidden categories.

What our servers cannot read

Everything about your relationships is encrypted on your device before it ever syncs, and we do not access it as part of running Kinu. That includes:

• The names of your people. Who is in your life is your business.
• Moments. Anything you write or say about the people you care about, including voice notes.
• Private notes. These get an extra layer of protection. They are architecturally isolated from every feature, on top of being encrypted, so nothing in Kinu ever reads them.
• Important dates. Birthdays, anniversaries, and any custom dates you add.
• Relational Compass settings. Closeness, intention, and the per-person mode you choose.
• Lens names. How you sort your people into groups like Family, Friends, or Work.
• Any other content you create. If you typed it or recorded it, it is encrypted before it ever leaves your device.

Voice notes never leave your device

Voice notes are local-only, on any plan. They stay on the device where you recorded them and are never uploaded to our servers. They live with you, not with us.

Photos are not local-only. Once backup or Plus sync is on, they are encrypted on your device and travel with everything else. We still cannot read them.

On the free plan, nothing leaves your device until you say so

On the free plan, your data stays only on your device by default. If you turn on the free encrypted backup, your data goes to our servers the same way sync data does: encrypted on your device first, so there is still nothing on our servers to read beyond your account email, your plan, and the pseudonymous analytics above.

Sync is a Kinu Plus feature, and backup is a free feature; both are something you choose to turn on. Either way, the rules above still hold: your relationship content is encrypted on your device first, and we do not read it. You can read more in Sync Explained.

How your synced data is protected

When you sync, your relationship content is encrypted on your device before it is uploaded, and it stays encrypted in transit and at rest. Our servers store only encrypted blobs. Your relationship content is never used for analytics, never sold, and never folded into ads or social features.

We are also working toward user-held keys, derived from a secret only you know. Today your key is derived from your account, so our servers could in principle re-derive it. That is why we describe this as encryption in transit and at rest, and not yet zero-knowledge. User-held keys are a future improvement, not something available today, and we will say so plainly when they ship. For the full explanation, see Encryption Explained.

Why we collect any analytics at all

You might wonder why we collect even pseudonymous numbers. The reason is simple. We need to know which features people actually use so we can spend our time making Kinu better.

So we drew a hard line. Analytics never include what you write, who you add, or which dates matter to you. They record only that a feature was used, and how many times, tied to a random support id. There is no cross-app tracking and no advertising identifiers. If even that feels like too much, we understand. We keep the list small and content-free by design.

There is one exception, and it is a question rather than a measurement. Kinu may ask how you first came across it, answered with one tap from a fixed list of about six choices. That answer is saved against the same random support id, written once and never overwritten. It is the only thing in analytics you tell us on purpose, and it exists so we can find out where to spend our time without following you around the internet to work it out.

Account deletion clears everything

If you ever want out completely, you can delete your account in the app at Settings, then Account, then Delete Account. You can also start the process from our account deletion page. Deletion is immediate and permanent. It removes your account and all server data, and it wipes the data on your device. That includes the analytics profile described above, its counts and your one-tap answer, which is deleted along with everything else. Analytics deletion is queued the moment you delete your account and completes shortly after. You can read the full walkthrough in deleting your account.

Learn more

---

Still need help? Contact support