Back to Kindred

Privacy Policy

Last updated: July 30, 2026

1. About this policy

Kindred is operated by Ubuntu Market LLC. This policy explains how we collect, use, disclose, retain, and delete information through heykindred.org, the Kindred web application, and the Kindred mobile application (bundle/package ID com.ubuntumarket.kindred).

2. Information we process

  • Account and profile data: name, nickname, email, phone number, password hash, profile image, authentication provider, role, community membership, and account timestamps.
  • Community content: community details, invitations, events and RSVPs, announcements, chats and attachments, polls and votes, kinship links, care circles, budgets, travel plans, contributions, memories, images, voice notes, transcripts, translations, tags, and legacy threads.
  • Payment and subscription data: plan, billing cycle, amount, payment status, store, transaction and customer identifiers, renewal or expiration dates, and limited checkout metadata. Stripe, Apple, or Google processes payment credentials; Kindred does not receive full card numbers.
  • Device and notification data: push notification tokens, device/platform information made available by the mobile runtime, and notification preferences.
  • Usage and diagnostics: page views, clicks and other interactions, IP-derived and browser/device information, timestamps, product user ID, and technical events collected through Google Analytics/Google Tag Manager and PostHog.
  • Support and communications: support messages, email addresses, email delivery events, and notification or digest preferences.

3. Why we use information

  • Provide accounts, private communities, invitations, collaboration, archives, and support.
  • Authenticate users through passwords, Google Sign-In, or Apple Sign In and protect sessions.
  • Process purchases, validate entitlements, prevent billing drift, and manage subscriptions.
  • Deliver transactional email, community digests, reminders, and mobile push notifications.
  • Measure product use, diagnose reliability issues, and improve Kindred.
  • Generate optional AI assistance, including memory tags and summaries, gathering suggestions, stewardship suggestions, voice transcription, and Spanish/Yoruba translations.
  • Enable user-requested sign-on handoffs to configured Ubuntu Market sibling products.

4. Service providers and disclosures

We do not sell personal information. Code in the Service can disclose limited data to:

  • MongoDB and the configured hosting provider: application records, content, media stored as data URLs, and operational metadata.
  • Vercel and Railway: frontend and API delivery, including provider-generated request, browser/device, IP, log, and diagnostic information according to the active production configuration.
  • Stripe: web checkout, billing, customer, payment, and subscription data.
  • RevenueCat, Apple, and Google Play: mobile purchase identifiers, entitlements, store, status, and subscription dates.
  • Google: Google Sign-In identity data; Google Analytics and Tag Manager usage data; and, when the configured AI model uses Gemini, content supplied to that model.
  • PostHog (EU ingestion endpoint): product analytics, autocaptured interactions, page views, a Kindred user ID after sign-in, and authentication-provider label.
  • OpenAI or another LiteLLM-routed model provider: text, images, or audio submitted to enabled AI features. Whisper is used for voice transcription when configured. The actual provider is controlled by server model configuration.
  • Resend: recipient email address and the content of subscription notices and community digests.
  • Apple Push Notification service / Google push infrastructure: device token and notification delivery data when push notifications are enabled.
  • Legacy Table and Ile Ubuntu: name and email only when an authenticated user initiates a configured cross-product sign-in handoff.

We may also disclose information when required by law, to protect users and the Service, or as part of a business transaction subject to appropriate safeguards.

5. AI features

AI features are best-effort and are activated by particular user actions or product workflows. Depending on the configured model, relevant prompts, community text, uploaded images, or voice recordings may be transmitted to Google Gemini, OpenAI, Whisper, or another provider selected through LiteLLM. Do not submit sensitive content to an AI feature unless your community authorizes that use. Provider retention and training terms depend on the production account and contract configured by Kindred.

6. Storage, security, and retention

Kindred stores application data in the configured MongoDB database. Uploaded profile images, community attachments, images, and voice notes may be stored in database records as encoded data URLs. Passwords are hashed with bcrypt and network traffic is intended to use HTTPS/TLS. Access is restricted by account, community, and role checks.

Account, community, and subscription records are generally retained while needed to provide the Service and meet legal, security, and accounting obligations. One-time SSO codes have an automated short-lived database expiration mechanism; most other record categories have no automatic time-based purge in the current code. Provider logs, backups, analytics, payment, email, and AI-provider records follow each provider's configured retention. Production backup and vendor-retention periods require operator confirmation.

7. Your choices and controls

  • Edit available profile fields and notification or digest preferences in Kindred.
  • Disable push notifications in device settings and use available digest unsubscribe controls.
  • Manage or cancel subscriptions through Kindred or the applicable Apple/Google account settings.
  • Delete individual content where the product provides a delete control.
  • Delete your account in Settings. A community owner with other members must first transfer ownership. Sole-owner deletion cascades through the community records handled by the deletion endpoint; non-owner deletion removes the user's account/session records but may leave community content and operational records.
  • Use browser or device controls to limit cookies or analytics. Kindred does not currently provide a separate in-product analytics opt-out.
  • Request access, correction, deletion, or other applicable privacy rights by contacting us.

8. Children

Kindred is not directed to children under 13. Communities should not create accounts for children or upload children's personal information unless they have the authority and consent required by applicable law.

9. Changes and contact

We may update this policy as the Service or its providers change. We will update the date above and provide additional notice when required. For privacy questions or rights requests, contact:

Ubuntu Market LLC
Email: support@heykindred.org