Privacy policy

Effective 11 October 2026. Kinlets is provided by Syzygy Capital B.V., De Nieuwe Erven 3, 5431 NV Cuijk, the Netherlands (KvK 85041076, VAT NL863483537B01). Questions about your data: privacy@kinlets.app.

The short version

• What we keep: your account (name, email, age range from Apple), the apps you make or join and what people put in them (records, comments, photos, places you save), your purchases of credits, and security data about your iPhone and your sign-ins.
• Why: to run Kinlets for you and the people you share with, keep accounts safe, stop abuse, apply the free AI allowance and improve Kinlets. Not for advertising.
• No ads, no tracking, never sold. Kinlets has no ad or analytics SDKs in the app and does not share your data with data brokers.
• Who sees your app's data: the people in that app, as the app shows before anyone joins. The owner of an app decides what it collects and who sees what, and can change that later. Never the public unless an app is made public. Templates carry the design only, never data.
• AI: when you describe or change an app, your description and the app's design go to an AI model through OpenRouter, only to providers that keep nothing and do not train on it, in the US or the EU, never in China. The records in your apps are never sent. You can stop us using your descriptions to improve Kinlets in Settings.
• Your choices: download your data (Settings, Privacy and data, Download my data) or delete your account (Settings, Privacy and data, Delete account) at any time.
• Age: Kinlets is for ages 13 and up. Listed and public apps, and apps with guests, are for adults.

1. Who is responsible

Syzygy Capital B.V. (address above) is the controller for your account, sign-in, devices, purchases, safety, AI use and the website. We have not appointed a data protection officer, because the law does not require one for Kinlets; write to privacy@kinlets.app or to our postal address.

For the content inside an app, the owner of the app decides what the app collects, who joins and who sees what. For a family or household app this is private use. For other apps the owner is responsible for that content and we store and sync it for them. Each person is responsible for what they add. We remain responsible for our own use of app content (safety checks, reports, backups and legal duties) and for your private entries in a public app, which only you can see.

2. What we use, why, and on what legal basis

• Account: your Apple user id (stored scrambled), the name and email you share (possibly a Hide My Email address), and your age range from Apple's Declared Age Range (13 to 15, 16 to 17, 18 or older, or not shared). To run your account and keep minors out of adult-only places. Basis: contract.
• Email sign-in: your email address and one-time codes (stored scrambled). Basis: contract and security.
• Devices and sign-ins: a key bound to your iPhone through Apple App Attest and DeviceCheck, your sessions, and the IP address and the device description your app reports (app and iOS version) when a session starts. To keep you signed in, spot sign-ins you do not recognise, stop abuse, and give one starting credit per iPhone. Basis: contract and legitimate interest in security.
• Your apps: the designs, notes, records, comments, photos and files in apps, and who is in them. To run the apps for the people in them. Basis: contract; for app content we act for the app's owner.
• What you type for the AI: what you write to make or change an app, the app's design and notes, and the result. To make the change; and, unless you switch off Help improve Kinlets (Settings, Privacy and data), to improve Kinlets, including training and testing AI models. Never for people under 18, and never the records, photos or files in your apps. Basis: contract for making the change, legitimate interest for improving Kinlets.
• AI usage: the cost of each AI request, your monthly allowance and an account trust level. To keep AI spending within limits. Basis: contract and legitimate interest in stopping abuse.
• Credits and purchases, once credits are offered: every credit movement, Apple transaction ids and, for web purchases, order, amount and VAT country. Card details stay with Apple or Stripe. Basis: contract and tax law.
• Safety: reports, blocks, moderation decisions and statements of reasons; automatic checks of text and images, including text read from images, QR codes and a nudity flag the phone sends with photos for public apps; and, once that service is connected, matching photos against lists of known child sexual abuse images. Basis: legal duties under the Digital Services Act and legitimate interest in the safety of users.
• Notifications and email: your push token and the emails we must send (sign-in codes, receipts, security and account notices). News and tips only if you opt in, which you can undo at any time; we keep a record of your choice. Basis: contract; consent for news and tips.
• Security logs and staff actions: request logs, rate limit counters (with your IP address only in scrambled form) and a log of every staff action. Basis: legitimate interest in security; legal duties.
• Support: your messages to us. Basis: contract or legitimate interest; legal duties for rights requests and notices.
• Website: kinlets.app sets no cookies. Cloudflare Web Analytics counts visits without cookies and without a personal profile. Basis: legitimate interest.

You can object at any time to the uses based on legitimate interest, including improving Kinlets (see section 6).

3. How long we keep it

• Your account and your apps: as long as your account exists. Deleted apps stay 30 days in Recently deleted, then go for good with their photos.
• What you type for the AI: at most as long as your account exists, and deleted with it.
• Sessions with their IP address and device description: while the session lasts and 30 days after it ends. Rate limit counters: 8 days. Sign-in codes: a day after they expire.
• Device records and App Attest keys: 24 months after the iPhone was last used. Your age range is cleared as soon as you delete your account; the scrambled Apple id stays until the end of that month.
• AI run statistics (no text of what you typed): 90 days.
• Credit and purchase records: at least 7 years, as Dutch tax law requires; after an account is deleted they are no longer linked to a profile.
• Staff action log: 7 years. Moderation decisions, statements of reasons and authority orders: kept as our record of compliance. Evidence of abuse images: as long as the law requires.
• Backups: 30 days.

4. Who receives your data

• The people in your apps, according to each app's rules, as the join screen shows.
• Our service providers: Cloudflare (hosting, storage, network, our safety checker, website statistics), PlanetScale (database, EU region Frankfurt), OpenRouter and the AI providers it may use (for example DeepInfra and Together AI, US; never providers in China), Resend (email), Stripe (web payments and payouts, when switched on) and Apple (sign-in, purchases, notifications, device checks, age range). Apple and Stripe also act on their own account.
• Authorities, only when the law requires it or to protect someone's life or safety.
• A buyer of the business, under the same promises, after telling you first.

We do not sell personal data and do not share it for advertising.

5. Outside the EU

Some providers are US companies or run worldwide (Cloudflare's network, OpenRouter's gateway, Resend, Stripe, Apple). For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (for OpenRouter in its data processing agreement, which also covers the AI providers in the US). The AI model never runs in China. Ask privacy@kinlets.app for a copy of the safeguards.

6. Your rights

You can ask to see, correct, delete or take your data with you, ask us to restrict its use, and withdraw consent at any time. You can object at any time to the uses based on our legitimate interest, including improving Kinlets with what you type; switching off Help improve Kinlets does this at once. Most of this works in Settings; for the rest write to privacy@kinlets.app. We answer within one month. For content someone else added about you in their app, ask that app's owner first, or write to us.

You can complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or the authority where you live.

Automatic decisions: new accounts get a smaller AI allowance that grows with use, and some text and images are held automatically before they are posted. None of this closes an account on its own; a person always decides that, and you can ask for a person to look at any automatic decision.

7. Deleting your account

Settings, Privacy and data, Delete account. We disconnect Sign in with Apple and sign you out everywhere. Apps you own are deleted (after 30 days in Recently deleted). What you added to other people's apps stays there as "Deleted user"; your private entries in public apps are deleted. Unused credits are handled as the credit terms say. Records we must keep by law stay, no longer linked to your profile.

8. Children

You must be 13 or older to have an account. Parents can keep information about their children in their own apps. Please do not add sensitive information, such as health details, that an app does not need.

9. Changes

We tell you in the app or by email before an important change to this policy takes effect.