Privacy Policy

1. Who we are

Kinrally is a family organizer app for iPhone, iPad and Android, operated by Core Layer Development LLC. You can reach us anytime:

• Email: support@kinrally.com
• Privacy & legal requests: privacy@kinrally.com
• Mail: 18006 Park Row, Ste 350 PMB 222, Houston, TX 77494

2. The short version

• We collect your email address so you can sign in and sync with your family. That's the only identifier we require.
• Most of your data stays on your device. Only what you share with your family group syncs through our servers.
• Calendar events you mark Private never leave your device. Events you don't mark private sync to your family.
• Family chat messages automatically delete after your chosen window.
• Vault documents are encrypted on your device before upload. This is strong protection against outside access, but it is not end-to-end encryption — see the vault section below for exactly what that means.
• Three features send data to an AI provider. Each one asks your permission first and names what it is sending.
• If another parent knows your exact email address, they can find your display name and family name in our lookup directory.
• No ads, no analytics trackers, no selling or sharing of your personal information.

3. Your account

Kinrally requires an account so that your family's synced data can only be reached by people you've invited. We store your email address, an encrypted password credential and an account identifier through our authentication provider (Supabase). We don't require your phone number, real name, street address or date of birth.

You can delete your account at any time from Family → My Profile → Delete Account, or without signing in at kinrally.com/delete-account. Deletion is irreversible. What it removes is described precisely in "What deletion actually removes" below.

4. Data stored on your device

These stay on your phone and are never uploaded to us: recipes, meal plans, your family timeline (journal), calendar events marked Private, saved stores and their arrival reminders, group task lists, your Get It Done service-link tap history, and app settings. Deleting the app deletes this data. (Taps on travel booking links are the one exception — see "Links to stores and service providers" below.)

If you are not in a family group, essentially nothing leaves your device except the email address used to sign in.

5. Data synced with your family

If you create or join a family group with a family code, the following is transmitted through and stored by our sync service so your family members can see it: shared lists, chores, family budget entries, shared to-dos, travel plans, member profiles, calendar events that are not marked private, and family conversations and messages (including voice notes, photos and videos you send). Every sync request must carry a valid signed-in session, so only members of your family group can read it.

Calendar events marked Private are excluded from sync entirely — they never leave your device. If you make an already-shared event private, Kinrally sends an instruction to remove it from other family members' devices.

Chat messages are automatically deleted after the auto-delete window chosen for that conversation, counted from the event date. Leaving your family group stops all syncing.

Family chat is not end-to-end encrypted. Conversations are private and invite-only, and are encrypted in transit, but messages pass through our sync service in a form our infrastructure could technically read. We do not read them, and we never use chat content for advertising, analytics or AI training. Please don't treat family chat as a secure channel for passwords, financial account numbers or similarly sensitive information.

6. Document vault encryption

Documents you add to the family vault are encrypted on your device with AES-256-GCM before they are uploaded, using a key derived from your family code (PBKDF2-HMAC-SHA256, 200,000 iterations). Our servers store only ciphertext, so a stolen backup or a compromised storage layer would not expose readable documents.

We want to be precise about the limit of that protection, because it matters. The encryption key is derived from your family code, and your family code is also used to route your household's sync data — meaning it is known to our service rather than to your devices alone. So this is not end-to-end encryption, and we do not claim we are technically incapable of decrypting your vault. What we commit to is that we do not access vault contents, and that the design keeps documents unreadable to anyone who does not hold your family code. Treat the vault as a convenient encrypted backup, not as a zero-knowledge safe, and keep your own copies of irreplaceable documents.

7. Parent directory

So parents can find each other, we store your email address, display name and family name in a private lookup directory. This means limited information about you is disclosed to people outside your household, so here is exactly how it is constrained: lookup is exact-match only, another parent must already know your full email address, and a match reveals only your display name and family name — never your email back to them, your address, your children or your household contents. There is no browsing, no partial or fuzzy search, and no way to list the parents in an area.

The email address registered in the directory is taken from your verified sign-in session, so nobody can register an address they don't control. Connecting with another parent is always mutual, either side can disconnect, and your directory entry is removed when you delete your account.

8. Location

Location is used for two optional features, and in both cases the matching happens on your device. We never receive or store your coordinates.

• Nearby store reminders — your phone watches for stores you've saved and fires a local notification when you're near one that has items still on your list. On Android this uses background location so the reminder can arrive while the app is closed; on iOS it uses the equivalent always-allow permission. The feature is off until you turn it on, and it is part of Kinrally Plus.
• Local events and neighborhood features — we use an approximate area (neighborhood or county level) to show relevant events and nearby families. We never store or share a precise address.

9. Device permissions

Permissions differ between platforms, so we list them separately rather than implying both apps ask for the same things.

iPhone and iPad

• Camera — only when you take a photo or record a video for a message, journal entry, vault document or flyer scan.
• Microphone — only when you record a voice note or video.
• Speech recognition — only when you use voice-to-text to add tasks.
• Photo library — to save a photo from a family message to your library.
• Location (when in use, and always-allow for nearby store alerts) — only for the optional features above.
• Calendar — only if you turn on two-way sync with your device calendar.
• Notifications — local reminders and message banners.

Android

• Internet — family sync and AI requests.
• Notifications — local reminders and message banners.
• Calendar (read and write) — only if you turn on two-way sync with your device calendar.
• Location (approximate, precise and background) — only for the optional features above; background access exists so a nearby-store reminder can arrive while the app is closed.
• No camera or microphone permission is requested. When you add a photo, the Android app hands off to your system camera or file picker, which returns just the file you chose. Voice notes are an iOS feature at this time.

You can revoke any permission in your device Settings at any time. Revoking a permission disables the feature that needed it and nothing else.

10. AI features and your consent

Three features send data outside the app: the AI meal planner, the flyer scanner and the AI trip itinerary planner. Nothing else in Kinrally does. Your calendar, lists, chores, budget, vault, timeline and family chat are never sent to an AI provider.

Before the first time you use each of those features, the app shows a disclosure screen naming the specific data it is about to send and the companies that will handle it, and it does not proceed until you agree. That agreement is stored on your device only — it is never synced to other family members or to us, because it is a personal decision. You can withdraw it at any time under Family → AI & Privacy, per feature or all at once, and the disclosure will appear again next time.

What each feature sends

• Meal planner — your saved allergies, dietary styles, household size, the number of meal slots to fill, the titles of your saved recipes, and any free-text preference note you write. Allergy information is health information about your family, and the disclosure screen says so plainly before anything is sent.
• Flyer scanner — the single photo you choose, in full. Anything visible on that image goes with it, including a child's name, face or school if the flyer shows them. Choose accordingly.
• Trip planner — the destination, dates and trip request you type, and your household size.

Who handles it

An AI request passes through three companies before a result comes back:

1. Rork — the platform Kinrally is built on; its service receives the request and forwards it.
2. Vercel AI Gateway — routes the request to the model provider.
3. Google (Gemini 2.5 Flash) — generates the result and returns it.

We don't send your name, email or account identifier with these requests, so the content is not tied to your identity by us. We do not use your household's data to train AI models, and we have no arrangement permitting these providers to use your content to train theirs; their own terms govern their handling once the request reaches them.

AI output is a suggestion, not professional advice, and can be wrong. Always verify anything that matters yourself — especially allergen and ingredient information, and especially dates and prices read off a scanned flyer.

11. Links to stores and service providers

Some features let you tap through to third-party retailers, booking sites or local service providers. Those links may include an affiliate or referral code, which means Kinrally may earn a commission at no extra cost to you. As an Amazon Associate, we earn from qualifying purchases. Once you leave the app, that company's own privacy policy applies, and we don't receive your order details.

When you tap a shopping or Get It Done service link, the app records it — which partner, which category, when — on your device only, so it can show you your own history. That log is capped, is not uploaded to us, and is deleted when you delete the app.

Taps on travel booking links work differently, and we want to be straight about it. If you are in a family group, tapping one records the partner name, the category, the trip it relates to, whether you got there from the AI planner or your own search, and the time — to your household's record on our sync service, not just your phone. We use it to understand which travel partners are worth keeping. It contains no prices, no order details, no passenger names and nothing about what you actually booked, and it is never used for advertising or profiling. If you are not in a family group, nothing is recorded at all. It is erased if you erase your household's shared data.

If you request a quote from a service provider, that is different: the request has to be sent somewhere to be useful. The app shows you exactly which fields will be shared and asks for your consent before sending, and quote requests can only be sent from an adult profile.

12. Cookies, tracking and Global Privacy Control

We run no advertising pixels, no third-party analytics and no cross-site tracking, on this website or in the apps. We store only what's strictly necessary to make a page work, and on this website we read and honor the Global Privacy Control (GPC) signal and the older Do Not Track header as valid opt-out requests. The full list of what's stored in your browser is on the Cookies & Tracking page at kinrally.com/cookies.

GPC is a browser signal, so it applies to this website. The mobile apps have nothing equivalent to opt out of — they contain no advertising or tracking SDKs at all.

13. How long we keep things

Your account record lives until you delete your account. Synced family content lives on our sync service while your household is active, and chat messages are removed automatically on the auto-delete schedule set for each conversation.

After a deletion runs, residual copies can persist briefly in routine encrypted infrastructure backups held by our providers before those backups age out. We don't restore deleted accounts from them, and we don't use them for any other purpose. We keep one record of a deletion itself — the date, and a one-way SHA-256 hash of the email address, never the address — so we can answer a later compliance question without keeping a list of former users. Those records are pruned after 60 days.

14. What deletion actually removes

Deleting your account always removes your sign-in credentials, signs out every device, and removes your parent directory listing so other parents can no longer find you.

Your household's shared records are a separate decision, because they belong to everyone in the household and not to you alone — erasing them would delete your family members' lists, chores and messages too. So the deletion screen asks you to choose. The last two options need your family code:

• Leave the household alone — only your account goes away. Shared records stay as they are, still showing your name.
• Remove your name from shared records — your family keeps their calendar, chores and lists, but your profile is replaced with "Former member" and your age and quiet hours are cleared. Everything that referenced you now shows that anonymous label. This is the recommended option when other people still use the household.
• Erase all shared household data — wipes the household's synced calendar, chats, photos and vault files for everyone in it. Intended for when you're the last member, or everyone agrees.

To offer the middle option we have to know which profile in the household is you, so after you enter your family code the page lists the household's profile names and you pick your own. That lookup needs both a verified deletion link and the family code, and it returns nothing but the names.

Data held only on your device is removed by deleting the app. If you want everything gone, choose the third option and delete the app afterwards. If any step can't be completed automatically, the page tells you so and we finish it by hand within 30 days.

15. How we protect your data

Traffic is encrypted in transit, family sync requires a signed-in account and is verified on every request, and Documents Vault files are encrypted on your device before upload subject to the limits described above. If you believe you've found a vulnerability, please report it privately — see our Security page at kinrally.com/security. No online service can promise perfect security, so please keep your own copies of documents that matter.

16. Local events feed

The events feed fetches listings from public event websites (for example visithoustontexas.com). These requests are governed by those sites' own privacy policies. We don't send them personal data about you.

17. Recipe import

When you import a recipe, our service fetches the page from the link you paste and extracts the recipe. The link is used only for that and isn't stored on our servers.

18. Service providers

These are the companies that can process data on our behalf. We use no analytics, advertising or tracking SDKs, and we don't sell or share personal information with anyone.

• Supabase — accounts and authentication (email address, encrypted password credential, account identifier).
• Cloudflare (Workers and Durable Objects, United States) — family sync, the parent directory lookup, recipe extraction and the deletion workflow. Synced family content and vault ciphertext are stored here.
• Rork — the app platform Kinrally is built on; its service relays AI requests from the three AI features.
• Vercel (AI Gateway) — routes those AI requests to the model provider.
• Google (Gemini 2.5 Flash) — generates AI meal plans, trip itineraries and flyer readings.
• Apple and Google — app distribution, crash reporting you opt into at the OS level, and, once purchasing is enabled, payment processing. We never receive your full payment card details.

19. Children

Kinrally is intended for adults, who may add their children as members of their family group. Child member profiles (name, age, avatar) are created and controlled by the parent and are visible only within the family group. We don't knowingly collect personal information directly from children, and features that contact outside businesses are restricted to adult profiles.

Two things are worth a parent's attention. A photo you scan with the flyer reader is sent to an AI provider in full, including any child's name or face printed on it. And content a child posts in family chat syncs to the other members of that conversation. Both are described where they happen in the app.

If you believe a child has provided us information directly, email privacy@kinrally.com and we'll delete it.

20. Your rights

You can access and delete your on-device data in the app or by deleting the app, and you can delete your account from Family → My Profile → Delete Account or at kinrally.com/delete-account, which works without signing in. Depending on where you live — including under the California CCPA/CPRA and the Texas TDPSA — you may also have the right to request a copy of your data, correct it, or ask us to delete it, and to be free from discrimination for exercising those rights.

Email privacy@kinrally.com from your account email address and we'll respond within 45 days. We don't sell or share personal information for cross-context behavioral advertising, so there is no such opt-out to exercise, and we honor Global Privacy Control signals on this website as opt-out requests.

21. Accessibility of this policy and our services

We want this policy, our privacy choices and our privacy request process to be usable by everyone, including people with disabilities. We work toward WCAG 2.1 Level AA on this website and follow Apple's and Google's accessibility guidance in the app, and this notice is offered in a format designed to work with screen readers, larger text and increased-contrast settings.

If you need this policy or any privacy disclosure in an alternate format, or you need help submitting a privacy or deletion request because of a disability, email accessibility@kinrally.com and we will provide the information in another way and help you complete the request at no cost. We aim to acknowledge accessibility requests within 5 business days. Requesting an accommodation never affects your privacy rights and we will not treat you differently for asking. Accessibility efforts are ongoing and described in full in our Accessibility Statement at kinrally.com/accessibility; we do not guarantee that every part of the service is free of barriers.

22. Changes

If this policy changes, we'll update this page and the effective date above. If a change materially reduces the protection of information we already hold, we'll give notice in the app before it takes effect.