Privacy Policy
The short version: You own your care data. We use it only to run the service. We do not sell it, share it with advertisers, or use it for any purpose beyond what's described here. You can export or delete everything at any time.
Who we are
Kin is operated by Smallsystems.co, a business registered in Singapore. When this policy refers to "Kin", "we", "us", or "our", it means Smallsystems.co and the Kin service accessible at trykinapp.com.
For privacy inquiries, you can reach us at privacy@trykinapp.com.
What we collect
We collect only what's necessary to provide the service.
Account information
- Your email address (used for login and to send you the weekly digest)
- Your subscription status and billing history (processed via Stripe — we do not store card numbers)
Care log data
- Appointment notes, medication records, next-step reminders, and care observations you enter
- The dates and times of your log entries
- The names and email addresses of family recipients you add to your distribution list
Usage data
- Pages visited and features used within the app (anonymised, no ad targeting)
- Device type, browser, and operating system
- IP address (retained for security and fraud prevention only)
We do not collect health records, clinical notes, or any data from healthcare providers. The care notes you enter are your own words, not imported clinical data.
How we use your information
We use your data for exactly three purposes:
- Delivering the service — assembling your care log entries into a digest and sending it to your chosen family recipients
- Managing your account — authentication, subscription billing, and customer support
- Improving the product — understanding which features are used to make Kin more useful (never for advertising)
We do not use your care data to train AI models, sell to third parties, or share with advertisers. Ever.
Who we share your data with
We share data only with the sub-processors required to run the service:
- Supabase — database and authentication (your data is stored on Supabase infrastructure in Singapore or the nearest available region)
- Stripe — payment processing (Stripe processes payment card data; we receive only a subscription status token)
- Resend / Postmark — transactional email delivery (digest emails sent to your family recipients pass through an email delivery provider)
- Vercel — hosting and edge delivery of the web application
We do not share data with any marketing platforms, analytics companies that sell data, or healthcare organisations.
We may disclose data if required by Singapore law or a valid legal order. We will notify you of such a requirement to the extent permitted by law.
How long we keep your data
We keep your data for as long as your account is active. When you cancel:
- Your care log data is retained for 30 days so you can export it
- After 30 days, all care log entries are permanently deleted from our systems
- Your email address is retained for legal and billing record purposes for 7 years, as required under Singapore's accounting standards
You can request immediate deletion at any time by contacting us. In that case, we will delete your care data within 72 hours and your account within 14 days, except where retention is legally required.
Your rights
Under Singapore's Personal Data Protection Act (PDPA) and, where applicable, the EU/UK General Data Protection Regulation, you have the right to:
- Access — request a copy of all data we hold about you
- Correction — ask us to correct inaccurate data
- Deletion — ask us to delete your data ("right to be forgotten")
- Export — download your full care record in PDF or JSON format at any time from your account settings, without needing to contact us
- Objection — object to any processing you did not consent to
To exercise any of these rights, email privacy@trykinapp.com. We will respond within 30 days.
Security
All data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is restricted to authorised personnel and protected by multi-factor authentication.
We do not store passwords — login uses a magic link sent to your email, eliminating the password attack surface entirely.
If we become aware of a data breach that affects your data, we will notify you within 72 hours.
Children
Kin is not directed at children under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has registered an account, contact us and we will delete the account immediately.
International transfers
Kin is operated from Singapore. If you are accessing the service from Malaysia, Australia, or another country, your data may be transferred to and processed in Singapore and the data centre regions used by our sub-processors (see section 4).
These transfers are protected by the contractual terms in place with each sub-processor and, where applicable, by standard contractual clauses.
Cookies
We use a single session cookie to keep you logged in. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
You can disable cookies in your browser settings. Doing so will mean you need to log in each time you visit.
Changes to this policy
If we make material changes to this policy, we will notify you by email at least 14 days before the change takes effect. Continued use of Kin after that date constitutes acceptance of the updated policy.
Minor changes (correcting typos, clarifying language without changing meaning) will be made without notice and noted in the version history at the bottom of this page.
Contact us
For any privacy questions, requests, or concerns:
- Email: privacy@trykinapp.com
- Operator: Smallsystems.co, Singapore
- Response time: within 30 days
If you are unsatisfied with our response, you have the right to lodge a complaint with Singapore's Personal Data Protection Commission at pdpc.gov.sg.