Kinfidential Privacy Policy
Effective date: October 18, 2026
Applies to: the Kinfidential iPhone app, including TestFlight beta builds
Kinfidential is a baby tracker for parents and caregivers. We built it to know as little about you as possible. This policy explains, in plain language, what the app stores, where it stores it, who can see it, and how you delete it.
We will not tell you that Kinfidential "collects no data." It does: to sync your family's log between phones, some information has to live on a server. This page tells you exactly what that is.
The short version
- No account to create. We never ask for your email address, phone number, password, or a social or Sign in with Apple login.
- Names are encrypted on your phone. Your child's name and each caregiver's display name are encrypted before they leave the device. Our servers only ever hold the scrambled version, and we do not have the key to unscramble it.
- What our servers can read: the care entries you log (feeds, sleeps, diapers, pumping sessions), your child's date of birth, and random ID numbers that are not tied to your identity.
- No ads, no third-party tracking, and no third-party analytics or crash-reporting SDKs. We do not sell your data.
- Apple handles all payments. We never see your card or payment details.
- You can delete everything from inside the app.
What Kinfidential stores
On your iPhone
Everything you enter is saved on your phone first, so the app works without a connection. This includes your child's name, your display name, and your care entries. The key that encrypts names (the "family key") is kept in your phone's Keychain.
On our servers (Supabase)
When your phone is online, Kinfidential syncs the following to a database we operate on Supabase, a cloud database provider:
| What | Can we read it? | Why |
|---|---|---|
| Care entries: entry type (feed, sleep, diaper, pump), start and end times, bottle and pumping amounts, milk type (breast milk or formula), breastfeeding side, diaper type (wet, dirty, both) | Yes | To sync your log between caregivers and devices |
| Your child's date of birth and preferred feeding mode (breast or bottle) | Yes | To show your child's age and choose which buttons to show first |
| Your child's name | No, encrypted on your phone | To show the name on every caregiver's phone |
| Each caregiver's display name | No, encrypted on your phone | So caregivers can see who logged each entry |
| Random IDs for your account, family, children, and entries, plus which account logged each entry and who belongs to which family | Yes | To keep the right data with the right family |
| Invitation records: a one-way hash of each invite code, who sent it, and when it was created, expires, was used, or was cancelled | Yes (not the invite code itself) | To make invites single-use and expiring |
| A recovery check value: a salted one-way hash derived from your recovery secret, and a count of failed recovery attempts | Yes (not the secret itself) | To let a reinstalled app prove it is you without us holding your secret |
The IDs are random numbers created on your device. They are not your name, email, phone number, or Apple ID.
What we do not collect at all: email addresses, phone numbers, mailing addresses, passwords, photos, free-form notes, contacts, location, advertising identifiers, or social profiles. The app has no free-text notes field, so there is no place for other personal or medical details to end up on our servers.
Technical information. Like any internet service, the companies that carry and host the app's traffic (Apple and Supabase) may process technical information such as IP addresses and request logs when your phone connects. We do not use this to identify or track you. Supabase keeps these request logs for at most 7 days, after which they are deleted automatically. We look at them only to diagnose a problem with the service.
In your own iCloud (account recovery)
To get your family back after you delete and reinstall the app, or move to a new iPhone, Kinfidential saves one small recovery record in the private iCloud database of the Apple Account your iPhone is signed in to. That record holds your account ID, a recovery secret, and, once you have a family, your family ID and family key.
- Each field is encrypted with Apple's iCloud encryption under a key in your iCloud Keychain, so neither we nor Apple can read it.
- It lives in your iCloud storage, not on our servers. We cannot access it.
- It does not contain your care entries, your child's name, or your child's date of birth. Your log is not backed up to iCloud by this feature. It syncs through our servers as described above.
- If iCloud is turned off or unavailable, the app still works, but it tells you that automatic recovery is not currently on. Recovery only works with the same Apple Account. It does not move between different Apple Accounts.
Where your data is stored
Our Supabase database is hosted in the United States (AWS region us-west-2, Oregon). The iCloud recovery record is stored by Apple under your Apple Account, according to Apple's terms. Kinfidential is currently offered only outside the European Union and the United Kingdom. If you use it outside the United States, the information described above is transferred to and stored in the United States.
All data travels over encrypted (HTTPS/TLS) connections.
How we use information
We use the information above only to:
- run the app: save, sync, and show your family's log on each caregiver's phone;
- handle invitations, family membership, and account recovery;
- understand, in aggregate, how the app is used. For example, we might count how many families log each type of entry, or how usage changes as children get older. We do this with database queries over the anonymous information described above. These counts never use names, because we cannot read them, and the app contains no analytics SDK.
We do not use your information for advertising, we do not build profiles of you, and we do not sell or rent it.
Who can see your family's data
- Caregivers you invite. Everyone in a Kinfidential family sees every child and every entry in that family, along with each other's display names. You add someone by sending an invite link from the app. The link contains the key that unlocks your family's names, so send it only to someone you trust. Each link works once and expires after 7 days.
- Our service providers. Supabase hosts our database and processes the server data described above on our behalf. Apple provides iCloud, the App Store, TestFlight, and payments. Cloudflare hosts this website and the invitation links, so it sees the IP address and page address of anyone who opens one; the part of an invitation link that unlocks it never reaches the website. We do not use any other third parties to process your data.
- Legal requirements. We may disclose information if the law requires it. Because we cannot read names and do not collect contact details, there is very little we could disclose.
Your family's server data is protected by access rules in the database itself, so one family cannot read another family's data, even if it knows that family's ID numbers.
Purchases
Kinfidential is free to download. It offers a free "14-day Trial" and an optional one-time Lifetime Unlock, both sold through Apple's In-App Purchase system. Apple processes all payments, and we never receive your name, card number, or billing details. The app checks your purchase status on your phone through Apple's StoreKit. We do not store your trial or purchase status on our servers. Kinfidential has no subscription, and it never charges you automatically when the trial ends.
Diagnostics
Kinfidential contains no third-party analytics, advertising, attribution, or crash-reporting tools. If you have chosen in your iPhone settings to share analytics with app developers, Apple may give us crash reports and diagnostics through App Store Connect and Xcode, following Apple's own privacy terms. The app is built not to write names, keys, or secrets into its logs.
TestFlight betas: if you test a beta through TestFlight, Apple also gives us any feedback or screenshots you choose to send, crash reports from the beta, and the details Apple shares about testers (such as the email address your invitation was sent to). These are kept by Apple in App Store Connect, and the app never links them to your family's data.
How long we keep data, and how to delete it
Your log is kept until you delete it. Deletion in Kinfidential is permanent. There is no recycle bin, and we do not keep recoverable copies in the app's database.
- Deleting an entry removes it from our servers and from every caregiver's phone the next time they sync.
- Deleting a child (Children → Remove) permanently removes that child, their encrypted name, date of birth, and every entry logged for them, from our servers and from every caregiver's phone. Before you delete, the app offers to export the child's history as a file. That file contains your child's name and history in readable form. It goes wherever you choose to save it (for example, iCloud Drive or Files), and we never receive a copy.
- Deleting everything (Family → Delete family and data, available to the person who created the family). After you type DELETE to confirm, this permanently removes the family, every child, every entry, every caregiver's membership and pending invitation from our servers, and deletes the recovery record from your iCloud. Every caregiver loses access, and the copy on your phone is erased. You need an internet connection for this, so we can confirm the server deletion before anything is erased on your phone.
- Leaving a family (Family → Remove from this phone → Leave this family, for caregivers who did not create it) removes your membership and erases the family from your phone. Entries you logged stay in the family's history so the other caregivers keep a complete log.
- Being removed. The family creator can remove another caregiver. That person loses access right away, and the family is erased from their phone the next time it connects.
What remains after deletion. After you delete everything or leave a family, two things stay on our servers: your random account ID, and your recovery check value (the salted hash described above). Neither one contains a name, a date of birth, or any care data. We keep them so the app keeps working properly if you start over. If you want these removed as well, email us and we will delete them, though we may need your help to identify which ones are yours. If you delete your whole family while another of your own devices still has the app installed under the same account, open the app on that device and delete there too.
Backups. Our database host may keep automatic daily backups for disaster recovery for up to 7 days. Data you delete can remain in those backups until they expire, and then it is gone for good. We never use backups to restore an individual user's deleted data.
You can also remove the app at any time. Deleting the app erases its data from that phone. Your family's server data and your iCloud recovery record are not deleted until you use one of the deletion options above.
Children's privacy
Kinfidential is used by parents and caregivers to record information about their baby. The app is for adults, and children are not its users. We do not knowingly allow children to use the app or collect information from children. The information about a child (an encrypted name, a date of birth, and care entries) is entered by their parent or caregiver, who controls it and can delete it at any time as described above. If you believe a child has used the app on their own, contact us and we will help delete the data.
Your choices and rights
Because Kinfidential has no accounts and no contact details, we generally cannot look you up or match a request to your data. Your data is controlled from inside the app, where you can view, edit, export (per child), and permanently delete it. If you have a question or a request, contact us at the address below. Depending on where you live, you may have legal rights to access, correct, or delete your personal information, and we will honor those requests as far as we can identify the data involved.
Security
We use HTTPS for all connections, encrypt names on your phone with AES-GCM before upload, keep encryption keys only on your devices and in your private iCloud, and use database access rules so each family can reach only its own data. No security is perfect. If you lose a phone, anyone who can unlock it can open the app.
Changes to this policy
If we change this policy, we will post the new version on this page and update the effective date. If a change significantly affects what we collect or how we use it, we will also say so in the app or in the release notes.
Contact
Email: support@kinfidential.app