Privacy & security

All your data, calendar events, notes, documents, health records, is scoped to your family: every request that reads or changes it is checked against your family on our servers, so other families can't see it. KinLife staff don't browse your calendar, notes, or documents day to day.

A small number of KinLife administrators can open the assistant's conversations, including the results it looked up to answer you. That access is read-only, and it is used to find and fix mistakes, to help you when you ask, and for security or legal reasons.

The assistant uses Google Gemini to understand your requests and read documents you upload. The AI model processes your content to answer you, but does not train on or retain your documents. Some quick decisions about a message, such as which mode the assistant should answer in, may be made by OpenAI instead. OpenAI sees only the text of that message, with names, contact details, links and account numbers replaced first, never the assistant's replies, your files, photos or Gmail, and does not train on it. When the assistant shops for you, OpenAI also checks which products to show: it sees the words of the search, with the same details replaced, and the shops' public listings and brands. When you search the supermarket specials, OpenAI checks which specials are what you searched for: it sees the words of the search, with the same details replaced, and the supermarkets' public product names and the aisle each is shelved in. Every AI call is logged internally with token counts and the channel it came from, for cost and abuse monitoring. To find and fix problems, some internal logs and records of the assistant's decisions also keep part of what was sent, for a limited time, and only the team that runs KinLife can read them.

• Calendar OAuth tokens and Apple app-specific passwords are encrypted at rest. KinLife never sees your real iCloud or Google password.
• Passwords are hashed; plaintext is never stored.
• Password resets use a single-use token with an expiry.
• Sessions use encrypted cookies.
• Database credentials are server-only and never exposed to the browser.

• WhatsApp: only numbers you explicitly register and activate receive AI responses.
• Email: inbound mail from non-family senders is logged for visibility but never triggers an automatic reply.
• Webhooks: inbound webhooks (email, WhatsApp) are cryptographically verified before they're trusted.
• Wiki images: served through an authenticated proxy that checks you belong to the owning family; there are no public image links.

You can review every action in the Activity log, change or revoke calendar sharing at any time, and edit or remove what the assistant remembers in Settings → Memory. Deleting a note sends it to Trash first, so mistakes are recoverable.