Kindred
We believe your relationships are private. Here is exactly what we collect, why, and what we never do.
Last updated: 2 July 202
Your contact data stays on your device. Names, numbers, and dates are stored locally and never uploaded to our servers.
We do not sell your data. We never have and we never will. There are no advertisers.
AI messages use minimal context. Only a few words about your contact reach our AI backend — no names or phone numbers.
You can delete everything. Settings → Delete All Data removes every piece of information from your device instantly.
Who we are
What data we collect and why
Legal basis for processing
Data stored on your device
Data sent to our backend
Third-party processors
International data transfers
How long we keep data
Your rights under UK GDPR
Children
Security
Changes to this policy
Contact us
Kindred is a personal relationship app developed and operated by [YOUR NAME / COMPANY NAME], based in the United Kingdom. We are the data controller for the personal data described in this policy.
We are registered with the Information Commissioner's Office (ICO) under registration number [YOUR ICO REGISTRATION NUMBER]. UK law requires most organisations that process personal data to register with the ICO.
You can contact us at any time:
Email: privacy@kindredapp.co.uk
Post: [YOUR ADDRESS]
Note for users: This policy covers your use of the Kindred Android app. If you use Google Play's subscription billing, Google's own privacy policy also applies to that payment process.
We collect the minimum information necessary to provide the app's features. The table below explains each category.
Data
Where it lives
Why we need it
Optional?
Contact names
Your device only
To display in reminders and the dashboard
No (required to add a contact)
Phone numbers
Your device only
To pre-fill WhatsApp and SMS share intents
Yes
Dates (birthdays, anniversaries)
Your device only
To schedule reminder notifications
Yes
Relationship notes
Your device only
Gift ideas, preferences — personalises AI messages if enabled
Yes
Interaction log
Your device only
To calculate relationship health scores
Yes (you choose when to log)
Your display name
Your device only
To sign off AI-generated messages (e.g. "Love, Sarah")
Yes
AI message context (Plus users)
Sent to our backend transiently; not stored
To generate a personalised message — see Section 5
Yes (only when you tap "Compose with AI")
App crash data
Sent to Google (Firebase Crashlytics)
To identify and fix bugs
No (enabled by default; can be disabled in Settings)
Device identifier (anonymous)
Sent to Google (Firebase Auth) for backend authentication
To authenticate AI message requests and enforce rate limits
No (required for Plus features)
We do not access your call log or SMS message history
We do not read your WhatsApp or SMS messages
We do not track your location
We do not collect your email address (unless you contact us directly)
We do not collect analytics about how you use the app
We do not use advertising tracking technologies
We do not create profiles for advertising purposes
Under UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:
Processing your display name and authentication tokens is necessary to provide the Kindred Plus subscription service you have purchased. Without this processing, we cannot deliver the AI message composition feature.
We process anonymised crash reports via Firebase Crashlytics to identify software bugs and maintain a stable, safe app. We have carried out a legitimate interests assessment and concluded that this processing does not override your privacy interests, because:
Crash reports contain no contact names, phone numbers, or relationship data
The data is anonymised and aggregated by Google before we see it
You can disable crash reporting in Settings at any time
All personal data you enter into the app — contact names, dates, phone numbers, notes — is provided voluntarily. You choose what to add. You can delete it at any time. No consent is required for local device storage under UK GDPR because this data never leaves your device without your action.
UK GDPR applies to the extent we are the controller of that data. Because all contact data is stored exclusively on your device and is never transmitted to us, we act as a data processor only when you choose to use features that involve our backend (AI message composition). You remain in full control of everything stored locally.
The core of Kindred stores everything locally using Android's SQLite database (via Room) and secure shared preferences (DataStore). This includes:
All contacts you add: name, phone number, relationship type, tier, photo
All events: dates, labels, message templates, reminder settings
All interaction logs: channel, timestamp, notes
Your display name and app preferences
This data never leaves your device unless you explicitly choose to export it (Settings → Export Data) or unless you use a feature that requires our backend (AI message composition — see Section 5).
Kindred uses Android's Auto Backup feature, which means Google may automatically back up your app data to your personal Google Drive account as part of Android's standard device backup. This backup is encrypted by Google and accessible only with your Google account credentials. It is governed by Google's Privacy Policy, not ours. You can disable Auto Backup in your Android system settings.
If you use the "Import contacts" feature (Settings → Import contacts), Kindred reads names, phone numbers, and birthdays from your device's address book. This data is read once, imported into Kindred's local database on your device, and is not sent to us. We do not maintain an ongoing connection to your contacts app.
The following information leaves your device and is processed by our backend infrastructure. We have designed this to be as minimal as possible.
When you tap "Compose with AI," the app sends a message generation request to our backend. This request contains:
The relationship type (e.g. "FAMILY" or "FRIEND") — not a name
The event type (e.g. "BIRTHDAY") — not the date
The age the contact is turning, if you have entered a birth year
The tone you have selected (warm / casual / formal / funny)
Your display name, if you have set one (used only for the sign-off)
Notes about the contact, if you have entered any (optional)
Critically, we never send the contact's real name or phone number to our backend. Our backend passes this context to the Anthropic Claude API to generate a message, then returns the message to your device. Neither we nor Anthropic retain this request beyond the time needed to generate the response (see Section 6 for Anthropic's data practices).
AI message composition is rate-limited to 20 requests per user per day. Your request count is tracked by an anonymous identifier (Firebase Auth UID) — not by your name or email.
When you use AI message composition, the app authenticates with our backend using Firebase Authentication. This creates an anonymous account linked to a device identifier. We receive this identifier but not your name, email, or any personally identifying information unless you explicitly provide it.
We use the following third-party services that may process some of your data on our behalf. We have data processing agreements (or equivalent contractual terms) in place with each of them.
Google — Firebase Authentication
What it processes: Anonymous device identifier used to authenticate AI compose requests. No name, email, or contact data.
Where: United States (Google infrastructure). Google participates in the UK International Data Transfer Agreement framework.
Purpose: To authenticate requests to our AI backend and enforce rate limits.
Google — Firebase Crashlytics
What it processes: Anonymised crash reports including app version, Android version, device model, and stack traces. No contact names, phone numbers, or personal relationship data.
Where: United States (Google infrastructure).
Purpose: To identify software bugs and maintain app stability.
Your control: You can disable crash reporting at any time in Settings → About → Crash reporting.
Anthropic PBC — Claude API
What it processes: The anonymised message generation context described in Section 5 (relationship type, event type, tone, optional display name and notes). Not contact names or phone numbers.
Where: United States. Anthropic provides a Data Processing Agreement with Standard Contractual Clauses (SCCs) covering transfers under UK GDPR.
Retention: Anthropic deletes API inputs and outputs within 30 days. Anthropic does not use API data to train its models.
Purpose: To generate personalised message text returned to your device.
Cloudflare — Backend infrastructure
What it processes: Request metadata (IP address, timestamps) for our API backend. No contact or personal relationship data.
Where: Distributed globally; EU/UK routing where possible.
Purpose: To host and protect our AI compose API endpoint.
Google — Google Play Billing
What it processes: Subscription status and purchase tokens. Payment details are handled entirely by Google and are never seen by us.
Where: United States (Google infrastructure).
Purpose: To manage Kindred Plus subscriptions.
Google Payments Privacy Notice ↗
We do not use any advertising networks, analytics platforms, social media SDKs, or tracking pixels. The processors listed above are the only third parties that receive any data in connection with your use of Kindred.
Some of the third-party processors listed in Section 6 are based in the United States. Under UK GDPR, transferring personal data to a country outside the UK requires an appropriate safeguard.
For all transfers to US-based processors (Google, Anthropic, Cloudflare), we rely on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) as the lawful transfer mechanism. These contractual safeguards require our US processors to protect your data to UK GDPR standards.
The data transferred internationally is limited to:
Anonymous device identifiers (Firebase Auth)
Anonymised crash reports (Crashlytics)
Anonymised message generation context (Anthropic — Kindred Plus only)
Subscription status (Google Play)
Your personal contact data — names, phone numbers, dates, notes, interaction logs — is never transferred internationally because it never leaves your device.
Data
Retention period
How to delete
Contact data, events, interaction logs (on-device)
Until you delete the contact or delete all data
Delete contact individually, or Settings → Delete All Data
App preferences and settings (on-device)
Until you uninstall the app or delete all data
Uninstall app, or Settings → Delete All Data
AI message generation requests (Anthropic)
Deleted by Anthropic within 30 days
Not applicable (we do not store this ourselves)
Authentication token (Firebase Auth)
Until you uninstall the app
Uninstall app
Crash reports (Firebase Crashlytics)
90 days (Google's retention period)
Disable crash reporting in Settings
Emails you send us (e.g. support queries)
2 years from last contact
Email us at privacy@kindredapp.co.uk to request deletion
The UK General Data Protection Regulation gives you the following rights. Because most of your data is stored on your device, many of these are exercised directly in the app — no need to contact us.
Right of access
You can view all your data at any time in the app. To export a full copy, go to Settings → Export Data.
Right to rectification
Edit any contact, event, or note directly in the app at any time.
Right to erasure
Delete individual contacts or all data in Settings → Delete All Data. This is immediate and irreversible.
Right to data portability
Export all your data as a JSON file via Settings → Export Data. The file can be read by any standard text editor.
Right to restrict processing
Disable crash reporting in Settings. Stop AI message generation by not using the Compose with AI feature.
Right to object
You can object to our use of legitimate interests (crash reporting) by disabling it in Settings at any time.
Rights related to automated decisions
Kindred does not make automated decisions that have legal or similarly significant effects on you.
Right to lodge a complaint
You have the right to complain to the ICO if you believe we have handled your data unlawfully.
To exercise any right that cannot be fulfilled in-app (for example, a complaint about our processing or a request relating to data held in our email correspondence), contact us at privacy@kindredapp.co.uk. We will respond within one calendar month as required by UK GDPR.
If you are unhappy with how we have handled your personal data, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data protection regulator:
Website: ico.org.uk
Phone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would always appreciate the opportunity to address your concern directly before you contact the ICO.
Kindred is not directed at children under the age of 13 and we do not knowingly collect personal data from children. The app is rated for users aged 18 and over on Google Play.
If you believe a child under 13 has provided us with personal data, please contact us at privacy@kindredapp.co.uk and we will take steps to delete that information.
We take the security of your data seriously. Our technical and organisational measures include:
On-device encryption: Android encrypts the device storage where Kindred's database is held, provided you have a device PIN or passcode set (which we recommend).
Encryption in transit: All communication between the app and our backend uses HTTPS with TLS 1.3. No data is ever transmitted over unencrypted connections.
Minimal data transfer: We have designed the app so that personal contact data never leaves your device, eliminating the risk of a server-side breach exposing your relationship information.
Authentication: Our AI backend requires a valid Firebase Auth token for every request, preventing unauthorised access.
Rate limiting: AI message requests are limited to 20 per user per day to prevent abuse.
No shared passwords: We do not hold any password associated with your use of Kindred. There is no Kindred account to compromise.
No system is completely secure. In the unlikely event of a data breach involving personal data we process, we will notify affected users and the ICO as required by UK GDPR (within 72 hours of becoming aware, where required).
We may update this privacy policy from time to time. When we make material changes — changes that affect what data we collect, how we use it, or who we share it with — we will:
Update the "Last updated" date at the top of this page
Show an in-app notification the next time you open Kindred
Where required by law, ask for your renewed consent
We encourage you to review this page periodically. Continued use of the app after changes are posted constitutes your acknowledgement of the updated policy, to the extent permitted by law.
Previous versions of this policy are available on request by emailing privacy@kindredapp.co.uk.
For any privacy-related questions, data subject rights requests, or concerns, please reach us using the details below. We aim to respond to all privacy queries within 5 working days and will always respond within the statutory one-month period.
We read every message personally and take privacy concerns seriously.
privacy@kindredapp.co.uk
[YOUR NAME / COMPANY NAME]
[YOUR ADDRESS]
United Kingdom
© 2026 Kindred · Privacy Policy · Terms of Use · Contact
Kindred is registered with the ICO under number [ICO NUMBER]. Data controller: [YOUR NAME / COMPANY], United Kingdom.