Privacy
We keep as little about you as we can, we never sell it, and there is no advertising here. Here is what we keep, why, and who else handles it.
What stays on your device
Your journal — every sealed page and every photo, recording, or video in one — is kept on your phone (and in your phone's own backups, if you make them), or in your browser on kindredly.io. So are the moments you keep from a correspondence, your drafts, your writing aura, and your courier's shape and the pronoun you gave her. None of that is uploaded to us unless you choose to send it: a journal page you let drift out goes to the desk as a letter you send yourself, and earlier versions of the app and the site let you drift a line or a page, anonymously, into a shared morning pool, where it stays, unsigned. Otherwise a sealed page reaches nothing of ours — not matching, not your fingerprint, not us; it feeds only the aura on your device, and only if you turn that on. Your answers to the /aura test stay in your browser until you keep the result and make an account: then the first is kept on your account as the first thing you wrote, all of them shape your first fingerprint, and the longest can go out as your first open letter. Your courier's name and look are different: they are kept on your account, so she is the same on every device. On kindredly.io your browser also keeps your sign-in, settings, and a copy of your recent correspondence and its translations, and one cookie, which tells our site the language you picked.
What we keep
An email address (from Apple, Google, or the one you type — Sign in with Apple may give us a relay address instead, which is fine; a guest's account has none), and any name or profile details Apple or Google pass on. What you tell us when your courier hatches: your pen name, your birth date, the face you chose, your pronoun if you give one, her name and look, and the first thing you wrote, kept as you wrote it even if you never sent it. What you send: letters, replies and room messages with their photos, voice recordings and song links, folded notes and reactions — and, if you trade names, the pen name and face you enclose, which stay on that correspondence. Notes, pictures and screenshots you send Wren; a bug report (and, on iPhone, a note that reads like one) also carries diagnostics — from iPhone, the app and system version, the device's name and a short log of slow screens; from the website, your browser's user-agent string (browser, version, system). Anything you send through Write to us, with the reply address you leave and your app and system version. Each letter and note to Wren is stamped with the language your app is set to. Which open letters you have opened, who you have blocked, and the reports you file, each with a copy of what you reported; and reports other people file about you, each with a copy of what they reported, and whether three of them have stopped your account from sending. A writing fingerprint: eight numbers describing measurable qualities of your writing — sentence length, pauses, rhythm, how often you ask or exclaim — kept with a word count. It is computed on your device from what you wrote as your courier hatched, and in the iPhone app again from your letters and the messages you send in correspondences; it contains no words and cannot be read back as text. Once a day we compare fingerprints and keep, for each writer, a list of up to 50 writers, ranked by how alike you write with two nudges: your birth date, so writers nearer your age rank a little higher, and your pronoun, so a she and a he rank a little higher for each other, two people who gave the same one a little lower, and they, or no answer, sits in between. Together the nudges add at most 0.09 to a writing closeness scored from 0 to 1 — enough to change the order among writers who write about equally like you, and who makes the list. That list decides which letters come first on your desk. Your birth date is also how we check you are 18. And the working parts: your device's notification token and app language; a record of each notification we queue for you, whether or not you allow notifications; for a letter that is out on iPhone, the lock-screen details we update, including your courier's name; product events from the iPhone app, such as a letter being sent, tied to your account ID; how many new letters you send each day; for a purchase, the plan, status, price and dates; and the standard server logs our hosting providers keep, which include IP addresses.
The AI, precisely
Text passes through Moonshot AI (Kimi) for two jobs only. A safety check before sending: on iPhone, the letters you write for the desk in the composer; on kindredly.io, the letters, replies and messages you type (not folded notes, photos or song links). And translation: on iPhone, when you tap to translate; on kindredly.io, a letter on your desk written in another language is translated as it appears, unless you turn off “Translate their letters for me” in Settings, and in a kindred's room one tap translates all of their messages. Our server sends Moonshot only the text — plus, for a translation, the language to put it in — never your name, email, account ID or IP address. Moonshot processes it in mainland China. Everything else Wren does — reading your writing, shaping your courier, noticing what two people share — is computed on your device with no model involved.
Who else touches it
Supabase holds the database, sign-in, and uploaded photos and voice letters; the apps send letters, messages, sign-ins and uploads to it directly. Cloudflare hosts kindredly.io and the part of our server the apps call for safety checks, translation, purchases, notifications and the guest desk; it tells our server which country a request comes from, which we use only to suggest a language and to keep checkout closed where it is not open yet, and do not store; and it counts visits to kindredly.io for us with Cloudflare Web Analytics, which sets no cookies and shows us totals, not individuals. Moonshot AI does the two jobs above. Apple runs Sign in with Apple and purchases in the iPhone app, and delivers notifications and lock-screen updates to iPhones; those lock-screen updates carry your courier's name. RevenueCat handles purchases in the iPhone app: the app gives it your account ID, and it keeps your App Store purchase status against it. Creem sells First Class on kindredly.io as merchant of record: it collects your email, name, billing address and card, and we give it your account ID so the purchase reaches your account; its notices to us include your email and name, which we discard, keeping only reference numbers, the plan, its status, the price and dates. Expo's push service delivers our notifications: it holds your device's push token and sees each notification's text — a line saying a letter came back, or the first line of a post from Wren or of our answer to a note you sent her. Google runs Google sign-in and serves the fonts every page of kindredly.io loads, so it sees your IP address and browser — also when the iPhone app opens these pages. When you put a Spotify or YouTube link in a room on iPhone, the app asks Spotify or YouTube for the song's title, so they see the link and your IP address. Email providers send your sign-in codes and hold what you write to hello@kindredly.io. We never see a card number, we sell nothing, and no advertising network or data broker gets anything from us.
What other members see
Your letters. The newest open letters are also shown, unsigned, to visitors on kindredly.io who have not made an account. And — only after five letters each way, and only if you both choose — the pen name and face you enclose. Never your email, your birth date, or your fingerprint.
What we never collect
No contacts. No location tracking: we read the country a request comes from and do not keep it, and the only other way a place can reach us is inside a photo you send from iPhone, if your camera saved where it was taken in the file. No advertising identifiers. No browsing history. No biometrics. No payment card details — Apple or Creem holds those.
How long
What we keep stays until you delete your account, which you can do in Settings at any time. Deleting removes, at once, your account — email, pen name, birth date, pronoun, courier and first line — with your fingerprint, your list of matches (other writers' lists drop you at the next daily match), your blocks, your notification tokens and records, your notes to Wren and our answers, your purchase records, any folded notes you wrote along with the other person's answers to them, and the reports other people filed about you, with any stop they put on your account. Some things stay, no longer tied to an account: letters you left on the desk stay in our database and are taken off every desk; each correspondence stays with the other person, your words in it unsigned — unless you traded names, in which case they keep the pen name and face you gave them (one closed by a block stays closed to both); photos, screenshots and voice letters you uploaded stay at their addresses; and so do messages sent through Write to us, with any reply address you left, reports you filed, product events, and any line or page you let drift out of your journal into the shared morning pool in an earlier version. Database backups can hold a copy until they expire. Deleting does not cancel a purchase, and Creem and RevenueCat keep their own records of one.
Your rights
Ask us for a copy of everything we hold. Correct your details in the app, or ask us to. Delete your account from Settings — How long, above, says what that removes and what stays. Withdraw photo, microphone or notification access in iOS Settings. If you are in the EEA or UK you may also complain to your data protection authority. Two automatic steps can limit what you can do, with no person deciding: the safety check can hold a letter back, and when three different people report your account, it can no longer send letters or messages. If you think either was wrong, write to us. Matching orders which letters you see, from your writing and, gently, your age and pronoun; it decides nothing else about you.
Where it lives
Your data may be stored and processed outside your country — by the companies above; in mainland China when Moonshot AI checks or translates text; and by Kindredly itself, which is run by a company in Beijing (see Contact) — for example, when we read and answer a note you send Wren or a letter you write to us. Where we move personal data out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses. Letters are encrypted in transit and at rest. The letter that opens a correspondence is an open letter, which anyone on the desk could read; after that, among members only the two people in it can read its replies and messages — enforced by the database itself, not by the app. Photos and voice letters work differently: each sits at an unlisted web address, and anyone who has that address can open it without signing in.
Contact
Beijing Lingxi Wuxian Technology Co., Ltd. · Rm 429, Block D, Bldg 3, No. 8 Courtyard, Fenggu 4th Rd, Badaling Development Zone, Yanqing District, Beijing · hello@kindredly.io