Privacy policy

Who this covers

Kinby is operated by Kinby, LLC, a Delaware limited liability company ("Kinby", "I", "me"). This policy covers the Kinby web application and the texts I send you.

Kinby is in a closed alpha: invite only, small, free, and changing every week. This policy will change with it, and the date at the top says when it last did.

Kinby is built for parents. It is not directed to children and children do not get accounts. Parents do put information about their children into it, and I read more about them out of school mail, so there is a section on children's information below.

What I collect

What you hand me

• The invite code you were given.
• Your mobile number, and the codes I text to prove it is yours. An account begins with one, and signing in is a code texted to it, so this is every account's minimum.
• Your Google account, once you connect a mailbox: the email address on it, and the name and profile picture Google publishes.
• If you join the wait list, your mobile number, the code I text to prove it, and the language the page was in, so the code I text you later is in it too.
• What you correct and add: names, ages, schools, relationships, the notes you type on a person's page, and whether you struck somebody off a card.
• Your home address, if you text it to me, so I can find the shop or office closest to you and give it to a site that asks for it when I book there.
• Your answers about what I may do on my own.
• The photos and files you text me (a form, a flyer, a picture of a schedule), and what I write down about each, so I can find it again.
• A sign-in for a school portal or team app, if you connect one. You type it on the portal's own page, in a window on mine; what happens to it is under School portals and team apps below, and the short answer is that I never hold it and it never passes through Kinby.

What your browser tells me

• Your time zone, read off the browser on the first signed-in page and kept current after a move or a trip, so that dates land on the right day.
• The language you read, taken off the same browser once, so that I write to you in a language you speak. After that it only changes if you change it.
• Ordinary server records: IP address, browser, and the times of requests, kept for security and for working out why something broke.

What I read from Google, once you connect a mailbox

Signing in to Kinby never goes through Google: it is a code texted to your phone. Connecting a mailbox and letting me email a school are separate trips to Google, on purpose, and each asks for different things.

• Connecting a mailbox asks who you are (openid, your email address, and your basic profile), which is where your name, your address and your picture come from, and for Gmail, read only (gmail.readonly), and Google Calendar: calendar.readonly to read it, and calendar.events to add the events I book for you or you ask me to add, and to change or remove an event when you ask me to, and nothing else of your calendars. It asks on a screen that explains what for, after the one that made your account. You can grant some and refuse the rest, and Kinby still works on what it was given.
• Letting me send an email for you asks for one more thing, gmail.send, and only the first time you ask me to send one: an absence for your kid's school, a note to a coach, a reply to a teacher. I ask for it on a page of its own that shows you the email first. With it I send that email, and the emails you ask me to send after it, from your address and in your name, and nothing else. I show you what I wrote before it goes, unless your text already said exactly what to send, and I send it only on your yes. Connecting a mailbox never asks for it, and you can take it back in your Google account.

From a connected Gmail account I read whole messages: the sender, the recipients, the subject, the date, and the body. I have to. A teacher's name, a grade, a signup deadline and a season's schedule are all in the body of a message and none of them are in a subject line. A narrower promise would be easy to keep and would make the product not work.

Each night, and again each morning, I read the last thirty days of your mail, and keep it on the clock below. Each morning I look over what came in since the morning before for anything about your children's week that can't wait for Sunday evening, or news about something your family is in the middle of (a tryout's result, an answer you were waiting for, an offer to accept), and tell you only when there is. To do that I keep a short note of what your family is in the middle of, each line with the day it should be settled by, rewritten each morning and dropped once that day passes.

When you ask me something those thirty days don't answer (whether a registration from the spring went through, when an appointment booked months ago falls), I search every mailbox connected to your household, back through every year, the way Gmail's own search box does, and read the few messages that match. That includes the other parent's mailbox, as the household section below explains. I use them for the answer you asked for and keep none of them: they are gone from Kinby once my answer is written, or once I give up on writing it, and what stays is the answer I texted you.

I search that way on my own once for each child, at night: for their doctor's visits, because a checkup comes once a year and thirty days of mail never holds the last one. From what that search reads I keep only what I learn about their visits (when, where, and what for, as the mail says it), in that child's memory, which you can read and edit on their page; never the messages. When a night can't finish that search (a mailbox out of reach, say), I try again on a later night, three nights at most, and after that I search again for a child only through a mailbox connected since.

I search that way once for everyone in the household, parents included, at night: for their birthday, because the registration or the form that printed a date of birth is usually older than thirty days. From what that search reads I keep only their birthday, on their page, and what I learn about their birthdays (the day, how it was celebrated, what they asked for), in their memory; never the messages, and nothing else from a legal, financial or medical message that printed a date of birth. The same three nights at most, the same way. And three weeks before each birthday I search again: for whether anyone is already planning it, so I remind you only when nothing shows, and, for a child, for what they were given around the last one, so I don't suggest the same thing twice. A parent's own birthday I tell only the other parent about, and only when there is one to tell. What that search reads goes only into what I tell you, and is kept nowhere.

I search that way once for each child, at night: for the sports they play, because last season's registration is up to a year old and thirty days of mail never holds it. From what that search reads I keep only what I learn about their sports (the club or league, their team, the seasons and the day they registered for each, the fee, where they register, and a sport they stopped), in that child's memory, which you can read and edit on their page, and each site they register on, in your vault, where nothing is signed in until you do it; never the messages. The same three nights at most, the same way. And in the six weeks before each registration comes round, once a week, I search again, and look the club's own public page up on the web by its name and town alone, never with anything about your family: for when the club opens and closes it, whether your child is registered already, and where to register, so I tell you when it opens. I keep only those days, whether they're registered, and the page; what the search reads I keep nowhere.

I also search that way through each mailbox, at night, for your children's grandparents, aunts and uncles: your parents and your siblings, and their husbands, wives and partners. I search again a month later, and each month after, because a family changes and one search can miss someone. I keep each of them as a person in your household, with their name, the address they write from, what they are to your children, whose family they are, and a note on how they're related; never the messages. Once you've shown you care about their birthdays (you've asked me about one, told me one, or answered me about one), I ask you whether I got them right; until then I ask you nothing about them, and I remind you of nobody's birthday until you say I did. Anyone you tell me isn't family I strike off and never look for again. I look back for their birthdays the way I do for everyone in the household, and keep only what I learn, the same way. A few weeks before each of their birthdays I search again: for how your family usually marks it (a present you sent last year, say), whether it's already planned, and what they might like. I keep how your family marks it; what I'll tell you I keep only until I've told you or the day has passed. I never write to them or tell them anything.

From a connected Google Calendar I keep each event's title, the day it falls on, and who is invited. Not where it is, which I never ask Google for. That is a wider window than the mail, a year back and three months ahead, because a season that started last autumn is what says a child plays a sport, and I read that whole window again every day while the connection stays live, so a change you make is caught within a day. If a connection lapses (a grant Google itself expired, say), I stop refreshing it, so a change on the real calendar stops being caught; what I already kept still ages out on the same year-back schedule as ever, and reconnecting or disconnecting is what starts or stops it for good. When you delete an event, its title and who was invited are gone from here within a day; what is left is the day it fell on, as a marker, until that day is far enough behind that it falls out of the window I read, at which point that goes too. Disconnecting a mailbox deletes every calendar event I kept from it, immediately, the same as it does your mail.

The calendars you've added to yours (your child's club's season, the school district's dates, a holiday calendar, a calendar of your own or one someone shares with you), other than another person's main calendar and Google's calendar of your contacts' birthdays, I read only when I need them: to answer something you ask me, to look over your coming week on Sunday evening, to tell what's routine from what's new each morning, and to check a time before I propose a booking. From them I read each event's title, when it starts and ends, and the calendar's name; never where it is or its details. I keep no copy of them: what stays is what I tell you.

When you ask me to put something on your calendar, or to change something on it, I first look at what is on it around that time, as it is right then: each event's title, its time, who sent it and who is invited. That is how I find the event you mean, and see whether what you asked for is there already. When I add to an event's notes, I read them only to add yours after them, and send them straight back to Google. When you ask me to remove an event, I take it off your calendar, and Google tells whoever was invited; I remove an event only when you ask, and never an invitation someone else sent you.

Some school mail is a sentence and a link, of the "use this link to read this week's newsletter" kind. Where a message is shaped like that I follow the link and keep the page behind it, because the message on its own says nothing. What I keep of that page is its words and its links, and it expires on the same clock as the message that pointed at it.

Some mail points into a site you've signed me in to: "You have unread content in Rooms", with a button. Each night, and again each morning, I open the page that button leads to, signed in as you, in the same browser I sign in to that site with, and keep the words on it with the message that pointed there, on the same clock as that message. I read only the page the link opens and press nothing on it, and I never open a link that would do something for you (reply, RSVP, confirm, sign up, pay, or unsubscribe). Many of these links go through the sender's click tracking first, so to see where one leads I may ask the tracker once, and the sender can count that as a click.

What I work out

From the above I build the household's picture: who lives here and who your children's grandparents, aunts and uncles are, their ages and birthdays, their schools and grades and teachers, their doctors, their teams and activities, what is coming up, and what needs doing. Each of those is stored alongside a pointer at the message it came out of, so that any claim I make about your family can show you why I made it.

I also store a mathematical representation of your mail (an "embedding"), which is what lets me search it by meaning rather than by keyword. It is derived from the words, so it is deleted whenever the words are.

I store the same kind of representation of our texts, yours and mine, so I can find what we talked about before when it comes up again and pick it up where we left it. It is derived from the words of each text, and goes whenever the text does.

What I use it for

• Building and keeping current the household's picture of your family.
• Finding the things that need doing and telling both parents about them.
• Answering what you ask me, and doing what you have told me I may do.
• Telling your kid's school they will be out, when you ask me to: on the school's portal, or by an email from your Gmail.
• Reading the photos and files you text me, writing down what matters in each, and keeping them so I can find them again when you or the other parent asks.
• Proving a phone number is yours, and sending you the texts you asked for.
• Keeping the service running, secure, and honest: rate limits, abuse prevention, debugging.
• Working out where I am getting things wrong, so that I get fewer of them wrong. Access to real data for that purpose is limited to the people who need it.

I do not sell personal information. I do not use your mail or your files to train models, mine or anybody else's, and the providers who process them for me are contractually barred from training on them.

Google Limited Use. Kinby's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What the other parent in your household can see

This is the section that is different from every other app you have connected to your mail, so it is set out in full rather than summarized.

Kinby is one agent for a household, with one memory, and that is the whole point of it. It is not one agent per parent that happens to be able to talk to another. Each adult in a household connects their own mailboxes and calendars, because in practice sports lives in one parent's inbox and medical in the other's, and everything I learn from any of them goes into a single shared picture of the family.

What that means concretely:

• Anything I learn from your mail is visible to every adult in your household. If I read in your inbox that Oliver's teacher is Ms. Reyes, or that a field trip form is due Friday, that appears on Oliver's page and on the household's home page, and the other parent sees it there. They do not have to have received the message. That is the feature: one parent should not have to tell the other what the school said.
• I show where a fact came from, and that pointer is shared too. Beside a fact or a thing that needs doing I name the message I read it in: who sent it and on what day. So the other parent can see that a message from the school office on 3 September is why I think the form is due. The link that opens the message opens it in Gmail, which means only the person who owns that mailbox can actually read it. The other parent sees the citation, not the message.
• Short excerpts can surface. Where I explain what I found, I may quote the sentence I read it in, and that quotation is on a shared page.
• Nobody can browse your mailbox through me. There is no screen in Kinby that lists, searches, or opens another parent's messages. What crosses between you is what I extracted about the family and the citation for it, and my answer when the other parent asks me something your mail answers: I search every mailbox in the household for it, and may say what the message said and who sent it.
• A photo or a file you text me is the household's too. I can tell the other parent what it says when they ask. Unlike a message in your mailbox, the file itself lives in Kinby, not only what I wrote down about it, so it is the other parent's to see as much as yours.
• I aim only at the family's logistics, and I am not perfect at it. I am looking for school, sports, medical and scheduling, and I am an AI system reading a real mailbox: I can misjudge what is relevant, and something you would not have chosen to share can end up in a shared record because I read it as being about your child.

So: connect the mailbox the school writes to. If a mailbox has things in it you would not want a co-parent to know I had read, do not hand me that mailbox. You can connect more than one account and you can disconnect any of them at any time.

Disconnecting a mailbox in Settings deletes every message and every calendar event I stored from it. It does not automatically retract facts already written into the household's pages, because the other parent may have acted on them. Those you can edit or delete yourself on the person's page.

One more thing worth saying plainly: anybody holding your household's invite code can join your household and see everything in it. Treat that code the way you would treat a key.

Children's information

Kinby is a record of a family, so it holds information about children: names, ages, birthdays, schools, grades, teachers, doctors, teams, activities, and what is coming up for each of them. It also holds a child's sex, the way a form asks for it (a boys' or a girls' team, a patient's sex at a check-in): I read it from the family's own mail, a team or a teacher writing "he" or "she", never from a name, or you tell me. I use it to answer a form that asks for it, and it is part of what I know about them when I answer your texts. It shows on the child's page, and you correct it by texting me. Some of it you type in, most of it I read out of school mail, and some comes from the photos and files you text me, which can include a child's health information: a sports physical, an immunization record, an insurance card. Those I keep as you sent them, for your household alone, until you ask me to forget them.

Children are not Kinby users. There are no accounts for anybody under 18, I do not knowingly collect information directly from a child, and there is no advertising in Kinby of any kind. As a parent you decide what is kept: every person in the household has a page you can edit and correct, and anybody I got wrong you can strike off.

Striking somebody off hides them, and is not the same as erasing them. It has to be: the other parent's mailbox gets read too, and if the record went entirely, the next run would find the same person in the same school newsletter and put them straight back. So the row survives, marked as struck off, and nothing draws them again. If you want a person erased rather than hidden, write to privacy@kinby.ai and I will do it by hand.

If you believe I hold information about a child that should not be here, write to privacy@kinby.ai and I will delete it.

School portals and team apps

Some of what a family needs done can only be done by signing into a school portal or a booking site, because almost none of them have an interface for anything else. If you connect one, you sign into it on Kinby's page: the site's own sign-in runs in an isolated cloud browser, operated by the browser provider listed below, and Kinby shows you what it asks for. When a site needs its own page, a sign-in with Google say, that browser is shown to you directly.

I never keep that password. What you type to sign in goes, in that one request, to your vault, which the browser provider keeps encrypted at rest under a key Kinby's servers never hold, so that the browser can be signed back in when the site's session lapses. It is never written down here: not to a column, not to a log, not to disk, and nothing can read it back, to me or to anybody. What Kinby's own database keeps is the identifier of the connection and the name the sign-in is filed under, which is enough to delete it with and worth nothing to anybody who steals the database. When a site emails you a sign-in code, I look for that email in your connected Gmail and enter the code for you; the code is never stored, and never shown to a language model.

When I sign in, I am acting as you, in an isolated cloud browser, and what I do there is bound by that site's own terms. If a site asks you to agree to updated terms before it lets you in, I ask you first and agree only on your yes, and keep a record of who said yes, when, and to which documents, on that site's page in the vault. Nothing you type to sign in is ever shown to a language model. You can disconnect a portal at any time from the vault, which deletes the connection and the stored sign-in.

When a site wants paying for something you asked me to do (a season's registration, say, or an appointment that takes a card when it's booked), I pay from the Link wallet you connect in the vault, with a single-use card Link makes for that one purchase, for its amount and that site alone, and Link may ask you to approve it in its own way. The card's number goes from your vault straight into the site's checkout. It is never shown to me or to a language model, and never written down here. I pay up to $500 without asking you first, and hold a registration's other ways of paying (a check, an invoice, a payment plan, a deposit) to the same figure. Past it I stop and ask you about the exact total, and your yes approves that total for that one purchase. If you tell me larger amounts are fine, I keep what you said in your household's memory, and from then on that is what I pay without asking, until you tell me otherwise. Only what a parent said counts; nothing I read in your mail raises it. A waiver, a release, a club's code of conduct or any other terms a registration asks you to agree to, I agree to only on your yes, and an optional extra like a donation or insurance I leave out unless you asked for it.

Who else touches your data

Kinby runs on other people's infrastructure, and these are all of them. Each is bound by a contract that limits what they may do with what they see. None of them are permitted to train models on your mail, and none of them are sold anything.

Who	What for
Google	The mailbox you connect, read only, and the calendar you connect, read, and added to, changed or removed from only as you ask.
OpenAI	Reads the mail Kinby has stored, to work out what it says and to make it searchable, the messages a search of your whole mailbox finds, to answer what you asked or to find a child's doctor's visits, and the photos and files you text Kinby, to answer you.
Kernel	Runs the cloud browsers Kinby signs into school portals with, and holds those passwords, and the connection to your Link wallet, encrypted.
Stripe	Link, the wallet you connect in the vault, which makes a card for each purchase Kinby pays for you, for that amount and that site alone, and may ask you to approve it.
Twilio	Delivers the texts Kinby sends you, and the texts, photos and files you send Kinby, whose copy of each file Kinby deletes once the file reaches it.
Render	Hosts the application and the database.

Beyond those, I will disclose data if the law requires it, and I will tell you when I am allowed to. If Kinby is ever acquired, your data goes with it and you will be told before it does.

How long I keep things

• Message bodies: 90 days from the day the message was delivered, deleted nightly. The record of who wrote and when survives that, because it is still useful long after the words are.
• The searchable pieces of a message go in the same breath as its body. An embedding is a lossy copy of the words, and a promise to drop the words is a promise to drop it.
• A message I read searching every mailbox in the household: not kept at all. It is gone once the answer it was read for is written, or once I give up on writing it; or, looking back for a child's doctor's visits or their sports, for someone's birthday, or for your children's grandparents, aunts and uncles, once that night's reading is done, with only what I learned kept in their memory and on their page.
• Calendar events: the same year back and three months ahead they are read over, refreshed every day the connection is live, so an event you change or delete is caught within a day rather than left stale. A lapsed connection stops being refreshed, but what is kept still ages out on that same schedule; reconnecting starts the daily refresh again, and disconnecting deletes it outright.
• Disconnecting a mailbox deletes every message and every calendar event stored from it, immediately, along with those pieces.
• Deleting your account is a request rather than a button today: write to privacy@kinby.ai and I will do it. It takes your login, your sessions, your Google tokens, your phone number, your picture, and every message and calendar event read from your mailboxes, with their searchable pieces. If another parent is still using the household, the household's shared record of the family survives without you, since it is theirs as much as yours, and so do the photos and files texted to me; when the household itself is deleted, they go with it.
• A photo or a file you text me: kept until you ask me to forget it or the household is deleted, with what I wrote down about it. Once a file reaches me, I delete the copy Twilio holds, whether or not I could keep it, so it lives in one place at most. I keep only the kinds I can read; anything else is named in our thread and not kept.
• A screenshot of something I did on one of your sites: the site's own page, as it showed what I'd done, which can include whatever else that page shows about your family there. Kept with your files until you ask me to forget it or the household is deleted. It goes to you by text, through Twilio, whose copy I delete once the text has gone.
• An absence you asked me to report: which child, which day, the reason you gave, and where it went, kept with the household's record like a booking.
• What you let me pay without asking: what you told me about larger amounts, kept in your household's memory until you tell me otherwise, and a total you said yes to, kept on that booking or registration. The card is never here; your wallet is Link's.
• A child you asked me to register for a season: which child, what for, the program and the fee the club showed, and its confirmation number, kept with the household's record like a booking. What you told the club's form through me (a shirt size, say) goes to the club and is kept in that registration's record of what you answered.
• An email you asked me to send: who it goes to, its subject and its words, from the moment you ask, so I can show it to you and send it once you say so. Kept 90 days, like your mail's words, then deleted. Once sent, it is in your own Sent folder too.
• Google access and refresh tokens are encrypted in the database. They are never looked up by their value, only by which parent and which address they belong to.
• Server logs are kept for a short period for security and debugging.

Kinby's servers and database are in the United States. If you are outside it, using Kinby means your information is processed there.

What you can ask me to do

You can ask for a copy of what I hold about you, ask me to correct it, ask me to delete it, ask for it in a portable form, and object to how I am using it. Much of that is in the app already: edit any person's page, delete a note, disconnect a mailbox, remove a portal. For the rest, write to privacy@kinby.ai and I will answer within 30 days.

If you are in the EU or the UK, those rights are the ones the GDPR gives you, and my lawful bases are your consent (for reading a mailbox) and the performance of a contract with you (for running the service). Consent can be withdrawn at any time by disconnecting. If you are in California, you have the rights the CCPA and CPRA give you: I do not sell personal information, I do not share it for cross-context behavioral advertising, and there are no financial incentive programs, so there is nothing to opt out of. Exercising any of these will never get you worse service.

You can also revoke my access from Google directly, at your Google account's permissions page. That stops me reading anything new immediately. Use Settings and Disconnect as well if you want what I already read deleted.

Security

Traffic is encrypted in transit and data is encrypted at rest. Tokens and credentials are encrypted again at the column, separately from the rest of the database. Access to production data is limited to the people who need it to run the service.

None of that makes any system perfect, and this one is an alpha. If there is ever a breach that affects you, I will tell you, promptly and in plain words.

Texts

I text the number you sign up with: first a code to prove the number is yours, and later what I have done and what is coming up. Each time you sign in I text it a code again. You can text me back, photos and files included; what I do with those is above. Message and data rates may apply, and how often I write depends on what is happening in your family's week. Reply STOP to any message to stop them and HELP for help. Stopping the texts does not close your account.

Cookies

Kinby sets the cookies it needs to keep you signed in and to keep forms safe from forgery, and no others. There is no advertising, no analytics that follow you off the site, and no third-party trackers.

Changes

When this policy changes, the date at the top changes with it. If a change materially affects what I do with your data, I will tell you in the app or by email before it takes effect, rather than leaving you to notice.

Language

Kinby's screens are written in six languages. This policy is written only in English, and the English version is the one that governs.

Getting hold of me

Privacy questions, requests, and anything in this document: privacy@kinby.ai.

Kinby, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA.