Privacy Policy

Kin is a health coaching app. We collect what you tell us about your body, eating, movement, and mood so the AI coach can give you personal, useful advice. We don't sell your data, we don't share it with advertisers, and you can delete everything at any time from the You page.

• Account: email, password (hashed), and — if you sign in with Google — your Google ID, name, and avatar.
• Onboarding answers: name, gender identity (if shared), age, height, weight, target weight, goal, eating habits, activity level, lifestyle, motivation, and (optionally) menstrual cycle data.
• Logs you create: meals you type in, water amounts, movement minutes, weight check-ins, and mood ratings.
• Chat history: messages between you and Kin, plus a summary the AI keeps of patterns it notices (e.g. “sleep dipped this month”).
• Technical: IP address (used briefly for rate limiting, then discarded), session cookies (used to keep you signed in).

• We don't track you across other sites.
• We don't use third-party advertising trackers in the app.
• We don't require permissions we don't need (no camera, contacts, location).

• To run Kin's personalized plan, coaching, and progress views — that's the whole point.
• To send you a verification email when you sign up and a reset link if you forget your password.
• To send weekly progress summaries if you opt in (you can turn this off).
• To prevent abuse and brute-force attempts (rate limiting, account lockout on repeated failures).

Only you, and the systems we use to run the app:

• Neon (Postgres database): stores everything except the AI requests.
• OpenAI: receives your chat messages and the most relevant context (recent meals, current plan, cycle phase) when you talk to Kin. OpenAI's API policy is to not use API-submitted data to train models.
• Resend: delivers verification and password-reset emails.
• Vercel: hosts the web app.
• Google: only if you sign in with Google — they confirm your identity to us.

We never sell your data. We don't share it with advertisers. We will only disclose data if legally compelled (and we'll fight a subpoena that seems abusive).

As long as your account is active. When you delete your account, we permanently remove everything within 30 days. You can also export everything you've ever logged from the You → Export my data button.

• Access: use Export to download a JSON file of everything we have about you.
• Correct: edit your plan, goals, and profile from inside the app.
• Delete: tap Delete my account on the You page.
• Object / restrict / port: contact us at hello@kinhealth.id.

If you're in the EU, UK, or California, the rights above are guaranteed by GDPR/UK-GDPR/CCPA. We comply.

Passwords are hashed with bcrypt. Sessions are random opaque tokens stored in our database — not in the cookie. Data in transit uses TLS. Data at rest uses Neon's database encryption. We don't embed API keys in the app. We rate-limit auth endpoints and lock accounts after repeated failed sign-ins.

Kin is a supportive coaching app. It is not a doctor, dietitian, or therapist. The AI may be wrong, especially about specific medical conditions and medications. Always consult a qualified professional for medical concerns. If you're struggling with disordered eating or distress, please reach out to a professional or a support line.

Kin is intended for adults. Don't use it if you're under 16. If we learn we've collected data from a child, we'll delete it.

If we change anything important about how we handle data, we'll email you before it takes effect.

Questions? Email hello@kinhealth.id.