Kin AgendaPrivacy Policy
Short version: Kin Agenda holds data about more than one person: you, your co-parent, and your child. We collect only what the app needs to run, we never sell your data, and you can export or delete your own account data at any time. Read section 3 before you use the app. It explains what “your data” means here, which is not quite what you’d expect.
1. Who we are
Kin Agenda is operated by Akvilė Strumylaitė, an individual based in Lithuania, EU, who acts as the data controller for the personal data described in this policy. Kin Agenda is not currently operated through a registered company.
For everything in this policy, we are the data controller: we decide what personal data is collected and why.
Contact for privacy matters: info@kinagenda.com
We have not appointed a Data Protection Officer.
2. What this policy covers
This policy covers the Kin Agenda web application and mobile app, and the servers behind them. It applies to everyone whose personal data we process: not only registered users, but also children, the other parent, and other people whose details a user enters into the app.
We serve users in the European Economic Area, and this policy is written under the EU General Data Protection Regulation (GDPR).
3. Please read this first: Kin Agenda holds data about more than one person
Most apps hold your data. Kin Agenda is different, and you should understand this before you use it.
Kin Agenda is built for two parents who are raising a child separately. That means almost everything in the app concerns at least three people: you, your co-parent, and your child. When you write a message, it becomes your co-parent’s record too. When you log a handoff, it records where both of you were. When you add a medical note, that is your child’s health information, not yours.
Some of it concerns people who never signed up at all: the parent of your child’s friend whose phone number you saved, or the person whose bank account number appears on a shared expense.
Three consequences follow, and we want to state them plainly rather than bury them:
Your co-parent can see the shared parts of your account. Messages, calendar entries, handoffs, expenses and your child’s records are shared by design. This is the point of the app. The one exception is your own “Only me” folder in the document vault (section 4.16).
Deleting your account does not erase the shared history. Your co-parent keeps their copy of your shared records, in the same way that deleting your email account does not delete the emails you sent to other people. Section 11 explains exactly what is deleted and what remains.
You are responsible for what you enter about other people. When you add a third party’s phone number or bank details, you are the one who decided to do that. We process that data on your behalf, but you should only add details you have a good reason to hold.
4. What data we collect
4.1 Account and profile data
Your name, email address, password (stored only as a cryptographic hash, never in readable form), your subscription plan, your notification and display preferences, and the date you signed up and the times you signed in.
4.2 Your child’s data
The child’s name, date of birth, and any details you choose to add: school, activities, clothing sizes (and the day they were last changed), allergies, notes, nationalities, and their passports and ID cards (section 4.15).
4.3 Your child’s health data (special category)
The medical card can hold your child’s diagnoses, medications, allergies, treating physician, insurance details, and a do-not-resuscitate (DNR) indicator.
This is health data. Under GDPR it is a “special category” of personal data with stronger protection. Nothing in the app requires the medical card: you choose whether to fill it in, and we process what you enter there only because you entered it, so that it is at hand for the people you share your child’s profile with. You can empty any field at any time, and the card is removed when the child’s profile is removed. Emptying a field does not affect processing that already happened.
The DNR field in particular records a medical directive about your child. We treat it as the most sensitive field in the application. It is never sent to any third party, never included in AI processing, and never appears in notifications or emails.
4.4 Messages between co-parents
The content of messages you send, who sent them, when, and whether they have been read.
Messages are stored so that both parents can see the conversation history. They are not end-to-end encrypted: they are encrypted in transit, and stored on our server in a form we are technically able to access. We do not read them, and access is limited to what is necessary for support, security, or a legal obligation.
When the AI features are used (a tone check on a message you write, or a summary of the thread asked for by either parent), message content is also sent to Anthropic (see section 6).
4.5 Location data from handoffs
When you log a handoff, on the Handover page of the website or in the Log a handover form of the phone app, you can press “Use my location” (“Use location” in the app). Only then does the app ask your device for its location. If your device gives one and you then log the handoff, the GPS coordinates and the time are stored with that entry.
Your phone or browser asks for your permission before it gives the app a location, and it is your device, not us, that remembers that answer. If you refuse, or location is switched off, the handoff is logged without it, as it is when you do not press the button. There is no background tracking: the app reads a location only when you press that button, or when the other parent presses “Confirm I was here” on a confirmation link. Because a handoff involves both parents, the record can end up describing where both of you were: your own location when you create the entry, and separately, your co-parent’s own location if they allow it when confirming. Each parent’s location comes only from their own device, at their own action, never inferred, never entered on someone else’s behalf.
4.6 Expenses and financial data
Amounts, dates, categories, descriptions, receipt images, how a cost is split between parents, and bank account numbers (IBAN) where you enter them for reimbursement.
An IBAN you enter may belong to a third party: a school, a clinic, a childminder. See section 7.
4.7 Contact details of other people
Phone numbers, email addresses and names you save for other people: your child’s friends’ parents, teachers, doctors, babysitters. These people are usually not Kin Agenda users and have not heard of us. See section 7.
In Family, each grown-up in the household has a card under People: the name the family uses for them, what they are called at home (Mom, Grandma), a colour, and a phone number if someone adds one. Everyone who joins the family with their own login gets a card by themselves, starting from the name on their account, and the card goes when their login leaves the family. A family can also add a card for someone without a login, such as a grandparent or a nanny; what we said above about other people applies to them too. To-dos and plans picked for a person keep their name as text, so it stays on those if the card is removed.
A grown-up’s card and a child’s profile can show a picture instead of a letter: an emoji, or a photo someone in the family chooses. Only people in that family’s Family space can see it. We keep a small square copy (384 pixels) and not the file that was sent, so where and when the photo was taken and the phone it came from are not kept. The photo is deleted when it is replaced, when the letter or an emoji is chosen instead, when the card or the child is removed, and when the family is deleted. A photo of a child is the child’s personal data: add one only if you are their parent or have their parent’s agreement.
The owner of a family can send an invite to join it (Family, Care Circle or Co-Parenting) by email: they type the person’s email address and we send that person one email with the invite link, through Brevo (section 8). We use the address only for that email and do not store it in Kin Agenda. The email says who sent the invite, and that we will not write again unless the person joins. An invite shared through the phone’s own Share sheet (a messaging app, for example) does not pass through us at all.
A read-only link (in Family, made by the family owner; in Co-Parenting, by a parent) can be sent the same way: we send that one email with the link, saying who shared it and what it shows, and we do not store the address or write to it again.
In Co-Parenting, a parent can share the record with a person from Sharing, with “Add a person”. For that person we keep the name the parent gives them, what they are to the children (Grandma, Nanny, Lawyer, or the parent’s own word), a phone number if the parent adds one, and an emoji or a photo. Both parents who can see the children on it see these details. A photo is kept the way a Family picture is (above): a small square copy, without where or when it was taken, deleted when it is replaced, when an emoji or the letter is chosen instead, or when the person is cleared from the list.
“Can view” gives that person a link that needs no account. It shows only the parts the parent ticked, and only about the children the parent picked: the calendar and custody days, the handovers (never where they happened), the child profile (sizes, routine, school, activities and the people to call), the whole conversation between the parents, the documents in the shared vault folders the parent picked (at least one; a folder that is not ticked, Travel included, never shows), and the expenses with their receipts. It never shows the medical card, the passport and ID card details in the profile, the profile’s notes, bank details, or anyone’s “Only me” files. A parent who ticks Messages, or the Medical folder, may be sharing health information, so that is a choice to make deliberately. The link works until the end date the parent picked (30 days, 90 days, a year, or no end date) or until a parent stops it.
Messages are shared only when a parent ticks them. The person then reads the conversation between both parents, including what the other parent wrote, and can save it as a PDF. The other parent sees that it was shared: the link is listed for them too, with who it is for, their relation, what it shows, when it was made and when it was last opened. Only the parent who made a link can change or stop it.
Each time the link is opened we record the time (once in any 10 minutes), and we record each PDF saved and each document or receipt opened through it, with the time and the name of the file or expense. Both parents see that list under “What they opened”. We record nothing else about the person for it; our server logs (section 8) still record the request, as for any page.
“Full access like a parent” is an invite to join with an account of their own, as before, made by the family owner. The same person details (name, relation, phone, picture) are kept on the invite.
Professional access, where a parent let a lawyer, mediator or therapist read the messages, became part of this on 22 October 2026. Each earlier grant is now a “Can view” link with Messages ticked. It keeps the email address it was given to as the person’s name, its end date and its earlier record of views, and a link already sent keeps working until it ends or is stopped.
4.8 Addresses you type in
When you enter an address (for a school, an activity, a handoff point), we send the text you typed to a mapping service to convert it into coordinates. See section 8.
4.9 Meal planning and shopping
The dish suggestions offered as you type come from a fixed list we hold ourselves, so what you type in that field stays on our own servers. This used to go to an outside recipe database and no longer does.
Three helpers in this part of the app do send text to Anthropic, our AI provider (see section 6). When you add something to a shopping list that we cannot sort into an aisle ourselves, the item’s name is sent so it can be sorted. When you build a shopping list from the week’s meals, the names of the dishes that have no ingredient list, and the names of the items already on your list and of the ingredients you saved for the week’s other dishes, are sent to work out what to buy. When you ask us to tidy up a pasted list of ingredients, that text is sent.
4.10 Technical data
Your IP address, browser and device type, operating system, and the pages and API endpoints you request, together with the date and time. This is recorded in our web server logs.
Your device’s time zone setting (for example “Europe/London”), which your phone or browser sends with each request and which we keep on your account, so that “today”, reminders and the morning digest follow your own clock. In a browser it is kept in a small cookie (kin_tz) for the same purpose, also when you open a link someone shared with you or a sign-in page without being signed in; then it is only in the cookie, not stored by us.
Push notifications are not being sent yet. If you turn on the Push switch in Settings in a browser, your browser’s push address and keys are stored from that moment, ready for when sending starts, and turning the switch off removes them. When sending starts, notifications will go through Apple (APNs), Google (FCM) or your browser’s push service, depending on your device (see section 8).
4.11 Payment data
Kin Agenda does not currently process payments through any third-party provider. This section will be updated to name the actual payment provider before a paid plan goes live with real billing.
4.12 What we do not collect
We do not use advertising trackers, we do not sell personal data, we do not build advertising profiles, and we do not use your data to train AI models. Anthropic, our AI provider, does not train its models on data sent through its API.
4.13 Feedback you send us
When you use “Send feedback” in the app, we keep what you wrote, whether you said we can reply, and where you sent it from: the page or screen, the product, web or phone, and the app version. It is linked to your account, and it reaches us as an email to info@kinagenda.com, from your name and email address. Please leave health details and other sensitive information out of it.
The contact form on our website asks for your name, your email address, a topic and your message, and we use them only to answer you. What you send reaches us as an email to info@kinagenda.com, through our email provider, and is not kept in the app’s database. To stop spam, we count the messages sent from each IP address and email address for an hour, in the server’s memory only.
4.14 Co-Parenting change history
When either parent adds, changes or deletes something in a child’s Co-Parenting record (a plan, an expense, a handover, a vault document, the child profile), we record who did it, when, and what changed. For plans, expenses and handovers that includes the old and the new value, for example a time or an amount. For the child profile it is only the names of the fields that changed, never what is in them, so medical details are not copied into the history. We also record who approved, rejected or settled an expense, and who wrote a correction to a handover. Both parents who can see the child can read this history; neither can edit or delete it.
Sharing is in the history too: when a parent shares the record with a person, changes what they can see, or stops it, the history names the person, their relation and the parts shared, never their phone number or the link. What a parent does in their own “Only me” vault folder appears only in their own view of the history.
4.15 Travel documents and the scan
A child’s profile can list their passports and ID cards: the kind of document, its number, the nationality, the issuing country, the expiry date, and whether the parent wants a reminder before it runs out. Reminders are not being sent yet; the setting is kept for when they are. These details are seen by the people who can see the child’s profile (in Family, the household; in Co-Parenting, both parents). They never appear on a share link or in a child’s own login.
In the phone app, a parent can scan the document’s photo page to fill the details in. The page is read on the phone itself, by the phone’s own text recognition (Apple’s on an iPhone, Google’s ML Kit on Android, which may download its reading model from Google the first time), and the picture is not sent to us. The name and date of birth on the page are only compared with the child’s profile on the phone, and are not saved. What reaches us is the details the parent checks and saves. The picture itself reaches us only if the parent switches on “Keep a copy”, which starts off: the copy is then stored as a document, in Family among the child’s documents, and in Co-Parenting in the shared vault, where the other parent can see it.
4.16 Your “Only me” folder in the Co-Parenting vault
Each parent has an “Only me” folder in the Co-Parenting document vault. A file there is seen only by the parent who put it there. The other parent does not see it, or how many there are, and it is left out of what anyone else sees: the other parent’s change history, reports, the other parent’s data export and every share link. Moving a file out of Only me into a shared folder shares it with the other parent from then on, and a file moved to Legal is locked there for good.
The files are stored like other vault documents (section 8). They are deleted when their parent deletes them, when that parent’s account is deleted, and when the child is removed after that parent has left the family’s Co-Parenting. A child can’t be removed while another parent who still has Co-Parenting reaches them, whatever that parent keeps in Only me, so one parent can never delete the other’s Only me files by removing the child.
5. Why we process it, and on what legal basis
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Account, profile, authentication | To give you an account and keep it secure | Contract, Art. 6(1)(b) |
| Calendar, handoffs, expenses, child profile | Core features you signed up for | Contract, Art. 6(1)(b) |
| Messages | To deliver and store your conversation | Contract, Art. 6(1)(b) |
| Handoff GPS coordinates | To record where a handoff took place | Consent, Art. 6(1)(a): you press “Use my location” (or “Confirm I was here” on a confirmation link), and your device’s location permission has to allow it |
| Child’s medical card, incl. DNR | To keep medical information available to both parents | Explicit consent, Art. 6(1)(a) and Art. 9(2)(a), which you give by choosing to enter the information and withdraw by emptying it |
| AI tone checks and thread summaries | To offer optional help with the tone of messages, and a summary of a long thread when a parent asks for one | Consent, Art. 6(1)(a) |
| Shopping and meal helpers (sorting an item, building a list from the week’s meals, tidying pasted ingredients) | To do the thing you asked for when you added the item or pressed the button | Contract, Art. 6(1)(b) |
| Address lookup | To place addresses on a map | Contract, Art. 6(1)(b) |
| Meal search | To suggest dish names as you type, from a list we hold ourselves | Contract, Art. 6(1)(b) |
| A child’s own login (see 13.1) | So a child can see their own plans, to-dos and dinner, as far as their parents allow | Contract with the parent, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f) |
| Co-Parenting change history | So both parents can see who changed what in the shared record, and when, including what was deleted | Contract, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f), for keeping the line about a deleted record |
| Sharing Co-Parenting with a person (4.7): their details, the link, and the record of what was opened | So a parent can show chosen parts of the record to someone without an account, and both parents can see who it was shared with and what they opened | Contract with the parent, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f), for the person’s details, the record of opens, and the other parent’s messages when Messages is ticked |
| Travel documents (4.15) | To keep a child’s passports and ID cards and their expiry dates at hand | Contract, Art. 6(1)(b) |
| “Only me” vault files (4.16) | To let a parent keep a file for themselves until they decide to share it | Contract, Art. 6(1)(b) |
| Feedback you send from the app | To fix what is broken, improve Kin Agenda, and answer you if you asked us to | Legitimate interests, Art. 6(1)(f) |
| Messages you send with the contact form | To answer you | Legitimate interests, Art. 6(1)(f) |
| Server logs, security monitoring | To keep the service running and to detect abuse | Legitimate interests, Art. 6(1)(f) |
| Retaining a co-parent’s copy of shared records after the other parent’s account is deleted | So one parent cannot unilaterally destroy the other’s records | Legitimate interests, Art. 6(1)(f) |
| Push notifications | To deliver alerts you asked for | Consent, Art. 6(1)(a) |
| Billing and invoices | To take payment and meet accounting law | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) (not yet applicable, see 4.11) |
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded it does not override them. You can ask us for that assessment, and you can object under Art. 21.
6. AI features
Kin Agenda uses AI, provided by Anthropic PBC (United States), in three places: optional help with the tone of messages, a summary of a message thread when a parent asks for one, and the shopping and meal helpers described in section 4.9. This section is about the first two.
Outgoing messages. Before you send a message, the app can check its tone and suggest a calmer version. You choose whether to accept, edit or ignore the suggestion. The text you typed is sent to Anthropic for this check. A short notice next to the message box tells you this happens when you press Send on a non-Health message; text you type without pressing Send goes nowhere.
Incoming messages. This part is not available yet. When it is, you will be able to ask to see a softened version of a message you have received. It will only happen when you actively request it, on that specific message, and the sender’s message text will then be sent to Anthropic.
Two things follow from this that we want to be explicit about.
First, once that is available, requesting a softened version of an incoming message will mean sending someone else’s words to a third party. Every time you write a message, a note next to the message box tells you that your text goes to Anthropic for the tone check; it’s always there, not a one-time notice you might dismiss and never see again. You can turn this off entirely in Settings; when you do, your writing is not sent to Anthropic by the tone check, by a thread summary, or by your co-parent asking for a softened version of something you sent.
Second, messages you have categorised as health-related are never sent to Anthropic, whichever direction they travel in. Tone assistance is unavailable for them by design.
Thread summaries. Either parent can ask for a short summary of a long thread. The messages in that thread are then sent to Anthropic together with the senders’ names, with two exceptions: messages categorised as health-related, and the messages of a parent who has switched AI off in Settings. When messages were left out for that second reason, the summary says so. The summary is shown to the parent who asked and is not stored.
What Anthropic does with it. Anthropic processes the text to generate a response and deletes inputs and outputs from its systems within 30 days. It does not use API data to train its models. If its automated safety systems flag content, it may retain that content for up to two years. Processing takes place in the United States; see section 9.
What we keep. We keep a short record of each tone check: the suggested rewrite, whether a check happened, and what you did with the suggestion. We do not keep a second copy of your original message text. These records are deleted after 90 days, and immediately if the underlying message is deleted.
Turning it off. Settings has an “AI tone checks” switch scoped to your own writing in messages: off means the automatic outgoing check, a thread summary, and your co-parent’s ability to request a softened rewording never send your messages to Anthropic. It will not affect your own ability to request a softened version of a message you receive, once that is available: that will be your choice as the reader, on that message. The shopping and meal helpers in section 4.9 have no switch: they run when you add an item or press their button.
7. Data about people who are not Kin Agenda users
Some of the data in Kin Agenda is about people who never signed up: your child, your child’s friends’ parents, teachers and doctors whose contact details you save, account holders whose IBAN appears on an expense, and the people a parent shares Co-Parenting with (section 4.7), including the record of when they opened the link.
We process that data because a user entered it in order to organise the care of their child, and we consider that a legitimate interest of both the user and the child (Art. 6(1)(f)).
GDPR normally requires us to tell those people directly that we hold their data (Art. 14). In most cases we have no way to contact them: we hold a phone number and a first name, entered by someone else, with no way to verify who it belongs to, and contacting them would itself mean processing more of their data. We therefore rely on the exception in Art. 14(5)(b) and publish this policy instead.
If you are one of these people and you have found this page: you can contact us at info@kinagenda.com and ask what we hold about you, ask us to correct it, or ask us to delete it. We will act on that request. In practice we will usually need to ask the user who entered your details to confirm the context, and we will tell you if we do.
If you are a Kin Agenda user: please only enter other people’s details when you actually need them, and remove them when you no longer do.
8. Who else receives data
| Recipient | What they receive | Where | Basis for transfer |
|---|---|---|---|
| Inferno Solutions (3NT Solutions LLP), hosting | Everything, as our infrastructure provider | United Kingdom | UK adequacy decision |
| Anthropic PBC, AI features | Message text for a tone check. The messages in a thread when a parent asks for a summary (never Health messages, and never those of a parent who has switched AI off). The names of shopping items we cannot sort ourselves. Dish names, and the names of items on your shopping list and of ingredients saved for the week’s other dishes, when you build a list from the week’s meals. Ingredient text you ask us to tidy up. | United States | SCCs / DPF (see section 9) |
| OpenStreetMap Foundation (Nominatim), address lookup | The address text you type | United Kingdom (company registered in England and Wales, no. 05912761); servers in the UK and EU | UK adequacy decision |
| Cloudflare, Inc., file storage and off-site backups | Files you upload: message attachments, family documents, expense receipts, vault documents (with a copy of a travel document’s photo page, if a parent keeps one), the photos chosen for people in Family, and the photos chosen for people shared with in Co-Parenting. Separately, a nightly copy of the whole database, kept as our off-site backup. | Stored in the European Union, both the uploaded files and the backup copies. Cloudflare itself is a United States company. | SCCs / DPF (see section 9) |
| Brevo (Sendinblue SAS), transactional email | Your email address and the content of service emails, including the feedback you send from the app and messages from the contact form on our website, which reach us as an email, and the address of someone a family owner sends an invite to, or a parent sends a read-only link to | France, and hosted in the EU, but some of Brevo’s own suppliers process this data in the United States | SCCs / DPF for those onward transfers (see section 9) |
| Namecheap, Inc., forwarding of email sent to info@kinagenda.com | Emails you choose to send us, feedback you send from the app, and messages from the contact form: your email address, what you wrote and anything you attached. Namecheap passes them on to our mailbox. | United States | SCCs (see section 9) |
| Google (Gmail), the mailbox where we read and answer email | The same emails, and our replies to you | Provided in Europe by Google Ireland Limited; Google keeps mail in data centres around the world, including the United States | SCCs / DPF (see section 9) |
| Apple (APNs), Google (FCM) or your browser’s push service, push notifications (not switched on yet) | Your device’s push token and the notification title and text | United States | SCCs / DPF |
Two of these deserve a note.
Address lookup. We use the OpenStreetMap Foundation’s public Nominatim service. The address text you type is sent there, and the Foundation records requests together with a shortened IP address for up to 180 days. It also analyses the addresses people search for in order to find gaps in its map data. Do not enter anything in an address field that you would not want recorded outside Kin Agenda.
Our own server logs. Our web server records the full request line of every request, together with your IP address, and keeps it for about two weeks (15 days at most). This is technical data (the page or endpoint requested), not the content of what you write in the app. Address lookups and dish searches are sent as a request body, not a URL parameter, specifically so that text never appears here. There is one exception: a word you type into a search or filter box on a page (a keyword filter on messages, a document search) becomes part of that page’s address, and so it is recorded in these logs.
We do not sell personal data and we do not share it with advertisers.
We may disclose data if we are legally required to (for example in response to a valid court order), and we will tell you when we are allowed to.
9. Transfers outside the EEA
Our hosting provider is based in the United Kingdom, so all of your data (not just AI processing) involves a transfer of personal data outside the EEA. Anthropic is based in the United States, so using the AI features involves a further transfer. The files you upload and our off-site backups are held by Cloudflare, Inc., which is a United States company even though it stores this data in the European Union at our request; because the company we contract with is outside the EEA, we treat that as a transfer too rather than relying on the storage location alone. Our transactional email is sent through Brevo (Sendinblue SAS), a French company that hosts this data in the EU, on servers in France, Belgium and Germany. Brevo’s own agreement is clear that some of its suppliers work outside the EEA even so: its error and log monitoring runs in the United States, and its support tooling and content delivery are partly there. Brevo relies on Standard Contractual Clauses and the EU-US Data Privacy Framework for those onward transfers. An earlier version of this page said receiving an email from us involved no transfer outside the EEA at all. That was wrong, and we have corrected it.
For both of those transfers we rely on the European Commission’s Standard Contractual Clauses (2021 decision), incorporated through each provider’s own data processing agreement: Anthropic’s applies automatically to our use of its API, and Cloudflare’s to our use of its storage. Both companies also participate in the EU-US Data Privacy Framework, but we treat that as a secondary basis rather than the primary one: the Framework is currently valid, and survived a challenge before the EU General Court in September 2025, but that ruling is under appeal to the Court of Justice. Holding Standard Contractual Clauses independently means our transfers do not depend on how that appeal ends.
The Claude API does not currently offer EU data residency: inference and storage are both in the United States. Text sent for the AI features described in sections 4.9 and 6 is therefore processed outside the EEA. This is one reason the message features can be switched off.
Our hosting and address lookups go to or through the United Kingdom. The UK is covered by a European Commission adequacy decision, renewed on 19 December 2025 and valid until 27 December 2031, so no additional safeguards are required for those transfers. Meal planning used to be on this list and no longer is: dish suggestions are now answered from a list we hold ourselves and are not sent anywhere.
Email you send to info@kinagenda.com leaves the EEA as well. The address is forwarded by Namecheap, Inc., a United States company that handles it on servers in the United States, and it arrives in a Gmail mailbox. Namecheap’s data processing addendum includes the Standard Contractual Clauses. Gmail is provided to us by Google Ireland Limited, and Google may keep mail on its servers outside the EEA, including in the United States; for that it relies on Standard Contractual Clauses and the EU-US Data Privacy Framework. This concerns only email you choose to send us, and messages from the contact form, not what you enter in the app.
You can request a copy of the safeguards we rely on by writing to info@kinagenda.com.
10. How long we keep things
| Data | Retention |
|---|---|
| Account, profile | While your account is active, then per section 11 |
| Messages, calendar, handoffs, expenses, child records | While at least one parent’s account is active |
| Child’s medical card | Until you empty it or remove the child’s profile, or until the last parent’s account is deleted |
| Tone check records | 90 days, or immediately when the underlying message is deleted |
| Web server logs (IP, requests) | About two weeks (15 days at most) |
| Text sent to Anthropic | Deleted by Anthropic within 30 days; up to 2 years if flagged by its safety systems |
| Address text sent to Nominatim | Up to 180 days, held by the OpenStreetMap Foundation |
| A child’s own login | Until a parent removes it, the child’s profile is removed, or the family is deleted. A one-time code is gone once used, and is useless after 10 minutes |
| A person shared with in Co-Parenting, and the record of what they opened | Until a parent clears them from the list in Sharing (a link has to be stopped or ended first), or the family is deleted. A stopped or ended link stays listed, with its record, until then |
| Travel documents | Until a parent removes them, or the child’s profile is removed |
| “Only me” vault files | Until their parent deletes them or their account is deleted, or the child is removed after that parent has left the family’s Co-Parenting |
| Co-Parenting change history | As long as the child’s Co-Parenting record exists, like the records it describes. If your account is deleted, your entries stay as part of the shared record, under “Deleted user” |
| Feedback you send from the app | 12 months, then deleted, or sooner when your account is deleted (section 11). The email copy in our mailbox is deleted within the same 12 months. |
| Password reset links | Single-use, expire after 1 hour |
| Invoices and accounting records | 10 years from the date of the document, as required by Lithuanian accounting law (not yet applicable, see 4.11) |
| Backups | Rolling backup of about two weeks (16 days at most). The primary copy is on our UK hosting and a second, off-site copy is held with Cloudflare (see section 8). A deleted record can persist in either backup for up to 16 days after deletion, before that backup is itself overwritten. |
11. Your rights
Under GDPR you can ask us to: give you a copy of your data (Art. 15); correct it (Art. 16); delete it (Art. 17); restrict how we use it (Art. 18); give it to you in a portable format (Art. 20); or object to processing based on legitimate interests (Art. 21). Where we rely on consent, you can withdraw it at any time.
Getting a copy of your data. You can export your data from settings at any time. This export contains your own account and activity: your profile, messages you sent, your read receipts, saved places, and your own logged actions across custody, handovers, expenses, and care (payments, log entries, medication doses, shifts). It also lists the people you shared Co-Parenting with by a link (their name, relation, phone and what the link shows, never the link itself), the travel documents you added (without the document number), and the details of the files you uploaded, your own Only me files included. It does not contain your child’s profile or medical card, or messages your co-parent sent to you; that content belongs to your child or to them, not to you, in the strict sense this export uses. If you want a fuller picture of everything visible in your family or circle, contact us directly.
Deleting your account. You can delete your account from Settings (step by step: Delete your account). We ask you to confirm your password, and the “Your data” export above is available to download first if you want a copy before you go.
Your account is blocked from signing in immediately. Deletion is permanent 30 days later; we email you a link to cancel at any point before then.
Every share link you made stops working on the day you ask, and stays stopped if you cancel.
When deletion completes, we erase: your login sessions and device tokens; your saved places and onboarding preferences; any data-export files and generated reports you created; your “Only me” vault files, with the history lines only you could see; and the precise location from handoffs you personally logged (the handoff event and its time stay, for your co-parent’s record, but the coordinates you submitted are gone). Your email, name and password are replaced so the account can no longer identify you or be signed into.
What we do not erase: your co-parent’s copy of your shared history. Messages you sent remain visible to the person who received them, with your name shown as “Deleted user.” Shared records about your child (the calendar, expenses, the medical card, any documents you or your co-parent uploaded) remain available to your co-parent, since that content belongs to your child and your shared household, not to you individually. When the last parent linked to a child deletes their account, everything about that child is permanently erased along with it.
One narrow gap remains here, smaller than it was. If you confirmed a handoff your co-parent logged while signed in to your own account, the location you submitted at that moment is now erased along with the rest. Confirmation links work without an account, though, and always will: the link itself is what proves it is you. So if you confirmed without being signed in, or you confirmed before 28 August 2026, there is nothing recorded that ties that location to you, and nothing for us to match on when erasing. Those coordinates stay, attached to the handoff record rather than to you. The fact that a handoff was confirmed, and when, is kept either way: that record belongs to your co-parent as much as to you.
Complaints. If you think we have handled your data wrongly, please contact us first. You also have the right to complain to the Lithuanian supervisory authority:
Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate)
L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
ada@ada.lt · +370 5 271 2804 · vdai.lrv.lt
You can also complain to the supervisory authority in the EEA country where you live.
We respond to requests within one month.
12. Security
Data is encrypted in transit (HTTPS). Passwords are stored as hashes and cannot be recovered, only reset. Access to production systems is limited to those who need it.
Messages are not end-to-end encrypted, which means we are technically capable of reading them. We say so plainly rather than implying a level of protection we do not provide.
If a data breach puts your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.
13. Children
Kin Agenda is for adults. You must be 18 or over to create an account.
Data about a child is entered by a parent or guardian, who is responsible for having the authority to provide it, including, where both parents share parental responsibility, taking the other parent’s views into account.
13.1 A child’s own login
In Family, a parent or guardian can give a child their own login on a phone. The child never creates an account: the parent sets it up from the child’s profile and shows the child a one-time code, which works once, for 10 minutes. The parent decides, and can change at any time, what the child can see and do: their own plans (or the whole family calendar), the to-dos they are to do and ticking them off, tonight’s dinner and voting on it, the shopping list and adding to it, and the basics of their own profile (school, activities, routine). A child’s login never shows messages, expenses, documents, medical details, contacts, Co-Parenting or Care Circle.
For a child’s login we keep: the login itself (linked to the child’s profile, with the child’s first name and no email address or password), the choices the parent made, which phones are signed in and since when, and what the child does in it: to-dos ticked or added, shopping items added and dinner votes. The parents can see all of that. We do not use location, push marketing, adverts or AI features with a child’s login, and nobody can message a child through Kin Agenda. The child’s app tells them, in plain words, what their parents can see.
We rely on the parent’s choice to set the login up (the contract with the parent, Art. 6(1)(b), and our legitimate interest in the family having the tool it asked for, Art. 6(1)(f)), not on the child’s own consent. The login is removed when a parent removes it, when the child’s profile is removed, or when the family is deleted; the to-dos and shopping items the child added stay with the family, like everyone else’s.
A child has their own rights under GDPR over data about them. A parent can exercise those rights on the child’s behalf; an older child can exercise them personally. If a child contacts us directly, we will answer in language they can understand.
14. Changes to this policy
If we make a change that materially affects you, we will tell you in the app or by email before it takes effect. The version and date at the top of this page always show the current text.
15. Contact
Akvilė Strumylaitė, operating Kin Agenda as an individual
Lithuania, EU
info@kinagenda.com