Kinlist Privacy Policy

What we collect

Only what the app needs to work. There is no analytics SDK and no advertising ID.

• Account identity.When you sign in with Apple or Google, we receive an email address and a provider account identifier. If you use Sign in with Apple's private relay, we only ever see the relay address. Apple also sends your name once, on first sign-in, which we store as your display name — you can change it, and we never overwrite a name you chose yourself.
• Household content. The names of your households, your lists and their titles, and the items on them — including item names, quantities, units, aisle categories, due dates, and whether something is checked off or bought.
• Membership and invites.Who belongs to which household, each member's role (owner or editor), and the invite codes used to join, along with their expiry and use count.
• Abuse prevention.A timestamped record of invite-code redemption attempts, tied to your account, used solely to rate-limit guessing at other households' codes.
• Aisle learning. When you move a grocery item to a different aisle, we remember that choice for your household so the item lands in the right place next time. This stays inside your household and is never pooled across users.

What we do not collect

• Location, contacts, photos, calendars, health data, or files.
• Advertising identifiers. Kinlist does not track you across other apps or websites, and does not ask for permission to, because it never does it.
• Payment details. Kinlist is free and takes no payments.
• Your Apple or Google password. Sign-in happens through Apple and Google; we only receive the result.

Who can see your content

Everyone in a household can read and edit that household's lists — that is the entire point of the app. Nobody outside it can. Access is enforced at the database level with row-level security, so a request for another household's data returns nothing regardless of what the app asks for.

Anyone holding a valid, unexpired invite code can join the household it belongs to. Treat invite codes like keys and only share them with people you want in your household.

Where it is stored

Data is stored on Supabase, hosted in the United States (AWS us-east-1), encrypted in transit and at rest. On your phone, your login session is kept in the operating system's secure storage (iOS Keychain / Android Keystore) and a copy of your lists is cached on the device so the app works offline. Deleting the app removes that on-device copy.

Service providers

• Apple and Google — sign-in only. They tell us who you are; we tell them nothing about your lists.
• Supabase — database, authentication, and realtime sync hosting.
• Sentry — crash reporting, so a crash on your phone is visible to us and fixable. Crash reports carry technical error information (the failure, the app version, the device model). They are configured to exclude the contents of your lists and items.

None of these providers are permitted to use your data for their own purposes. We have never sold personal data and have no plans to.

How long we keep it

Your content stays until you delete it or delete your account. Invite-attempt records are kept only as long as they are useful for rate-limiting. Deleted content may persist briefly in encrypted database backups before aging out.

Deleting your account

You can delete your account from inside the app at any time — open Settings and choose Delete Account. It is immediate and cannot be undone.

Deleting removes your login, your profile, every household you created (along with its lists, items, and invites), and your membership in households created by other people. Households someone else created keep existing for them — you are simply no longer a member. If you were the last member of a household you created, it and its lists are gone for good.

If you have already removed the app and cannot sign in, request deletion here.

Children

Kinlist is not directed at children under 13 and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. The in-app deletion above satisfies the deletion right immediately. For anything else, email us and we will respond within 30 days.

Changes

If this policy changes materially, we will update the date at the top of this page and note the change in the app's release notes.

Contact

Meridian Tech Labs LLC, Texas, USA — hello@meridiantechlabs.com