Privacy
We keep as little about you as we can, we never sell it, and there is no advertising here. This is the whole of it.
What never leaves your phone
Your journal — every sealed page and every photo, recording, or video in one. The moments you keep from a correspondence. Your courier's name, look and shape. Your drafts. None of it is uploaded to us, ever. A sealed page feeds nothing: not matching, not your fingerprint, not us.
What we keep
An email address (from Apple, Google, or the one you type — Sign in with Apple may give us a relay address instead, which is fine). Your pen name, the birth date used to check you are 18, and the face you chose. The letters you send. Reports you file. And a writing fingerprint: eight numbers describing measurable qualities of your writing — sentence length, pauses, rhythm, how often you ask or exclaim. It is computed on your phone, contains no words, and cannot be read back as text.
The AI, precisely
Letter text passes through Moonshot AI at two moments only: an automated safety check before delivery, and translation when a reader asks for it. Only that letter's text is sent, without your name or email, and it is not used to train models. Everything else Wren does — reading your writing, shaping your courier, noticing what two people share — is computed on your phone with no model involved.
Who else touches it
Supabase stores the database and uploaded voice letters and photos. Apple handles every payment; we never see a card number. RevenueCat holds your subscription status against your account ID. Cloudflare hosts the site and API. That is the entire list. No advertising networks, no analytics SDK, no data brokers.
What other members see
Your letters. And — only after five letters each way, and only if you both choose — the pen name and face you enclose. Never your email, your birth date, or your fingerprint.
What we never collect
No contacts. No location. No advertising identifiers. No browsing history. No biometrics. No payment card details.
How long
Your account and letters stay until you delete the account, which you can do in Settings at any time. After that, account data leaves our live systems immediately and our backups within thirty days. Letters you already sent remain in the other person's copy, unsigned. Reports are kept up to twelve months so repeat behaviour can be recognised.
Your rights
Ask us for a copy of everything we hold. Correct your details in the app. Delete everything from Settings. Withdraw photo or microphone access in iOS Settings. If you are in the EEA or UK you may also complain to your data protection authority. We make no automated decision that has a legal or similarly significant effect on you — matching orders which letters you see; it decides nothing about you.
Where it lives
Our servers are outside your country. Where we move personal data out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses. Letters are encrypted in transit and at rest, and only the two people in a correspondence can read it — enforced by the database itself, not by the app.
Contact
Beijing Lingxi Wuxian Technology Co., Ltd. · Rm 429, Block D, Bldg 3, No. 8 Courtyard, Fenggu 4th Rd, Badaling Development Zone, Yanqing District, Beijing · hello@kindredly.io