Kin Album
Privacy Policy
Effective September 15, 2026
Kin Album is a private, end-to-end encrypted family photo album, operated by Cobblestone, LLC (“Kin Album,” “we”). This policy says what we collect, what we can and cannot see, and the controls you keep. The short version: your photos are encrypted so that we cannot look at them, we show no ads, we sell nothing about you, and you can export or delete everything at any time.
What we collect
- Account details. Your email address (or phone number), a password or sign-in identity, and the display name you choose. Other family members see only your display name — never your email or phone.
- Your family’s content. Photos and videos are encrypted on your device before upload; our servers store only ciphertext we cannot decrypt. Captions, comments, and reactions are stored readably so the album works across devices and in email updates.
- Child profiles. Optional names and birthdates that a parent or guardian enters about their own child, used only to organize the album. Children do not use Kin Album and we do not collect information from them (see “Children” below).
- Technical basics. Error reports (with personal identifiers turned off), delivery records for the emails we send you, and the minimum logs needed to run the service. The website uses only essential cookies and browser storage to keep you signed in and to hold this device’s encryption keys — no advertising trackers, no analytics profiles, no fingerprinting. We do count page views on our public website, with our own software writing to our own database: which page, the country, and the site that linked to you. It sets no cookie. Your address is never stored — it is turned into a scrambled value using a key that changes every day, so the same visitor cannot be recognised tomorrow. And pages reached by a private link, like an invitation or one particular memory, are counted only by their SHAPE (“an invitation page”), never by the link itself.
- Feature usage. The apps record which screens and features are used — a short event name from a fixed list (like “invite sent”), tied to your account, so we can find and fix onboarding friction. There is deliberately nowhere to record anything else: no free-form content, no location, nothing from your photos. This stays in our own database — we use no third-party analytics services — and is deleted with your account.
- What you told us when you signed up. The iPhone app’s opening screens ask how much four things matter to you — owning your photos, no ads, no AI, and encryption strong enough that we can’t look — and which one matters most. We keep those answers, along with how long the questions took, so we can tell which promises actually matter to families. They are stored on your phone until you create an account, then attached to it. They stay in our own database, are never sold or shared, and are deleted with your account.
What we can and cannot see
End-to-end encryption is always on — it is not a setting. Encryption keys live on your family’s devices, so we cannot see your photos or videos, and neither can anyone who breaches our storage. We can see the metadata required to run the service: who is in a family, captions and comments, timestamps, and file sizes. One deliberate exception exists, and its scope is wider than it sounds, so here it is plainly: if an album admin turns on “Send photos in their emails” for even one person, then from that moment small photo renditions are prepared outside encryption for every photo posted to that album, by every member — not only for the photos that person is sent. Full-quality originals stay encrypted throughout. Turning the setting off again stops new renditions being made anddeletes the ones already made, within a day.
One more moment of transit worth naming: when you invite someone by email, the invitation link in that email carries the secret that lets their device join the album’s encryption. It travels inside the link (never stored readably by us), but like anything sent by email, it is only as private as the recipient’s inbox — which is why invites expire, are bound to the invited address, and stop working the moment they are used or revoked.
How we use information
Only to provide Kin Album: storing and syncing your album, delivering invites and email updates, processing your subscription, and fixing problems. We do not sell or rent personal information, we do not show ads, and we do not use your family’s content to train AI.
Notifications
If you turn on notifications, we send you alerts when someone posts a memory or comments — in the iPhone app through Apple’s notification service, and in a web browser through your browser’s push service (Google, Mozilla or Apple, depending on the browser). Those alerts are written by our servers and contain only a first name and a short phrase, such as “Maya added a new memory.” They never contain a photo, a caption, or the text of a comment, because a notification travels outside the encryption that protects your album. Browser notifications are additionally encrypted so the push service relaying them cannot read them. You can turn notifications off at any time in your device or browser settings, and email updates keep working either way.
Crash reports
If the app crashes or freezes, your device may send us an anonymized technical report (using Apple’s MetricKit) so we can find and fix the problem. These reports describe the app’s behavior — where it was in the code when it failed — never your photos, captions, comments, or anything you wrote. They are sent only to our own systems, never to a third-party crash service, and are not linked to your identity.
Who processes data for us
Like every online service, we rely on infrastructure providers, each bound by their own data-processing terms: Supabase (database and authentication), Cloudflare (encrypted media storage), Vercel (web hosting), Resend (email delivery), Sentry (error monitoring), Apple (app distribution, in-app purchases and iPhone notifications), and your browser’s push service when you enable web notifications. None of them can decrypt your photos.
Retention and deletion
Your content stays as long as your album does. If your subscription lapses, the album pauses — nothing is deleted. Deleting your account or family vault (both available in Settings) starts a 30-day grace window during which you can change your mind; when it ends, content is permanently purged from our live systems, and any residual copies in our encrypted database backups rotate out within 14 days. You can export a full archive of your family’s memories at any time, also from Settings.
If a family sends you photos by email
A family admin can add you as an email recipient: new photos arrive in your inbox, and you never need an account. Once an album is a few months old you may also get an occasional “one year ago” note naming a moment from that week — no photograph, just the caption and who shared it, with a link to the album. A family admin can switch those off for the whole album. For that to work we hold your email address, the name the admin typed for you, and when we last sent you each kind of email — nothing else, and never a password, because you don’t have one. The photos in those emails are preview-size copies; the originals stay in the family’s end-to-end encrypted album. Every email has a one-click unsubscribe that works immediately, the person who added you can see you opted out, and if you mark our mail as spam we stop permanently — even if someone tries to re-add you. To have your address removed entirely, use the unsubscribe link or write to support@kinalbum.com.
If you joined the waitlist
Before the app was in the App Store you could leave an email address to be told when it launched. We hold that address, the date you gave it, and a short label saying which page it came from — nothing else, and no account, because you don’t have one. It is used for exactly one message: that Kin Album is live. It is not a newsletter, we never sell or rent the list, and it is not connected to any album. One thing IS shared, and only if it applies to you: if you reached us by clicking an advertisement, we tell that advertising platform that a signup happened, so we can see which adverts are worth paying for. What we send is a scrambled version of your address and the tracking code that platform itself put in the link it sent you — never your address in readable form, and never the list. We send it from our own server, so there is no advertising company’s code running on this website and no cookie is set for it. If you did not arrive from an advertisement, nothing at all is sent to anyone. Write to support@kinalbum.com and we will delete your address the same way we would delete an account.
Children
Kin Album is for adults: everyone with an account, including invited family members, must be at least 18. Children do not have accounts and we do not knowingly collect personal information from children; photos and profile details about children are provided by their own parents or guardians, who control exactly who can see them and can delete them at any time. If you believe a child under 13 has created an account, contact us and we will remove it.
Your rights
Regardless of where you live, you can access, export, correct, or delete your information — the tools are built into Settings, and we honor the same rights by email. Residents of California, the EU/EEA, and similar jurisdictions may have additional statutory rights; we apply the built-in controls above to everyone rather than gating them by geography.
Security
End-to-end encryption is the core of Kin Album’s design: a breach of our media storage would expose only ciphertext — never your photos or videos. Account details, captions, and comments are not end-to-end encrypted (see “What we can and cannot see”); they are protected by industry-standard encryption in transit and at rest. If an incident affects your personal information, we will notify affected families by email promptly — within any legally required deadline, and no later than 30 days after we confirm it — with what happened and what we did.
Changes and contact
If this policy changes in a way that matters, we will email account holders before the change takes effect. Questions or requests: jared@cobblestonehq.com, or by mail: Cobblestone, LLC, 8735 Dunwoody Pl, Ste N, Atlanta, GA 30350-2995.