Kin Album

Privacy Policy

Effective and last updated November 3, 2026

Kin Album is a private, end-to-end encrypted family photo album, operated by Cobblestone, LLC (“Kin Album,” “we”). This policy says what we collect, what we can and cannot see, and the controls you keep. The short version: your photos are encrypted so that we cannot look at them (with two exceptions, described below: the small preview copies made while your album sends photos in emails, and an invitation emailed from the iPhone app), we show no ads, we sell nothing about you, your album’s admins can export the whole album at any time, and you can delete anything you’ve posted, or your account.

Our promises

Three things will not change:

No ads. We don’t show ads in Kin Album, and we never will.
We never sell your personal information.
No AI on your photos. Your photos and videos are end-to-end encrypted, so we can’t look at them (apart from the two exceptions described under “What we can and cannot see”: the small preview copies made while your album sends photos in emails, and an invitation emailed from the iPhone app). We don’t run AI on them, and we don’t use your family’s content to train AI.

These are promises, not settings. We will never change them unless we first ask you and you agree, and anyone who takes over Kin Album has to keep them too.

What we collect

Account details. Your email address, a password or a sign-in identity (if you sign in with Apple or Google), and the display name you choose. Other family members see only your display name — never your email or phone — with two exceptions, both for an album’s admins only. While an invitation waits to be accepted, they see the address or number it was sent to; once it is accepted, the album shows your name instead. And when you ask to join an album, the admins who can let you in see the name and email address you signed in with, so they can tell who is asking — only while your request is waiting for an answer.
Your family’s content. Photos and videos are encrypted on your device before upload; our servers store them as ciphertext we cannot decrypt, apart from the small email preview copies described under “What we can and cannot see” below. Captions, comments, and reactions are stored readably so the album works across devices and in email updates.
Child profiles. Optional names and birthdates that a parent or guardian enters about their own child, used only to organize the album. Kin Album accounts are for adults 18 and over, and we do not collect information from children (see “Children” below).
Reports and blocks. If you report a memory or a comment, we keep a record of which one, in which album, who reported it, the reason you picked (if you picked one), and when. It never copies the memory or comment itself. The album’s admins are told that something was reported, and see the memory or comment and the reason, but never who reported it. If you choose, or if no one else in the album can act, the report also reaches Kin Album — which memory or comment, in which album, whose it is, who reported it, the reason and when, never the memory or comment itself. A report is deleted when the memory or comment is, and when the account that made it is closed; if it reached Kin Album, we keep a record of it until we have looked into it, for at most 90 days. If you block someone, we keep who blocked whom and when, so that what they post is hidden from you on all your devices and left out of your notifications and email updates. Only you can see your blocks: the person you blocked is not told. A block is deleted when you unblock them, or when either account is closed, apart from the short record described under “How long we keep things”.
Screenshot alerts. An album’s admins choose whether screenshots are allowed in the app and whether they are told about them. When the Kin Album app sees a screenshot of a memory in an album that tells its admins, we record who took it, the album, memory and photo, the memory’s caption, which app it came from, and when. The album’s admins see it in a notification (“Maya took a screenshot of a memory”) and in the album’s activity; other members don’t. It stays in the album’s activity until the album is deleted. The iPhone app can tell when a screenshot is taken. On Android, screenshots of the album show the photo only on Android 15 or newer, in an album that allows them, and the album’s admins are told about each one; everywhere else on Android, screenshots of the album stay blocked. A web browser is never told about screenshots, so the website sends nothing, and screen recordings are never recorded or announced.
Encryption keys. To lock your album’s key for the people and devices allowed to open it, we keep public keys: one for your account if you use the iPhone app, and one for each web browser or Android phone you open an album on, with a plain name for it such as “Safari on iPhone” or “Kin Album on Android”, and when each was last used. We don’t record your phone’s model with it. A public key can lock the album key for a device, but can’t unlock anything. Your album’s admins can see these names, but not when they were used, so they can tell which device is asking to be let in. If you set a recovery password or a recovery phrase in the iPhone app, the app also locks a copy of your account’s private keys with it, and we keep that locked copy so you can get back into your albums on a new phone. Your recovery password or phrase never leaves your phone, and we can’t open the copy without it. Setting a new one replaces the old copy, and the copies are deleted with your account.
Gift time. If you buy gift time for an album in the iPhone app, Apple takes the payment and tells us about the purchase. We keep a record of it: who bought it, for which album, how many months, the price and currency Apple reports, when, and Apple’s reference for the purchase.
Paying for another family’s album. If you pay for a family’s album in the iPhone app, we keep a record of it: who paid, Apple’s reference for the subscription, a scrambled form of the link we gave you (never the link itself), when the link was made and used, and which album it pays for once the family starts it.
Website purchases. When you pay on kinalbum.com, Stripe handles the payment, and we never see or keep your full card number. We keep a record of the purchase: who bought it, for which album, what was bought (a subscription, how many months of gift time, or a payment for another family’s album), the price and currency, when, and Stripe’s reference numbers for you and for the purchase. For a subscription we also keep the dates it is paid through and whether it renews. If Stripe says you paid from outside the United States, or doesn’t say where, we also keep that country, so we know about it. We keep no country for a buyer in the United States. For paying for another family’s album we also keep what is listed above for that, with Stripe’s reference in place of Apple’s.
Technical basics. Error reports (with personal identifiers turned off), delivery records for the emails we send you, and the minimum logs needed to run the service. The website uses only essential cookies and browser storage to keep you signed in, to hold this device’s encryption keys and to remember that you said you’re 18 or older, and for which accounts, plus one small cookie described under “Feature usage” — no advertising trackers, no analytics profiles, no browser fingerprinting. If you save a passkey for a web browser, we keep a locked copy of that browser’s key, so the browser can get back into your album with your passkey (Face ID, for example) after its data is cleared, or on a new device. Only your passkey can unlock the copy; we can’t. An album admin can turn this off, which deletes the copies, and they are deleted with your account. We do count page views on our public website, with our own software writing to our own database: which page, the country, the site that linked to you, and whether it was a phone, tablet or computer. It sets no cookie. Your internet address is never stored. Together with the browser details your device sends and the date, it is turned into a scrambled value using a random key made fresh each day inside our database, and that key is deleted soon after the day ends (UTC). Counting a day’s visitors never needs the key. While a day’s key exists we could, in principle, check a known address against that day’s values; once it is deleted, and has rotated out of our encrypted database backups within 14 days, nobody — including us — can tell whether visits on different days came from the same person. And pages reached by a private link, like an invitation or one particular memory, are counted only by their SHAPE (“an invitation page”), never by the link itself.
Feature usage. The iPhone app and the web app record which screens and features are used — a short event name from a fixed list (like “invite sent”), tied to your account, so we can find and fix onboarding friction. The Android app records none. There is deliberately nowhere to record anything else: no free-form content, no location, nothing from your photos. This stays in our own database — we use no third-party analytics services — and is deleted with your account. Separately, we keep a bare daily count of how many times the price screen in the iPhone app’s setup and the price section of our website are shown — one number per day for each, with nothing about who saw them: no account, device, address, album or time of day. We keep the same kind of bare daily count for a few steps of joining an album: an invitation opened, someone joining, a first look at the photos, a return in the second week, a web browser that needed its key again, and setting up the iPhone app after joining on the web. So the website doesn’t count the same browser twice, it keeps a small cookie noting which steps it has counted. The cookie holds only short scrambled tags, never your name, email address or account. We may add other counts of the same kind, one number per day that says nothing about who, when they help us see where Kin Album is hard to use. These counts, and the feature usage above, are for running and improving Kin Album only. We never sell them, and we never share them with anyone for advertising.
Messages to support. When you use Contact us in the iPhone app, we receive your message, your name, your app version, iOS version and device model, and your account’s email address and ID, so we can reply. If you attach a photo or video, our support team can see it — it is not end-to-end encrypted — and its location is removed before it leaves your phone. Your message reaches our support inbox as an email and stays there until we delete it; ask, and we will delete yours. Our email provider keeps its own copy of the emails it delivers for 30 days, and up to 7 days more in its backups. In the Android app, Contact us opens your own email app with a message to us already addressed, and the app’s version, your phone’s model and its Android version filled in; you can change any of it before you send. The app itself sends nothing. What you send reaches our support inbox like any other email; it too stays there until we delete it, and we will delete it if you ask.
Your answers during setup. The iPhone app’s opening screens ask how much four things matter to you — owning your photos, no ads, no AI, and encryption the company itself can’t open — and which one matters most. Your answers, and how long the questions took, stay on your iPhone: they are never sent to us, and they are removed when you delete the app.
Installing the Android app from an invitation. If you open an invitation on an Android phone that doesn’t have the app yet, the page can send you to Google Play to get it. That link gives Google Play the invitation’s reference code, so the app can find your invitation when it first opens. It never includes the secret that unlocks the album. The app reads the code once, and uses it only for that.

What we can and cannot see

End-to-end encryption is always on — it is not a setting. Encryption keys live on your family’s devices, so we cannot see your photos or videos — with the two exceptions below. We can see the metadata required to run the service: who is in a family, captions and comments, child profile names and birthdates, timestamps, and file sizes. The first exception’s scope is wider than it sounds, so here it is plainly: if an album admin turns on “Send photos in their emails” for even one person, then from that moment small photo renditions are prepared outside encryption for every photo posted to that album, by every member — not only for the photos that person is sent. Those renditions are stored with us, beside the encrypted originals, for about 30 days after each photo is posted, and they are not end-to-end encrypted while they exist. Full-quality originals stay encrypted throughout. Turning the setting off again stops new renditions being made and deletes the ones already made, within a day.

The second is an emailed invitation. When you invite someone by email from the iPhone app, the link in that email carries the secret that lets their device join the album’s encryption: it unlocks a locked copy of the album key that we keep for that invitation. The link passes through our server and our email provider on its way, and our email provider keeps a copy of each email it sends for 30 days, and up to 7 days more in its backups — so until the invitation ends, we could in principle use that link to unlock the album. Like anything sent by email, it is also only as private as the recipient’s inbox. That is why an invitation lasts only 14 days, why each of its links works only for the address it was sent to, and why we delete the locked copy of the album key the moment an invitation is withdrawn and within an hour of it expiring. Once that copy is gone — and has rotated out of our encrypted database backups, within 14 days — the copy at our email provider can no longer open anything. A link does not stop working when it is first used: until it expires, it keeps working for the person it was sent to, which is how they open the album on a second phone, tablet or browser. Withdrawing an invitation that hasn’t been used stops all of its links at once, and removing someone from the album stops them working for that person. Replies to an emailed invitation go to the email address of the person who sent it, so the person invited can see that address; when we can’t use it — for example, an address from Apple’s Hide My Email — the invitation says replies aren’t delivered.

Separately, anything you choose to attach when you contact us from the app reaches our support team as it is; see “Messages to support” above.

How we use information

To provide Kin Album: storing and syncing your album, delivering invitations, notifications and email updates, taking payments, answering you when you write to us, keeping the service secure and free of abuse, and finding and fixing problems. We also use the counts described under “Feature usage” to make Kin Album easier to use. We don’t show ads, we never sell personal information, and we don’t use your family’s content to train AI (see “Our promises”). We do measure whether our own ads work: if you installed Kin Album from an ad, Apple’s ad measurement tells that ad network — without identifying you — whether the install led to a monthly or yearly subscription. Apple sends us a copy of the same report.

To apply the free plan’s storage limit and the daily limit on how much any album can add, we use the size of each encrypted photo and video file, which we record when it is uploaded. A size is all it tells us: the file itself stays encrypted, and its size says nothing about what is in it.

We use a gift-time purchase to add the time to the album, to take it off again if Apple refunds it, and to show the person who bought it their own purchases. The family is never shown who gave gift time or how much it cost. An album’s admins can see the date the album is paid through and how much gift time is waiting; other members can’t.

If you pay for another family’s album, we use that record to apply your subscription to the album the family starts, to show you your own links and the albums your subscription pays for, and, if your subscription stops paying for that album, to tell you by email and in the app, with how to cancel it. The album’s admins can see who pays for the album and what it costs; other members aren’t shown it. An admin who goes to remove you is also told that you pay for it.

We use a website purchase to give the album its paid time or gift time, to stop a subscription renewing when the album no longer needs it, to refund unused gift time to your card when an album is deleted, to refund unused time to your card if Kin Album shuts down, to take time off the album if Stripe refunds a purchase, and to show you your own purchases. To take the payment, we send Stripe the email address on your account and a reference number for the purchase. We send it nothing about your album: not its name, its photos or videos, or anyone in it. In the family, only the album’s admins can see who paid and how much it costs.

Notifications

If you turn on notifications, we send you alerts when someone posts a memory or comments, and, if you are an album admin, about things like a screenshot or a report — in the iPhone app through Apple’s notification service, in the Android app through Google’s Firebase Cloud Messaging, and in a web browser through your browser’s push service (Google, Mozilla or Apple, depending on the browser). Those alerts are written by our servers and contain only a first name and a short phrase, such as “Maya added a new memory,” and the reference numbers the app needs to open the right album or memory. They never contain a photo, a caption, or the text of a comment, because a notification travels outside the encryption that protects your album. Browser notifications are additionally encrypted so the push service relaying them cannot read them. In the Android app, Firebase is switched on only after you say yes to notifications, and we use it for nothing else: no Google Analytics, no crash reports. It gives your phone an address for alerts, which we keep with your account, together with your notification settings and the app’s version. We delete it when you sign out on that phone, when you delete your account, or when Google tells us the app is no longer on the phone. You can turn notifications off at any time in your device or browser settings, and email updates keep working either way.

Email from us

Most of our email is part of the service: invitations, your album’s updates, sign-in and security messages, payment reminders, and notices about your account or album.

We send news about Kin Album, such as new features, tips or offers, only to people who ask for it, for example by ticking a box that asks. Every one of those emails has a one-click unsubscribe link, and unsubscribing never affects your album or its emails. Today we send no such news.

Crash reports

If the app crashes or freezes, your device may send us an anonymized technical report (using Apple’s MetricKit) so we can find and fix the problem. These reports describe the app’s behavior — where it was in the code when it failed — never your photos, captions, comments, or anything you wrote. They are sent only to our own systems, never to a third-party crash service, and are not linked to your identity. Once a day, the iPhone app may also send anonymous statistics about how it performed (for example how long it took to open, whether it was slow to respond, and how much memory, battery and data it used), under the same rules. The Android app sends no crash reports or performance statistics.

Service providers

Like every online service, we rely on other companies to run parts of Kin Album, each bound by their own data-processing terms. We use them in these categories, and these are the ones we use today:

Hosting and database: Supabase (our database, sign-in and server functions) and Vercel (our website).
Storage: Cloudflare (photo and video storage, our encrypted backups, and a copy of the short restore record described under “How long we keep things”).
Scheduled backup jobs: GitHub (running our scheduled database backups, which are encrypted before Cloudflare stores them).
Email: Resend (sending our emails) and Cloudflare (routing email sent to our kinalbum.com addresses).
Customer support: Google (Gmail, the mailbox where email to support@kinalbum.com and privacy@kinalbum.com arrives).
Payments: Apple (purchases in the iPhone app) and Stripe (payments on kinalbum.com, described below).
Notifications: Apple (iPhone), Google’s Firebase Cloud Messaging (Android), and your browser’s push service (web).
Sign-in and app stores: Apple (the App Store, Sign in with Apple, and the ad measurement described above) and Google (Google Play and sign-in with Google).
Error and crash reporting: Sentry (problems on our website). The iPhone app’s crash reports come only to us.
Security: protecting the service from abuse and attacks. Today the providers above do this.

If we add or replace a provider within one of these categories, we update this list. That is a routine update. A new kind of provider, or giving a provider something new about you, is a change we tell you about in the Kin Album app first (see “Changes to this policy”).

None of them can decrypt your photos or videos. The email preview copies described above are not encrypted: Cloudflare stores them, and Resend delivers them in those emails. Nor is a photo or video you attach to a message to support: Resend delivers it to our support inbox.

When you pay on kinalbum.com, Stripe takes the payment, through its payment service Link. It is more than a provider that works for us: it is an independent company, Link is the seller of record for those purchases, and Stripe handles sales tax, fraud checks and disputes. When you pay, you leave our website for a page Stripe hosts, and Stripe’s own privacy notice applies to the payment details you give it there. Stripe never receives your photos, videos, captions or comments, or your album’s name.

When the law or someone’s safety requires it

Beyond the uses above, we share information only:

when the law requires it, such as a valid court order or subpoena;
to report child sexual abuse material to the National Center for Missing & Exploited Children, as US law requires; and
when we believe in good faith that it’s needed to protect someone from serious harm.

We share only what’s needed. Photos and videos stay end-to-end encrypted, so we can’t hand over what we can’t open, apart from the two exceptions under “What we can and cannot see”. Anyone, with or without an account, can tell us about something that may be illegal or break our Terms at kinalbum.com/report.

Where your information is stored

Kin Album is run from the United States, and your account, albums and photos are stored in North America. If you use Kin Album from another country, your information is sent to North America to be stored, and some of our providers may also handle it in other countries. Where the law of your country requires it, as in the UK and the EU, those transfers are protected by our providers’ standard contractual clauses, or by the EU-US Data Privacy Framework and its UK Extension where a provider takes part.

Retention and deletion

How long we keep things

Your account: until you delete it. Deleting starts a 30-day window to change your mind, then it is purged.
Photos, videos, captions and comments: until they, or their album, are deleted, as described below.
Email preview copies: about 30 days after each photo is posted.
Invitations: up to 14 days. The locked copy of the album key that an emailed invitation opens is deleted within an hour of the invitation ending.
Device names, keys and when each was last used: until your account is closed. A request to let a new browser into an album ends after 30 days if no one answers.
Feature usage: up to 90 days linked to your account, then only as daily totals for each album that name no one. Your part is deleted with your account.
Website page views: up to 90 days, then only as daily totals. The key that scrambles visitors is deleted soon after each day ends.
Daily counts (the price screen and the steps of joining an album): kept, because they say nothing about who.
Reports: until the memory or comment, or the account that reported it, is deleted. If a report reached Kin Album, our record of it: until we have looked into it, at most 90 days.
Blocks: until you unblock someone, or either account is closed, apart from the record described next.
To make sure a restore from backup can never undo a removal or block, we keep a short record of it (which accounts, and when) for up to 30 days.
Screenshot alerts: in the album’s activity until the album is deleted.
Notification addresses: until you sign out on that device, delete your account, or remove the app.
Purchases: a record of each purchase is kept for refunds, tax and accounting, even after its album is deleted. Apple and Stripe keep their own records.
Messages to support: in our support inbox until we delete them; we delete yours if you ask. Our email provider keeps its copy for 30 days, plus up to 7 days in its backups.
Reports sent from kinalbum.com/report: what you type there (the reason you picked, any link or id, your email address if you give one, and your words) goes to our support inbox, delivered by Resend. We don’t record your internet address or browser with it, and it isn’t stored in our database. It stays in the support inbox until we delete it.
Email-only relatives: your address while you’re on an album’s email list. If you delete it, only the fingerprint described under “If a family sends you photos by email” stays, so the album can’t quietly add you back.
Waitlist: your address until you ask us to delete it. Signup-attempt counts: up to 3 days.
Error and crash reports: website error reports, up to 90 days at our error-monitoring provider. Crash reports from the iPhone app carry no name or account, and we keep them while they help us fix problems.
Notices about albums without a subscription: kept after the album is deleted, as proof the notice was given. They hold no photo, caption, name or email address.
Backups: copies of our database rotate out within 14 days (copies made every 4 hours are kept 8 days); copies of photo and video files within 30 days.
If the law requires us to keep something longer, for example for a legal claim, we keep it only as long as required.

Your content stays as long as your album does. If your subscription lapses, your albums move to the free plan — nothing is deleted for two years. After that, an album without a subscription is deleted if its owner’s albums without one hold more than the free plan’s storage, or if no member has opened it for two years, always after 90 days’ notice by email to its admins and in the app, with a free export (the Terms of Service give the details). To apply that rule we keep, for each album, the day a member last opened it and the day its subscription stopped, and a record of each notice we sent, which we keep after the album is deleted as proof the notice was given (it holds no photo, caption, name or email address); the album itself is purged like any other deleted album. A record of each gift-time purchase is kept after its album is deleted, so the person who bought it can still see it — with any unused whole months. For gift time bought in the iPhone app, they can ask Apple to refund those on Apple’s refund page; for gift time bought on the website, we refund them to the card ourselves, if the purchase is still inside Stripe’s refund window. If that person closes their account, the record no longer says who bought it. Deleting your account, or an album you own (both are in Settings), starts a 30-day grace window during which you can change your mind. When it ends, a deleted album is permanently purged from our live systems, with every photo, video, caption and comment in it, unless the law requires us to keep something for longer. A deleted account’s sign-in, name, email address or phone number, and the comments and hearts it left are purged, and so is any album only that person was in. Photos and videos it posted to an album other people are still in stay with that album, with everyone’s comments and hearts, credited to “a former member” — anyone can delete a memory they posted before closing their account. Where an album’s invitations or activity still show that account’s address or number, it is replaced with “a deleted account”. Old profile pictures — ones that were replaced, or whose profile, album or account was deleted — are left in our storage only as scrambled files no one can open, including us: the key that unlocked each one is deleted. Residual copies in our encrypted database backups rotate out within 14 days. Deleted photos and videos are removed from our backups within 30 days. Album admins can export a complete archive at any time, from the iPhone app or on kinalbum.com. On kinalbum.com the copy is decrypted in your web browser: our servers send it only the encrypted files, as they do to the app. Anyone else can ask their album’s admin for a copy, or write to privacy@kinalbum.com for the personal information we hold about them.

If a family sends you photos by email

A family admin can add you as an email recipient: new photos arrive in your inbox, and you never need an account. Once an album is a few months old you may also get an occasional “one year ago” note naming a moment from that week — no photograph, just the caption and who shared it, with a link to the album. A family admin can switch those off for the whole album. For that to work we hold your email address, the name the admin typed for you, and when we last sent you each kind of email — nothing else, and never a password, because you don’t have one. The photos in those emails are preview-size copies; the originals stay in the family’s end-to-end encrypted album. Every email has an unsubscribe link. One press stops every email from that album straight away, and the person who added you can see that you opted out. On the same page you can then delete your address from that album’s email list yourself: we erase your email address and the name the admin typed for you from that list, and it shows only “Address deleted”. Any invitation from that album to that address that you hadn’t accepted yet is withdrawn too. To stop the album quietly adding you back, we keep a fingerprint of your address — made with a secret key that is created inside our database and never leaves it, except inside our encrypted backups of that database — and the date you deleted it. The fingerprint is not your address. Because we hold its key, we could check whether a given address matches it, and that check is its only use: if an admin types your address into that album again, the app tells them you asked to be removed and adds you back only if they confirm you asked. If you mark our mail as spam, we stop permanently — even after you delete your address. Copies in our encrypted database backups rotate out within 14 days, and our email provider’s records of emails already sent to you follow its own retention.

If you joined the waitlist

Before the app was in the App Store you could leave an email address to be told when it launched. We hold that address, the date you gave it, and a short label saying which page it came from — nothing else, and no account, because you don’t have one. It is used for exactly one message: that Kin Album is live. It is not a newsletter, we never sell or rent the list, and it is not connected to any album. If you’d also like news about Kin Album after that, we’ll ask you, and you’ll get it only if you say yes. Nothing about the waitlist is shared with anyone. We don’t tell any advertising platform that you signed up or how you found us, even if you arrived by clicking an advertisement, and no advertising company’s code runs on this website or sets a cookie for it. To stop the form being flooded, we count signup attempts for each email address, and for each internet address they come from, for an hour. The count is stored under a scrambled value made with the day’s random key described under “Technical basics” above — once that key is deleted, and has rotated out of our encrypted database backups within 14 days, no one, including us, can tell which address a count belonged to — and the count itself is deleted within three days. Write to privacy@kinalbum.com and we will delete your address the same way we would delete an account.

If you’re in the UK, the European Economic Area or Switzerland, or we can’t tell where you are, we email you a link to confirm your address, and you join the list only when you use it. While we wait, we keep your address, the same short label and a scrambled form of the link’s code, for up to 7 days; the link works once. If you don’t confirm, all of it is deleted within a day after the link expires. To stop that form sending you too many emails, we count confirmation requests for each address for a day, stored the same scrambled way as the signup count above. To decide whether this applies, our website uses the country your internet address points to, as our hosting provider tells us for each request. We don’t store it.

Do Not Track and Global Privacy Control

No advertising or analytics company’s code runs on our website, and no other company collects information there about what you do across other sites. The one outside company whose code does run in your browser there is Sentry, our error-monitoring provider: it can send us a report when something breaks, a note of whether each page opened without an error, and page-load timings for a small sample of visits — with personal identifiers turned off, and only so we can find and fix problems. Our website makes no report to any advertising platform. If your browser sends a Global Privacy Control signal, we treat it as a request not to share. We don’t otherwise change anything in response to “Do Not Track” signals, because our website does no cross-site tracking for them to switch off.

Children

Kin Album accounts are for adults 18 and over. When we ask you to confirm you’re 18 or older (on iPhones that offer it, we ask Apple), we keep only that yes and when it was given, never your age or age range. We do not knowingly collect personal information from children; photos and profile details about children are provided by their own parents or guardians, who control exactly who can see them and can delete them at any time. If you believe someone under 18 has an account, contact us and we will remove it.

How to see, export or delete your data

To get a copy of your album, an album admin can save one at any time: in the iPhone app, go to Settings → Export; on kinalbum.com, go to Settings → Save a copy of your album. If you’re not an admin, ask one. To close your account, go to Settings → Account in the app (on kinalbum.com, Settings → Your account), or to kinalbum.com/delete-account. For anything else, such as a copy of the personal information we hold about you, a correction, or a question about how we use it, write to privacy@kinalbum.com. You don’t need an account to write to us.

Your rights

Regardless of where you live, you can access, correct, or delete your information with the tools built into Settings, album admins can export their album from Settings in the iPhone app or on kinalbum.com, and we honor the same rights by email at privacy@kinalbum.com, including a copy of the personal information we hold about you. Residents of California, the EU/EEA, and similar jurisdictions may have additional statutory rights; we apply the built-in controls above to everyone rather than gating them by geography. If you’re in the UK or the EU, the next section explains how these rights apply to you.

If you’re in the UK or the EU

Kin Album is for families in the United States, but a relative in the UK or the EU may be invited to an album or added to its emails. If you are in the UK, the EU or the European Economic Area, this section applies to you.

Who is responsible. Cobblestone, LLC, 8735 Dunwoody Pl, Ste N, Atlanta, GA 30350-2995, USA, is responsible for your information. We have no office in the UK or the EU. To reach us about your information, write to privacy@kinalbum.com or to that address. We answer within one month.

Why we may use your information.

Running your account and album, delivering invitations, notifications and members’ album emails, and taking payments: because it is needed to provide the service you asked for (our contract with you).
Sending album emails to a relative a family member added, who has no account: our legitimate interest, and the family’s, in sharing their photos with relatives. Every email has a one-click unsubscribe.
Keeping Kin Album secure, preventing abuse, handling reports and blocks, keeping backups, and finding and fixing problems: our legitimate interest in a safe service that works.
Counting how Kin Album is used, as described under “Feature usage”: our legitimate interest in improving it.
Joining the waitlist: your consent, which you confirm by using the link we email you (UK, EEA and Swiss visitors).
Sending the waitlist launch message, and sending news about Kin Album: only with your consent, which you can withdraw at any time. Withdrawing it doesn’t affect what was done before.
Keeping records the law requires, such as tax records, and answering lawful requests: to meet a legal obligation.

Your rights. You can ask for a copy of your information, ask us to correct it or delete it, ask for it in a form you can take elsewhere, ask us to limit how we use it, and object to uses based on our legitimate interests. You can withdraw consent at any time. Most of this is built into Settings; for the rest, write to privacy@kinalbum.com. We don’t make decisions about you by automated means that have legal or similarly significant effects.

Complaints. If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the Information Commissioner’s Office in the UK, or to the data-protection authority where you live or work in the EU.

Transfers. Your information is stored in North America and handled by providers mainly in the United States. “Where your information is stored” explains how those transfers are protected.

Security

End-to-end encryption is the core of Kin Album’s design: what we store of your full-quality photos and videos is encrypted, and only your family’s devices can open it. The one exception is the email preview copies described under “What we can and cannot see”: in an album that uses them, the preview-size copies of photos posted in about the last 30 days are stored without end-to-end encryption. Account details, captions, and comments are not end-to-end encrypted (see “What we can and cannot see”); they are protected by industry-standard encryption in transit and at rest. If an incident affects your personal information, we will notify affected families by email promptly — within any legally required deadline, and no later than 30 days after we confirm it — with what happened and what we did.

If Kin Album changes hands

We don’t sell personal information. Apart from our service providers and the legal and safety reasons described above, we will transfer it to another company only as part of a transfer of Kin Album itself: a merger, an acquisition, a sale of the service, or a bankruptcy. Any company that takes over must agree to honor this policy, including “Our promises”, for the information we already hold, and may not use that information in a materially different way unless it first asks you and you agree. Full-quality photos and videos stay encrypted with keys held on your family’s devices, so a company that took over could no more open them than we can. The exceptions are the two described under “What we can and cannot see” — the small preview copies made while an album sends photos in emails, and an invitation emailed from the iPhone app, whose link carries the album’s secret through our servers until the invitation ends — and a company that took over would hold those under this policy, as we do. If Kin Album shuts down instead, we delete what remains after the shutdown date, unless the law requires us to keep something for longer: it is purged from our live systems, and copies in our encrypted database backups rotate out within 14 days.

Changes to this policy

This policy is effective from the date at the top of this page. When we change it, we update that date, and we keep every earlier version.

If a change is material, we also tell you in the Kin Album app before it applies, with a short note saying what changed. A change is material if it changes what we collect, how we use or share information, or what we can see, or if it takes away a choice or protection you have. If it takes something away, the note comes at least 30 days before the change applies. If a change affects people who receive album emails without an account, the next album email they receive will say so.

Some updates are routine and apply when we post them: adding or replacing a provider within a category listed under “Service providers”, adding another daily count that names no one, clearer wording, or describing a new feature that works within what this policy already says. Switching on something this policy already describes is not a change to the policy. Changing anything under “Our promises” always needs your agreement first.

We will not use information we have already collected in a materially different way from what this policy said when we collected it, unless we first ask you and you agree. If you don’t agree, that information stays under the policy it was collected under.

A change applies only from the day it applies. If you don’t want to continue under a change, you can stop using Kin Album and delete your account before it applies; if you are an album admin, export your album first. Apart from the ask-first promise above, continuing to use Kin Album once a change applies means you accept it. No change to this policy deletes photos or videos without first giving your album’s admins a chance to download them.

Contact

Questions: support@kinalbum.com. Requests about your information: privacy@kinalbum.com. Or by mail: Cobblestone, LLC, 8735 Dunwoody Pl, Ste N, Atlanta, GA 30350-2995.