Kin Album
Security
Last updated November 3, 2026
How your photos are protected
Photos and videos are end-to-end encrypted for everyone who uses Kin Album, in the app or on the website. They are encrypted on your iPhone before they are uploaded. Each file gets its own encryption key; that key is wrapped under your family’s album key, and the album key is only ever granted to your family members’ devices — sealed to keys held on their iPhones, on their Android phones, and in the web browsers they use to open the album. Our servers store ciphertext and wrapped keys. We cannot decrypt your photos or videos. Two things below work differently: the optional email photo previews, and invitations sent by email. One limit applies to all of this: the first time a new phone opens an album, it trusts what our servers show it about the album key until someone in the family compares security codes with that phone, so until then a dishonest server could in principle hand that phone a key of its own.
A few things sit outside that encryption so the product can work, and we say so plainly:
- Captions, comments, and names are stored readably.
- Optional: email photos for relatives who don’t use the app. An album admin can choose to send photos in emails, so a relative who only has email can see them. It is on by default for a relative who only has email. While anyone in an album gets photos in their emails, a preview-size copy of every photo posted to that album, by every member, is made outside the encryption and stored with us, beside the encrypted originals, so the emails can show the photos. Each preview copy is deleted about 30 days after its photo was posted, or within a day of photos in emails being turned off for everyone in the album.
- Invitations sent by email. An invitation emailed from the iPhone app carries, in its link, a secret made for that invitation, which unlocks a copy of the album key we store for it. The app hands that link to our server, which sends the email through our email provider, and our email provider keeps a copy of each email it sends for 30 days, and up to 7 days more in its backups. So until the invitation ends, we could in principle recover the album key. The link stops working 14 days after it is sent. We delete the stored copy of the album key the moment an invitation is withdrawn and within an hour of it expiring; once that copy has also rotated out of our encrypted database backups, within 14 days, the email provider’s copy of the link opens nothing.
- Push notifications never contain a photo, a caption, or the text of a comment.
Separately, a photo or video you choose to attach when you use Contact us in the iPhone app goes to our support team as it is — it isn’t end-to-end encrypted — with its location removed on your phone first.
The full design, including key rotation and what happens when someone is removed from an album, is documented and available to security researchers on request.
The encryption uses standard, well-studied primitives: Apple’s CryptoKit on the iPhone; Android’s built-in cryptography and Google’s open-source Tink library (for the key exchange) on Android; and the browser’s built-in Web Crypto on the web. On an Android phone, the phone’s own key is stored encrypted under a key kept in the Android Keystore, and is left out of the phone’s backups. We do not invent our own ciphers. Findings from good-faith security research are welcome below.
Reporting a vulnerability
If you believe you have found a security issue in Kin Album, email security@kinalbum.com. Include enough detail to reproduce the issue. We will acknowledge your report within 3 business days, keep you informed as we investigate, and credit you when a fix ships if you would like credit.
We will not pursue or support legal action against good-faith security research that respects our users: do not access other families’ data beyond what is needed to demonstrate the issue, do not degrade the service, and give us reasonable time to fix before public disclosure. Machine-readable details live at /.well-known/security.txt.