Kunna legal
Last updated: June 27, 2026
Version: 2026-06-27
This Privacy Policy explains how John Restrepo, operating as Kunna ("we," "us," or "our") collects, uses, discloses, and protects personal information for Kindo, a family management application. This policy applies to Kindo mobile applications (iOS and Android), web portals, and related support channels.
Depending on the features you use in Kindo, we collect: (a) Identifiers (such as name, email, phone number, and account user ID); (b) Commercial Information (subscription status, purchase history, and RevenueCat identifiers; please note that credit card information is processed directly by the Apple App Store or Google Play Store, and we never receive or store your raw payment card details); (c) User Content (tasks, calendar items, shopping lists, budgets, documents, and uploaded files including photos, receipts, or attachments); (d) Device & Network Data (IP address, operating system, device identifiers, and crash logs); (e) Sensory Data (photos, videos, or audio files you choose to upload); and (f) Geolocation Data (precise coordinates, if you explicitly enable location sharing for family map features).
We share data with core subprocessors to provide the Service: (a) Supabase (hosting, PostgreSQL database, file storage, and serverless edge functions); (b) Firebase Authentication (secure sign-in and user authentication); (c) RevenueCat (in-app subscription status validation and payment processing coordination); (d) Sentry and Firebase Crashlytics (error monitoring and crash diagnostics); and (e) OpenAI, Anthropic, Google (Gemini), or Cloudflare (AI-powered assistance and content suggestions).
When you use Kindo's optional AI features, relevant User Content (such as task descriptions or note text) is processed by our AI providers (OpenAI, Anthropic, Google Gemini, or Cloudflare) via API to generate suggestions or categorizations. This data is transmitted securely and is processed under strict enterprise API terms which prohibit the provider from using your data to train their public foundation models. We do not use your personal data to train any AI models. Where applicable, processing may also occur locally on your device (on-device AI processing).
Under the General Data Protection Regulation (GDPR), we process your data under the following lawful bases: (a) Performance of a Contract: to set up your account, sync household data, process subscriptions, and provide core Kindo features; (b) Legitimate Interests: to monitor security, detect fraud or abuse, analyze performance, and troubleshoot bugs; (c) Consent: to access optional device permissions (like photo library or GPS) and send newsletters; and (d) Legal Obligation: to comply with applicable tax, financial, or regulatory requirements.
Kindo requests access to certain device features only when you initiate actions that require them: (a) Camera/Photo Library: to upload family photos, receipts, or attachments; (b) Location Services: to share locations with household members on the map; (c) Contacts: to invite family members to your household; and (d) Microphone: to record audio attachments. You can enable or disable these permissions at any time via your device’s system settings, but disabling them may make related features unavailable.
Kindo uses local storage and caching on your device to keep you logged in and ensure fast access to your data. We do not use advertising cookies or cross-site tracking. We may use privacy-compliant product analytics tools (such as basic in-app telemetry) to monitor feature usage, which does not share your personal information with ad brokers.
We send push notifications to alert you to household updates, shared task modifications, and family events. If you opt in to receive marketing communications or newsletters from us, you can opt out at any time by clicking the "unsubscribe" link at the bottom of any email we send, or by contacting us at [email protected]. You can also customize or disable push notifications directly via your device's system settings.
John Restrepo (operating as Kunna) is headquartered in Canada. Your personal data is stored and processed on secure cloud servers hosted in the United States by Supabase and Firebase. To protect data transferred from the European Economic Area (EEA), United Kingdom, or Canada to other jurisdictions, we ensure standard contractual clauses (SCCs) or other legally recognized transfer mechanisms are in place with our processors.
We retain your personal data and User Content only for as long as your account remains active or as required to fulfill the purposes outlined in this policy. Inactive accounts and associated data are deleted after two years of complete inactivity. Database backups are kept for up to 30 days in encrypted storage for disaster recovery before being permanently overwritten.
You can delete your account and all associated household data at any time through the in-app Account Settings screen, or by emailing a request to [email protected]. Upon deletion, your active profile, credentials, and uploaded User Content are immediately marked for deletion and removed from active production databases within 7 days. Backups are fully purged within 30 days in line with our standard backup lifecycle.
Kindo is designed for households, but is not intended for children under the age of 13 (or 16 in certain EEA countries) without explicit, verifiable parental consent. We do not knowingly collect personal data from children under these ages. If we discover we have inadvertently collected data from a child without proper parental consent, we will delete it immediately.
We implement industry-standard technical and organizational security controls to protect your data, including: (a) Encryption in Transit: using TLS 1.3/HTTPS for all communications; (b) Encryption at Rest: AES-256 encryption for databases, stored attachments, and backups; (c) Database Row-Level Security (RLS) to prevent unauthorized cross-household data access; (d) strict developer access control and key management; and (e) routine vulnerability scanning.
In the event of a security breach that compromises your personal data and poses a high risk to your rights and freedoms, we will notify you and the relevant regulatory authorities (such as the Office of the Privacy Commissioner of Canada or European supervisory authorities) in accordance with applicable laws. Where required by GDPR, we will notify regulatory bodies within 72 hours of becoming aware of the breach.
If you reside in the EEA or UK, you have the following rights: (a) Right of Access: to receive a copy of your personal data; (b) Right to Rectification: to correct inaccurate data; (c) Right to Erasure: to request deletion of your data; (d) Right to Portability: to export your data in a structured, machine-readable format; (e) Right to Restrict Processing; and (f) Right to Object to processing based on legitimate interests. You also have the right to lodge a complaint with your local supervisory authority.
If you are located in Canada, we process your personal data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to access the personal information we hold about you, request corrections to any inaccuracies, and contact our Privacy Officer to challenge our compliance with PIPEDA principles.
If you are a California resident, you have rights under the CCPA/CPRA. John Restrepo (operating as Kunna) does not sell your personal information, nor do we "share" it for cross-context behavioral advertising. You have the right to know what personal data we collect, request deletion, request correction, and opt out of any future selling or sharing. We will not discriminate against you for exercising your privacy rights.
To submit a Data Subject Access Request (DSAR) or exercise any of your privacy rights, please email us at [email protected]. To ensure the security of your household's data, we must verify your identity (which may require you to confirm the request from your registered account email) before we can process or disclose any records. We will respond within 30 days of receiving your request.
We may modify this Privacy Policy from time to time to reflect changes in our data practices, features, or legal obligations. We will indicate the date of the latest update at the top of this page. If we make material changes, we will notify you through the app interface or via email.
For any privacy inquiries, requests, or questions regarding this Privacy Policy, please contact our Privacy Officer at [email protected].
Contact: [email protected]