Privacy

What we collect

• Your account: your email, your name, a one-way hash of your password, and, if you sign in with Google or GitHub, the id they give your account.
• Your connections: the service's address, the connection's label, the account name the service reports when you connect (or one you typed), and its key or sign-in tokens, which are encrypted.
• The tool descriptions your connected services publish.
• Your permissions: what you set to Allow, Ask me or Block.
• Activity: for each call to run an action, which AI app, which connection and action, the outcome, the time and how long it took. Not the arguments, not the results, and not what was searched for. For each change, and each request that waits for your approval, a one-way hash of its arguments, so it does not run twice.
• The arguments of an action set to Ask me, encrypted, while it waits for your decision.
• The full version of a trimmed result, encrypted, for a short time.
• The result of an approved request, encrypted, for up to one hour after it runs.
• If you pay: Stripe's customer and subscription ids, the price you chose, the subscription status, when the current period ends, when a payment started failing and when we emailed you that your free trial was about to end. Never card numbers.
• Request logs: the method, path, status, timing and network address of each request. Google Cloud's own record of each request also has the full address, your browser's user agent and the page that linked to it.

The arguments and results of actions pass through our server on the way between your AI app and the service. They are not stored, apart from the encrypted approval and result cases above.

A public custom server you connect is listed in Explore, by its host name and public tool descriptions and without naming you or including account data, only if you or an AI app you connect shares it. Keep this private starts ticked when you add one, and Never list your connections in the directory, in settings, keeps all of yours out.

Google user data

When you connect a Google service (Gmail, Google Calendar, Google Drive, Google Drive (files you pick), Google Docs, Google Sheets, Google Contacts or Google Tasks), Kin asks Google only for the access that service's actions need, and only when you add it.

What we access. Gmail: your messages, drafts and labels. Google Calendar: your calendars, events, and free and busy times. Google Drive: your files' names, details, sharing and text, read only, and the folders and shared files Kin creates. Google Drive (files you pick): only the files you pick in Google's file picker and the files your AI apps create through it, with their names, details and text, and the folders and files Kin creates; never the rest of your Drive. Google Docs and Google Sheets: the documents and spreadsheets you or your AI app name. Google Contacts: your contacts, read only. Google Tasks: your task lists and tasks. From every Google connection: the account's email address and Google's id for it.

How we use it. Only to run an action that an AI app you connected asks for, when your permissions for that connection allow it, and to return the result to that AI app. Changes ask you first unless you choose otherwise.

Google's file picker. When you choose Add files on a Google Drive (files you pick) connection, your browser loads Google's sign-in and file picker from Google, and Google shows you your Drive in its own window. Your browser gets a short-lived Google token that can reach only the files you pick. It stays in your browser and is never sent to Kin. Google then lets that connection open the files you picked, and Kin lists them on the connection's page. Nothing from Google's file picker loads until you choose Add files.

What we store. The account's email address and Google's id for it, and the access and refresh tokens Google issues, encrypted. Content normally passes through without being retained. Three exceptions are kept encrypted: the full version of a trimmed result, with access expiring after ten minutes; the arguments of an action waiting for approval, cleared when you decide or with access expiring after one hour; and the result of an approved action, with access expiring one hour after the action ends. Expired copies are cleared by periodic cleanup. Backup copies are separate, as described under How long we keep it.

Who receives it. Only the AI app you connected that ran the action. What that app does with the result is governed by its own terms and settings. We do not sell Google user data, use it for advertising, or use it to create, train or improve any AI or machine learning model. Kin itself does not run it through an AI model. People at Kin do not read it unless you explicitly agree that we may view specific data for support, it is needed to investigate abuse or keep the service secure, or the law requires it.

How to remove it. Remove the connection in Kin. That deletes its tokens at once, and when no other Kin connection uses the same Google account, it also revokes Kin's access at Google. You can remove Kin's access yourself at any time at https://myaccount.google.com/connections.

Kin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Its use of information received from Google Workspace APIs also adheres to the Google Workspace API User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy).

Why we collect it

To run the service, to bill for it, and to keep it secure.

We do not sell your data, use it to train models, or run it through an AI model.

Who else handles it

• The AI apps you connect, which receive the results of the actions they run.
• Google Cloud, for hosting.
• Stripe, for payments.
• Resend, for account email such as password reset links and the reminder before a free trial ends.
• Cloudflare, for DNS.
• PostHog, in the United States, for product analytics.
• Google and GitHub, if you sign in with one of them. We receive your email address, your name and the id of your account there.
• Intercom, for support chat when you open it. If you are signed in, Intercom also receives your email address and account id, so we know who is writing.
• Endorsely, to credit the partner who referred you, only if you arrived through a partner's link.
• Google, for its sign-in window and file picker when you choose Add files on a Google Drive (files you pick) connection.

How long we keep it

• The arguments of an action set to Ask me are deleted when you decline it or once it has run. If nobody answers, they can no longer be used after one hour, and a cleanup that runs every minute while Kin is running deletes them.
• The full version of a trimmed result can be read for ten minutes, then the same cleanup deletes it.
• The result of an approved request can be read for one hour after the action ends, then the same cleanup deletes it.
• Google keeps request logs for 30 days.
• Removing a connection deletes its credential.
• Deleting your account removes the account and workspaces you own from our live database. The benefit and audit records described below remain. Backup copies are separate and are not erased immediately by account deletion. Stripe, PostHog and Intercom keep what they already hold, as What Kin holds describes.

Kin keeps creator-benefit and partner commission reconciliation records, and the audit history of complimentary Pro grants, after an account or workspace is deleted. These records can identify creators, customers they referred, and people who received complimentary Pro. They can include account and workspace IDs, partner IDs and codes, a hash of a creator's email address, payment references, amounts and dates, and operator details and notes. These records currently have no automatic deletion period.

Product analytics

We use PostHog, hosted in the United States, to see how people find and use Kin, such as how many visitors sign up and how many go on to connect a tool, and to find and fix errors.

For every visitor, without asking, we send the pages you open (with ids removed, and nothing after a "?" except the campaign tags of a link we shared, such as utm_source=newsletter), the site that referred you, your browser, operating system and device type, and a few milestones: seeing our prices, which part of a page a sign-up button you click is in, starting to sign up and with which plan, signing up and how, a sign-up that did not go through (only a reason from our list, such as "email already used"), connecting a service or failing to (only which one from our directory, or "custom", and a reason from our list), an AI app connecting for the first time and which kind of app it is (only from our list, such as ChatGPT, Claude or Cursor, or "other"), a workspace finishing setup (its first working connection together with a connected AI app), the outcome of the first action an AI app runs, an AI app's action succeeding (at most once a day), the first read and the first change an AI app runs successfully (and whether a change ran after you approved it), an AI app's action succeeding again seven days or more after the first one, deciding a request, creating a profile, reaching a plan limit, choosing to upgrade, starting checkout, subscription changes and deleting an account. When you sign up, the campaign tags and referring site you arrived with are sent with it (through a Google or GitHub sign-in they ride in its short-lived sign-in cookie), so we can tell which links bring people who sign up. These basics use no cookies and nothing stored in your browser.

We also send error reports, from your browser and from our server: the kind of error, where in our code it happened, and its message with addresses, quoted text, email addresses, long numbers and anything that looks like a token removed. Error reports leave out what you typed, the contents of requests, the details of actions and their results.

Milestones and errors are counted per workspace too. A workspace is known to PostHog by an internal number with only its plan, the month it was created and roughly how many connections it has.

If you have an account, all of this is linked to an internal account number, never to your email address or name. Apart from what you write in feedback or a survey answer, we never send PostHog your email, name, password or tokens, the names or addresses of your connections or profiles, the names of your AI apps (only which kind each is, from our list), what your AI apps search for, the details of any action, or any result. Events from your browser pass through our own server, which keeps only the items above and does not forward your IP address.

Three more things run only if you choose Allow for the current notice and recording scope, wherever you are: session recordings, short surveys, and an id kept in your browser so tests of new designs stay consistent. A survey asks one question at a time, and we receive your answer. Choosing No thanks, or leaving the question unanswered, keeps these three off. Basic page counts, milestones and scrubbed error reports described above do not depend on Allow.

What a recording can show. Movement, clicks and timing on our public pages (such as the home page, pricing, sign in and sign up, and these policy pages) and the setup steps that show none of your connected data (your first visit, your list of connections, connecting an AI app). Every word on the page and everything you type is hidden in the recording before it leaves your browser. Audio, video, canvases and embedded pages are blocked. A recording can still show the size and position of blocked areas and masked text lengths.

What is never recorded. We never record pages that can show what your connected services hold, such as approvals, activity, Try it, a connection's own page, computers, Explore or settings, or pages where you choose a new password, pair a device, finish a sign-in handoff or administer Kin. A page without an explicit recording rule is excluded too. Recordings never include data from Google or any other connected service. The browser stops recording when you leave an allowed page, and our server independently checks the route and removes sensitive content before forwarding a recording to PostHog.

Your versioned choice. This notice is 2026-10-16.1; its recording scope is public-setup-v1. When you answer, we remember only your choice, those two versions, and the time you chose, in this browser's consent receipt. The receipt is signed by our server; it does not include your name, email, account number or the pages you visited. It records an analytics choice, not permission to access a connected account or run an action. Allow lasts for up to 180 days. An expired, earlier or unversioned Allow does not authorize this scope: optional analytics stays off until you choose Allow for the current version. An earlier No thanks stays off.

If you choose No thanks, none of these three runs and we do not ask again automatically. You can change your answer at any time under Privacy choices at the bottom of our public pages, or in settings. Turning them off stops optional analytics in this browser, removes the optional analytics id kept here, and reloads the page. It does not delete recordings or other analytics already received by PostHog. Your choice does not change the choice in another browser. If your browser sends Do Not Track or Global Privacy Control, it sends nothing to PostHog, and we do not ask. Our server only adds one to an hourly count of visits to our public pages, sign-ups started and sign-ups, split by the campaign tag or referring site you arrived with. Those counts hold no id, network address or browser details, stay on our server, and are never sent to PostHog. Milestones our server records for your account, errors on our server, and feedback you choose to send are still sent, without the campaign tags or referring site.

Feedback. Send feedback in the app sends only what you choose to send, when you choose Send: the topic you pick, your message, the page you sent it from, and, only if you allowed session recordings and that page was being recorded, a link to its masked recording. Before your message leaves our server, we remove email addresses, tokens, keys, long numbers, network addresses and anything after a "?" in a web address, and we hide text that looks pasted rather than written, such as quoted results, code, and data in braces or brackets. Our server sends it to PostHog under your internal account number. Since you choose to send it and it does not track you, it works the same whether or not your browser sends Do Not Track or Global Privacy Control. We keep feedback in PostHog to improve Kin. To have yours deleted, write to privacy@kinlab.ai.

Cookies

We set the cookies Kin needs to work: the sign-in session cookie, short-lived cookies that keep a sign-in with Google, GitHub or a connected service secure while it is under way, and a signed privacy-choice cookie that remembers your optional analytics answer for up to 180 days. That choice cookie holds only your answer, the notice and scope versions, and the time you chose; it is not an analytics id. The app also keeps a few settings in your browser's storage, including your privacy choice. Basic analytics and PostHog set no analytics cookies. If you allow session recordings, surveys and experiments, PostHog's id for you is kept in your browser's storage until you turn them off. There are no advertising trackers, apart from the partner referral cookie described below. If you open the support chat, Intercom sets its own cookies to keep that conversation going, and while the chat is open it sees the address of each page you visit here. Nothing from Intercom loads until you open the chat. If you arrive through a partner's referral link, Kin checks the partner's code with Endorsely, our partner program service, and tells Endorsely about the referral so that partner is credited if you subscribe. Endorsely gets the partner's code from our server, not your address or anything from your browser. Kin remembers that partner in a cookie of its own for 60 days and keeps the partner with your workspace, so it still counts if you subscribe from another device. Nothing from Endorsely loads in your browser, and a browser that sends Do Not Track or Global Privacy Control is never credited to a partner. If you choose Add files on a Google Drive (files you pick) connection, Google's sign-in window and file picker use Google's own cookies, under Google's privacy policy. Nothing from Google loads here until you do.

Your privacy rights

The Free plan is available worldwide and paid plans only in the United States for now, so you may be using Kin from anywhere. Wherever you live, you can use the rights below. Kin Computing, Inc. answers every request.

Write to privacy@kinlab.ai for any of them, and for any other question about your data. We answer within 30 days. So that nobody else can get or change your data, we act on a request only when it comes from, or is confirmed from, the email address on your account.

• Find out what we hold. Your connections, permissions and activity are in the app. Write to us and we will tell you what else we hold about you.
• Get a copy. A download in the app is not built yet. Write to us and we will email you a copy of your account's data, leaving out password hashes, keys and sign-in tokens.
• Correct it. Write to us to correct your name, your email address or anything else we hold about you that is wrong.
• Delete it. In the app, open Usage and settings, choose Delete account, type your email to confirm, and choose Delete my account. That removes your account and workspaces you own from our live database, and ends paid subscriptions for those workspaces immediately. The benefit and audit records under How long we keep it remain. Backup copies are separate and are not erased immediately by account deletion, and other companies keep what they already hold, as that section describes. You can also ask us by email to delete your account. To remove a single connection, open it and choose Remove.
• Say no to optional analytics. Session recordings, surveys and an id kept in your browser run only if you choose Allow. Choose No thanks when we ask, or change your answer at any time under Privacy choices at the bottom of our public pages or under Privacy in Usage and settings. Turning them off stops them in that browser at once and deletes the id kept there. Your answer applies to the browser you give it in.
• Global Privacy Control and Do Not Track. We honor both. A browser that sends either sends nothing to PostHog, is never asked about analytics, and is never credited to a partner. Milestones our server records for your account, errors on our server, and feedback you choose to send are still sent, as Product analytics describes.
• Object to anything else. To object to any other use of your data, write to us. We will stop it where we can, or tell you why we cannot.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, meaning ads aimed at you based on what you do on other companies' sites and apps. The partner referral cookie described under Cookies is used only to credit the partner whose link you followed, not to show you ads.

Changes to this policy

When this policy changes, the new version will be posted on this page. A change to optional recording scope requires a new Allow before that scope can run. We keep this notice version and the previous privacy policy and optional analytics prompt available so you can review what a choice covered.