Privacy Policy

1. Information We Collect

• Account Information: When you create an account, we collect your name, email address, username, and optionally a profile photo.
• User Content: Photos, videos, and text you share through the Service, including kindness chain posts, Good Vibes posts, and journal entries.
• Location Data: We collect location data only when you explicitly allow it. Location is used to show the general area of kindness chain activity on a map. If you deny location permission, your experience is still shared but without a map pin. It is also used to show you nearby activity and challenges if you allow it.
• Device Information: Device type, operating system, app version, and a unique device identifier for push notifications.
• Usage Data: How you interact with the Service, including pages visited, features used, and actions taken.
• Payment Information: Payment processing is handled by Stripe. We do not store your credit card numbers or bank account details on our servers.

2. How We Use Your Information

• To create and manage your account
• To display kindness chain journeys on the map
• To send push notifications about chain activity and challenge updates
• To process purchases through the rewards shop
• To improve the Service through analytics
• To provide customer support
• To detect and prevent fraud or abuse
• To comply with legal obligations

3. Information Sharing

We do not sell your personal information. We share information only with the following service providers who help us operate the Service:

• Stripe: Payment processing
• Firebase: Push notifications, analytics, and crash reporting
• Cloudflare: Content delivery and media storage
• Sentry: Error tracking and monitoring
• Mapbox: Map services
• Resend: Transactional email delivery

These providers are contractually obligated to protect your information and may only use it to provide services to us.

4. Data Retention and Account Deletion

If you have a consumer account, you can delete it at any time from the app (Profile → Delete Account). Business and partner accounts are managed and deleted from the web dashboard rather than in the app. If you have lost access to your account and cannot delete it yourself, contact us at support@kindact.app and we will process your request.

When you delete your account, you are signed out immediately and your account is deactivated right away. We then erase your personal profile and content — including your profile details, posts, journal entries, photos and videos, your chat media and your chat profile and presence data, your follower and blocked lists, your cart and saved items, and your notification and device records. We replace your name with “Deleted User” and anonymize your username and public email so your erased profile and content can no longer be linked to you. We complete this erasure across our systems (including media in our cloud storage and video-delivery network) as soon as we reasonably can after deletion, typically within 30 days.

Kindness chains you started or joined, and messages you sent in one-to-one or group conversations, are not deleted, because they are shared with other participants. Your entries and messages there remain in those other participants' views but with your identity removed (shown as “Anonymous User”).

Some records are kept after you delete your account, only where the law permits or requires it, and limited to what is necessary for each purpose. These retained records are reduced but not anonymous — we can still link them to you where the law requires us to keep them, so they remain your personal data and continue to be protected under this policy and applicable data-protection law. Before retaining any of these records we remove the details that are not needed for the stated purpose — for example, where a record originally included an identity-verification selfie, precise location data, or the raw data from our payment processor, we delete those fields and keep only the minimum needed. What we keep:

• Transaction, order, and billing records — including your own reward redemptions, the redemptions other people made at challenges you created, partner invoices, and billing-dispute records. We keep these to meet our tax and accounting obligations and to handle refunds, chargebacks, and disputes, for as long as applicable tax and accounting law requires (generally up to 7 years after the end of the financial year in which the transaction occurred, or longer where the law requires).
• A limited fraud-prevention record derived from your email address and your social-login identifier, kept to stop abuse of one-time rewards by people who repeatedly delete and re-create accounts, for up to 6 years, after which it is deleted. As part of this same measure, for 6 months after you delete your account the email address from the closed account cannot be used to open a new account.
• Your payment-processor (Stripe) customer record, which remains with Stripe under its own privacy policy and retention schedule (see stripe.com/privacy); on our side we keep only the Stripe customer reference needed to reconcile your past transactions, for the financial-record period described above.

We keep this information only for as long as these purposes require, and we delete it when the purpose has been met or the retention period ends. For users in the EEA/UK, we rely on the erasure exceptions in Article 17(3) of the GDPR — in particular compliance with a legal obligation (such as tax and accounting law) and the establishment, exercise, or defense of legal claims — and, for the fraud-prevention record, our legitimate interest in preventing reward abuse. You may object to the legitimate-interest processing on grounds relating to your particular situation (see Section 6).

5. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will promptly delete it. If you believe a child under 13 has provided us with personal information, please contact us at support@kindact.app.

6. Your Rights

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and personal data
• Export your data in a portable format
• Opt-out of non-essential communications

To exercise any of these rights, contact us at support@kindact.app.

Your right to deletion is subject to the limited legal, accounting, and fraud-prevention retention described in Section 4. For users in the EEA/UK, we rely on the erasure exceptions in Article 17(3) of the GDPR for those retained records, and where we keep data on the basis of legitimate interests (such as the fraud-prevention record) you have the right to object on grounds relating to your particular situation. If you are in the EEA/UK, you also have the right to lodge a complaint with your local data-protection supervisory authority — but please contact us first at support@kindact.app so we can try to resolve your concern.

7. Cookies

Our website (kindact.app) uses essential cookies for authentication and session management. We do not use tracking cookies or third-party advertising cookies. The mobile app does not use cookies.

8. Security

We implement industry-standard security measures to protect your information, including encrypted data transmission (HTTPS/TLS), encrypted storage for sensitive data, and access controls. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect and how it is used
• The right to request deletion of your personal information
• The right to opt out of the sale of personal information (we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

To exercise your CCPA rights, contact us at support@kindact.app.

Your deletion request is subject to the exceptions permitted under the CCPA/CPRA (Cal. Civ. Code §1798.105(d)) — including completing the transactions and orders for which we collected the information, complying with our legal obligations (such as tax and accounting recordkeeping), and detecting and protecting against security incidents and fraudulent, deceptive, or illegal activity — as described in Section 4.

10. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States. By using the Service, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service or by other reasonable means. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at: support@kindact.app

Kind Act LLC
Website: kindact.app