Privacy Policy

The short version

• Kyndred is run by KYNDREDSDK S.R.L. in Romania. We are the "controller" of your data.
• We keep what we need to make your characters work and keep the service safe: your account, your conversations and the memory a character builds from them, the characters you import, and payment and usage records.
• We do not sell your data and we do not use your conversations or imported characters to train AI models.
• Your account, conversations and characters are kept in the EU. Copies pass through our hosting, AI and voice providers, most of them in the United States, while a reply is generated, under EU-approved safeguards.
• You can see, correct, download and delete your data at any time. To delete everything, close your account in your settings or write to us.
• If you import a character, our Content Rules forbid characters that depict real people other than you, and you can ask us to remove a character that depicts you.

1. Who is responsible for your data

The controller of your personal data is KYNDREDSDK S.R.L., Tecuci, str. Furceni nr. 62, Galați County, Romania, Trade Register no. J2026034037001, CUI 54758064, VAT no. RO55328014 ("Kyndred", "we", "us").

For anything about your data, write to contact@getkyndred.com or use the form at getkyndred.com/contact. We keep the need for a data protection officer under review; the founders handle every privacy request personally.

2. What this policy covers

This policy applies to the Kyndred web app at getkyndred.com, the Kyndred desktop app, Kyndred on Telegram, and our mobile apps when we release them. It does not cover third-party websites we link to — for example the marketplaces where you can find character models — or the Telegram platform itself, which have their own privacy policies.

3. What we collect, why, and on what legal basis

Your account. E-mail address, sign-in provider identifier, your Telegram user ID and username if you link Kyndred on Telegram, display name, your date of birth, account settings, and account timestamps. To open an account you must give us an e-mail address and a date of birth; without them we cannot create it. Everything else is optional. If a sign-up attempt gives a date of birth under 18, we keep a flag on that device for 24 hours so that the same device cannot simply try again. Why: to create and secure your account, and to check that you are an adult. Basis: performing our contract with you; for the date of birth, our legitimate interest in keeping minors out of an adults-only service and in being able to show that we checked.

Your conversations and memory. What you type or say to a character, the character's replies, voice transcripts, the "memory" a character builds from your conversations (a profile of what matters to you, stored partly as numerical representations called embeddings), your character's emotional state, and safety flags our systems attach to a conversation — including signs of a crisis and signs that an account may belong to a minor. Why: so the character can respond, remember you across sessions and devices, and stay safe, and so that we can keep minors out. Basis: performing our contract with you, together with the explicit consent described in section 4; for safety review, our legitimate interest in a safe service and our legal obligations.

Voice mode. In voice mode your microphone audio is converted to text by our speech-to-text provider and the character's reply is turned into speech by our text-to-speech provider. Audio passes through in real time and is not stored by us; the transcript is kept with your conversation. We do not analyse your voice to detect emotions or to identify you. Characters read tone from the words, expressions and context of the conversation, not from the sound of your voice. Basis: performing our contract with you.

Custom Characters you create. The character model files you import (for example Live2D .model3.json packages, textures and motions), the name and anything you tell the character about who it is, the voice you choose from our library, the confirmations you give at import about your rights to the model, and the results of our safety checks on the file. Why: to store, render and animate your character for you, to check files for malware and prohibited content, to handle reports from rights holders, and to defend ourselves if a claim is made. Basis: performing our contract with you; our legal obligations under the EU Digital Services Act; our legitimate interest in a safe, lawful service and in defending claims. If a model you import contains someone else's data — a face, a voice, a creator's name — we store and process it only to run and safety-check your character and to handle any complaint about it. We also compare imported files against fingerprints (hashes) supplied by creators and rights holders, so that we can block models they have not allowed. We cannot notify creators or depicted people individually; this policy is our notice to them, and they can write to us at any time. Our Content Rules forbid characters that depict real people other than you. If you think a character on Kyndred depicts you, write to us with whatever you know about the account or character; we will look for it and remove it under our Content Rules.

Payments. When you subscribe, Stripe collects your name, e-mail, billing country, payment method and card details, and gives us a customer identifier, the last four digits of your card, your subscription status and payment history. We never receive or store full card numbers. Why: to charge you, issue invoices, prevent fraud and keep accounting records. Basis: performing our contract with you; our legal obligations under Romanian tax and accounting law. Stripe is also an independent controller for fraud prevention and anti-money-laundering purposes under its own privacy policy.

How you use Kyndred. Technical data from your device (device type, operating system, browser, language, screen size, app version), session and feature-usage events (for example session length, whether voice mode was used, which screens you visited), A/B test allocation, and error and crash reports, under a random analytics identifier. We do not attach your name or e-mail address to analytics, and we do not record your screen or keystrokes. Why: to fix bugs, understand what to improve and test changes. Basis: your consent — we ask in the cookie banner on the web and on first launch of the desktop app, and you can switch it off at any time in the settings. Separately, our servers keep short-lived technical logs (IP address, request times, errors) to keep the service running and detect abuse; we keep those apart from analytics and do not use them for anything else. Basis for logs: our legitimate interest in security and a working service.

E-mail and notifications. Transactional e-mails (sign-in links, receipts, renewal reminders, notices about your account) go to everyone. Your character may also send you messages between sessions, by e-mail or notification, which draw on your recent conversations; you can switch them off at any time in your settings. We send marketing e-mails only if you have agreed, and you can unsubscribe in one click in any e-mail. We record your consent state and, for marketing e-mails, whether they were opened. Basis: contract for transactional e-mail and for messages from your character, which you can switch off; your consent for marketing.

Advertising measurement. If you arrive at Kyndred from an ad on Meta (Facebook, Instagram) or Reddit, and you have accepted marketing cookies, we tell that platform that the ad led to a sign-up or subscription, using a hashed (scrambled) version of your e-mail and event data such as "trial started". This lets us measure our ads; it also lets the platform improve its ad delivery under its own terms. For this measurement Meta Platforms Ireland Ltd and we are joint controllers. In short: we decide whether the measurement runs and ask for your consent; Meta matches the hashed e-mail to Meta accounts, reports results to us and uses the data to improve its ad delivery under Meta's own privacy policy. You can exercise your rights against either of us — requests sent to us are handled by us, and Meta answers for its side. Meta's controller addendum, which sets this out in full, is at facebook.com/legal/controller_addendum. Reddit acts as an independent controller for its side under Reddit's privacy policy. Basis: your consent, which you can refuse or withdraw at any time in the cookie settings or on our Privacy Choices page without losing any part of the service.

Support and rights requests. What you write to us, and the checks we make to confirm your identity before acting on a request. Basis: our legal obligations and our legitimate interest in answering you.

Safety and moderation records. Reports and notices we receive, decisions we make (including whether a tool or a person made them), statements of reasons we send you, appeals, and copies of removed content kept as evidence. If you send a counter-notice under US copyright law, the law requires us to forward it — including your name and address — to the person who complained. Basis: our legal obligations under the EU Digital Services Act; our legitimate interest in handling copyright notices, enforcing our Terms and defending claims; where someone's life or safety is at risk, their vital interests.

We do not collect more than this, and we do not buy data about you from anyone.

4. Sensitive conversations — your explicit consent

A conversation with a character can reveal things about your health, sex life, sexuality, beliefs or origin. The law calls this special-category data, and we can process it only with your explicit consent. We ask for that consent in a separate tick-box before your first conversation, not in the Terms. It covers sending what you write and say, as you send it, to the AI and voice providers listed in section 7 (most of them in the United States) so that a reply can be produced; storing your conversations; letting a character remember what you tell it; and running our safety checks over what you write — including flags about self-harm, which a person on our team may review to check how the character responded. The tick-box says, in short: "To reply, Kyndred sends my messages and voice to its AI and voice providers, most of them in the United States, which may use them only to produce the reply. Conversations can reveal sensitive things about me, such as my health, sex life or beliefs; I agree that Kyndred stores my conversations, lets my character remember them, runs safety checks on them, and may use them, with my account details removed, to test and improve its safety filters and the service." You can withdraw this consent at any time in your settings or by writing to us; if you do, we stop, and you can delete your conversations and memories. Because a character cannot work without reading what you write, withdrawing consent means you can no longer chat; you keep your account and your Custom Characters, and you can end your subscription at the same time, in which case we refund the unused part. We never use these details for advertising, and we share them only with the providers that process the conversation for us (section 7).

5. Memory, profiling and automated decisions

A character's memory is a profile of you — the law calls this profiling — built for one purpose: so that the character can remember you. You can see, edit and delete what a character remembers in your settings, and ask us for a copy of it or for anything else.

Three automated systems can make decisions about you. The age gate refuses sign-up if the date of birth you give is under 18. Our safety classifiers can stop a conversation, block a message, or take a Custom Character offline until a person has looked at it. And if our systems detect signs that an account may belong to a minor, they suspend it and switch off romantic content until a person has reviewed it and the account holder has had 30 days to confirm their age (Terms, section 3). We need these to run an adults-only service safely. If an automated decision restricts your account or a Custom Character, you always receive our reasons and a way to appeal (see our Terms, section 7.8), a person reviews the decision when you ask, and you can tell us why you think it is wrong; if the decision is reversed, we restore what was lost and refund the subscription time you lost. We make no other decisions about you based solely on automated processing.

6. AI providers and training

Your conversations are generated by large language models and voice models run by specialist providers (section 7). Each provider receives only what it needs to generate the next reply or its audio, may not use it to train its own models, and keeps it only for the short period its contract with us allows. We do not use your conversations, memories or imported characters to train or fine-tune AI models. We may use conversations, with your account details removed, to test and improve our safety filters and the service, on our legitimate interest in a safe, working service and within the consent described in section 4; you can object at any time. We use the models you import only to run and safety-check your character and to handle complaints about it.

7. Who receives your data

Most of the companies below are processors working for us under a data-processing agreement, only for the purpose listed. Stripe, Meta, Reddit, Telegram, our sister company and the professionals in the last row are exceptions and are marked. Where a provider is outside the EEA, the safeguard for the transfer is shown.

We also share data when the law requires it: with courts, regulators or law-enforcement authorities on a request that is legally binding on us in Romania — we do not hand conversations to foreign authorities voluntarily — and, as the Digital Services Act requires, with the authorities where we become aware of a serious crime that threatens someone's life or safety. If Kyndred is ever sold or merged, your data would stay under this policy, and we would tell you as soon as we can.

We do not sell your personal data, and we do not run third-party advertising on Kyndred.

8. Where your data is kept

Your account, conversations, memory, Custom Characters and analytics are stored in the European Economic Area. Voice processing, AI generation and some infrastructure involve providers in the United States. Where a US provider is certified under the EU–US Data Privacy Framework (and its UK Extension) we rely on that; otherwise we rely on the European Commission's Standard Contractual Clauses with the UK Addendum, with additional measures where needed. The table in section 7 shows which applies to whom. You can ask us for a copy of the safeguards.

9. How long we keep it

• Account data, conversations, memory, Custom Characters: for as long as your account is active. Deleted within 30 days of you deleting them or closing your account, backups included. If we close your account, we keep your imported files for those 30 days so that you can ask for a copy (Terms, section 7.11), unless we removed them after a notice you did not successfully contest. We keep only what an open complaint, a legal claim or a legal duty requires, for as long as that lasts. Accounts with no active subscription that are unused for 24 months are closed after notice and deleted the same way.
• Safety-flagged conversations: where our systems flagged a conversation as a crisis or as a sign of a minor, we keep a sealed copy for three years after the rest is deleted, used solely to answer a complaint, investigation or legal claim.
• Import confirmations and safety-check results for Custom Characters: 12 months after the character is deleted, or longer for a claim.
• Date of birth and age-gate status: for the life of your account.
• Documents you send to confirm your age or identity: deleted as soon as we have checked them; we keep only the result and the date.
• Payment and invoice records: for the period required by Romanian accounting and tax law, even after you close your account.
• Safety and moderation records (notices, decisions, statements of reasons, appeals): up to 12 months after the decision, or longer if needed for a legal claim. We keep removed content itself only while an appeal or counter-notice window is open; after that only its fingerprint, metadata and a screenshot, for the same period (Terms, section 7.9).
• Analytics events: up to 12 months on a rolling basis, then deleted or aggregated.
• Server logs: up to 30 days.
• Marketing consent and e-mail engagement: until you withdraw consent or close your account; we keep a record of the withdrawal itself.
• Support correspondence: 24 months after the last message.
• Ad measurement events: retention is governed by the platform (Meta, Reddit); we keep no copy beyond our analytics.

If we close an account belonging to a minor, we delete its data promptly, keeping only the sealed copy described above and anything the law or an open complaint requires.

10. Your rights

Wherever you live, you can ask us to: show you the data we hold about you; correct it; delete it; give it to you in a portable format; restrict or object to a particular use, including any use based on our legitimate interests; and withdraw a consent you have given, without affecting what was done before. You can also delete conversations, memories and Custom Characters yourself in the app.

You can ask us for a copy of your conversations and memory at any time. To delete everything — account, conversations, memory, Custom Characters, the lot, apart from the records section 9 says we keep — close your account in your settings, use the Privacy Choices page, or write to contact@getkyndred.com from the e-mail address on your account. We may ask you to confirm your identity. We answer within one month, and tell you if a complex request needs longer (up to two further months, as the law allows).

If you are unhappy with how we handle your data, you can complain to the Romanian data protection authority (ANSPDCP, www.dataprotection.ro) or to the authority in the country where you live; UK users can complain to the ICO (ico.org.uk). We would rather hear from you first.

11. Users in the United States

If you live in California or another US state with a privacy law, you have rights to know what personal information we collect and how we use and disclose it, to delete it, to correct it, to opt out of the "sale" or "sharing" of personal information for targeted advertising, and not to be discriminated against for exercising these rights. We offer these rights to all users, whether or not a particular law requires it.

In the past 12 months we have not sold personal information. For users who accepted marketing cookies, we have "shared" identifiers and internet activity with Meta and Reddit to measure our ads, as described in section 3. You can stop this at any time through the Do Not Sell or Share My Personal Information link on our Privacy Choices page or by refusing marketing cookies, and we treat a Global Privacy Control signal from your browser as a request to stop, even if you accepted earlier. Sensitive personal information you share in conversation is used only to provide the service. The categories of personal information we collect are the ones described in section 3 (identifiers, commercial information, internet activity, audio and electronic information, inferences, and sensitive personal information you choose to share), and we disclose them only to the recipients listed in section 7.

11A. Washington consumer health data

If you live in Washington State, the My Health My Data Act treats some of what you may share in a conversation — for example about your mental health, or the safety flags our systems attach — as "consumer health data". We collect it only because of what you choose to type or say, we use it only to run the character and keep you safe (sections 3 and 4), we share it only with the providers in section 7 that store it for us or produce the reply, and we never sell it. We collect it with the consent described in section 4 and you can withdraw that consent, ask us what we hold, or ask us to delete it, as described in section 10. We do not use geofencing.

12. Cookies and similar technologies

We use cookies and similar identifiers that are strictly necessary for the service — keeping you signed in, remembering your settings, protecting against abuse. These need no consent. Analytics identifiers (PostHog) and advertising pixels (Meta, Reddit) are set only if you agree in the cookie banner — wherever you are in the world — and never on chat pages; you can change your mind at any time in the cookie settings or on the Privacy Choices page. The desktop app asks for the same choice when you first launch it. It also stores your session and cached character files on your device so that it can start quickly; anyone who can use your computer account can read them, and you can clear them from its settings. The Telegram bot sets no cookies.

13. Children

Kyndred is for adults. We do not knowingly collect data from anyone under 18: we ask for a date of birth at sign-up, and our systems watch for signs that an account belongs to a minor. If we think an account may belong to a minor, we suspend it and switch off romantic content, leave its data untouched, and give the account holder 30 days to confirm their age; if age is confirmed we restore the account and refund the time lost, and if not we close the account, refund every payment made on it and delete its data, keeping only a sealed copy of any safety-flagged conversation as described in section 9. If you believe a minor is using Kyndred, write to us; parents and guardians can use the same route.

14. Security and breaches

We protect your data with measures appropriate to its sensitivity: encryption in transit and at rest, two-factor authentication on our accounts, access limited on our side to the small team that runs Kyndred, and providers chosen with EU data residency wherever possible. No system is perfectly secure. If a breach puts your data at risk, we notify the relevant authority within 72 hours where the law requires, and we tell you directly where the law requires it or the risk to you is significant.

15. Changes to this policy

When we change this policy in a way that matters — new purposes, new categories of data, new providers that handle your conversations — we tell you by e-mail or in the app at least 30 days before the change takes effect, as our Terms promise, unless the law requires a faster change; where a change needs your consent, we ask for it. Smaller changes (clearer wording, or a provider that does not handle your conversations swapped for an equivalent) are reflected in the date at the top of this page. Previous versions are available on request.

16. Contact

Any privacy question or request: contact@getkyndred.com · getkyndred.com/contact · KYNDREDSDK S.R.L., Tecuci, str. Furceni nr. 62, Galați County, Romania.