Privacy Policy
Effective August 13, 2026. This is version 1, the first published version.
1 Who we are, and who holds your data
Kinshire is published by Twice Baked Software LLC, a limited liability company registered in the United States. Where this policy says “we” it means that company. Where it says “you” it means the person using Kinshire or, for a household server, the adult who runs it. A Hosted Instance means a copy of Kinshire that we run for you, rather than one you run yourself.
Kinshire can be run two ways, and the difference decides who is legally responsible for the data. Open the one that applies to you. Sections 2 onwards apply to both unless they say otherwise.
You run itYour household is the data controller. We hold nothing.
You operate the server. Accounts, photos, contacts, calendar entries, lists, and research notes are written to your database on your hardware. The software does not report home, and there is no back door for us: we cannot retrieve your data, reset it, or hand it to anyone who asks, because we never have it.
In data-protection terms you are the controller and we are neither controller nor processor of that data. The duties come with it. Backups, deciding who gets an account, and answering a family member who asks what you hold about them are yours to carry out. If you are subject to the GDPR, the UK GDPR, or a similar law, those obligations fall on you rather than on us.
Connections that reach outside your server. Kinshire is quiet by default. Each of the following is off until an adult running the server turns it on.
Publishing. Marking something public or shared is an instruction to send it out. Copies then live on the servers you shared with and can outlive your own copy.
Connecting to another family’s server. Sharing with relatives who run their own Kinshire opens a direct link between the two servers. Each sees what the other deliberately shares and nothing else.
Reading from a shared research server. Genealogy work can pull corroborations from a larger public server, cache them locally, and reach its own conclusions from them. This is an outbound request your server makes, so the far server can see your server’s network address and the subject of the request. Nothing private is sent, and nothing about your family is uploaded.
Google Photos on the television. Uses a small service we operate, described in section 4.
We host itWe are the data controller, because somebody has to be.
Kinshire Hosted runs the same software on infrastructure we operate, so a family can start without setting up a server. The trade is plain: you skip the sysadmin work, and we end up holding the data a self-hoster would hold themselves. For hosted accounts we are the controller, and every obligation in this policy is ours.
Kinshire Hosted is not open yet, so nothing in this panel describes data we hold today. It describes how the service will operate, and it will be revised with anything that changes before the first account is created.
Access is limited to operating the service. Only the people who run it, and only to investigate a fault you reported, restore a backup, or answer a legal demand we are required to answer. Nobody reads your family’s content out of curiosity.
Leaving. Export everything and move to a server you run yourself. Hosted and self-hosted are the same software, so there is no migration penalty and no format only we can read.
2 This website
The pages on kinshire.app are pre-built files served by Cloudflare. Visiting them does not create an account.
We set no cookies and run no analytics. There is no tracking script, no advertising pixel, and no third-party embed on this site. Nothing here asks for consent because nothing here collects anything.
As with any web host, Cloudflare records standard request information such as IP address, user agent, and the page requested, in order to deliver traffic and absorb attacks. That processing is necessary for the site to exist and is not used to profile you.
3 What Kinshire stores, and why
The software stores the same categories wherever it runs. On a server you run, all of this stays with you. On a hosted account, we hold it on your behalf.
| What | Why it exists |
|---|---|
| Email address and hashed password | To let a person sign in and to recover an account. |
| Session records | To keep a browser signed in and to let you sign out everywhere. |
| Content your family creates: contacts, photos, calendar entries, lists, chores, research notes | It is the product. Kinshire exists to hold it and show it back to you. |
| Information about people who never signed up | A relative’s birthday or phone number is recorded by the family member who knows it. Anyone living who never signed up shows as a name and nothing more outside the circle of the person who recorded them. |
Where the GDPR or a similar law applies to a hosted account, our lawful basis is performance of the contract to provide you the service, and our legitimate interest in keeping it secure and working.
4 Google Photos on the television
Kinshire’s television display can show photos from Google Photos in its picture frame. Connecting is optional, the frame works without it, and you can disconnect at any time from the television’s settings.
What we ask for
photosambient.mediaitems, which reads only the albums, people, or favourites you select in the Google Photos app, so they can be displayed on the television.openidandprofile, so the television’s settings screen can show which account is connected, by name and avatar. We do not request your email address.
What happens to the photos
Photos are fetched by the television, drawn on screen, and discarded. Kinshire does not write them to disk, does not upload them anywhere, and does not keep copies, thumbnails, captions, album names, or location or camera metadata. Google Photos content is never imported into your Kinshire album, never added to your family records, and never passed through face detection or face matching of any kind. It is a display path, not a source of data.
How the connection is made
Google requires this kind of integration to run under one registered application, so a television does not sign in to Google on its own. It goes through the Kinshire ambient service, which holds the application credentials Google issued to us. That service performs the sign-in exchange and renews the authorization when it expires.
Your authorization passes through that service in the process. It is not written to disk or to a database there, and the service keeps no record of your account, your television, or your photos. What it stores is our application’s own credentials, which are not yours and say nothing about you.
If you run your own Kinshire server, this service is still ours by default, because Google does not issue these application credentials to individual households. The address the television uses is configurable, so you can point it at your own if you ever have credentials of your own.
Where the sign-in is kept
The authorization itself lives on the television, in encrypted storage backed by the Android Keystore, and is excluded from device backup. Disconnecting deletes the registered device through Google’s API and erases the stored authorization from the television. Your Google Photos library is never modified. The photos themselves never touch our infrastructure.
Limited Use
Kinshire’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google Photos is used only to provide the photo-frame feature visible on the television. It is not transferred to anyone, is not read by any person at Twice Baked Software LLC, is not sold or shared with advertisers, data brokers, or credit agencies, and is not used to train any model.
5 How long data is kept
On a server you run, data is kept until you delete it. Retention is yours to set, and nothing expires on our schedule.
On a hosted account, data is kept while the account is open. Deleting your account removes it from live systems within 30 days, and it ages out of encrypted backups within a further 90 days. Deleting an individual item follows the same schedule. We may keep the minimum records needed to meet a legal or accounting obligation, and nothing else.
6 Where data is processed
On a server you run. Your data is processed wherever you keep that server, which for most families is their own home. None of it is transmitted to us.
On a Hosted Instance. When you use one, the data described in section 3 is transmitted from your devices to that instance over an encrypted connection and stored there. It is stored for the purpose of operating the software for you: serving your family’s pages, running the calendar, lists, and chores, holding the photos you upload, and taking backups so that an account survives a failed disk. It is processed for running the service and for nothing else, and it is not combined with data from any other household.
Hosted Instances run on infrastructure we operate, in the United States. We engage no other company to process what is held on them. That is the position today, and Kinshire Hosted is not yet open; if we later rely on another company for any part of it, this section will name them, the countries they operate in, and the safeguards for any transfer out of your region, and it will be revised before the first account is created rather than after.
On this website. Cloudflare serves kinshire.app from locations worldwide and records the request logs described in section 2. The site loads no fonts, scripts, analytics, or embeds from anywhere else, and makes no third-party requests at all.
7 How data is protected
Passwords are stored as hashes rather than as text, and session tokens are hashed too, so a stolen copy of the database does not hand anyone a working login. Connections to the service use TLS.
On a server you run, everything past that point is your setup: your network, your backups, your updates. On a hosted account, access is restricted to the people operating the service, credentials are held in managed secret storage, and backups are encrypted.
No system is perfectly secure. If a breach affects your data on a hosted account, we will tell you and the relevant regulator within the time the law requires, and describe what happened in plain terms.
8 What we never do
- We do not sell or rent personal information, and we do not share it with data brokers or advertisers. We have never done so.
- We do not use your family’s content to train machine-learning models.
- We do not serve advertising or build a profile of you for anyone else.
- We do not run face recognition on people who have not agreed to it. Where Kinshire offers face matching at all, it is computed on your own device and keyed to it.
9 Your rights, and how to use them
Depending on where you live you may have the right to access a copy of your data, correct it, delete it, take it elsewhere in a portable format, object to or restrict how it is used, and withdraw consent you previously gave.
On a server you run, all of these are things you do yourself, in the app. Deleting something that never left your own machine is a real deletion rather than a request to a third party. If a relative asks you to remove what you hold about them, that request goes to you, not to us.
On a hosted account, the same operations are in the app, and you can write to us at privacy@craigory.dev if something will not budge. We answer within 30 days and do not charge for it. We will ask you to confirm you control the account before acting.
Where you have deliberately published something to a wider audience, we can remove it from anywhere we control and signal others to do the same, but we cannot guarantee the removal of copies already held elsewhere. That distinction is stated plainly because it is real.
If you are in the UK, the EU, or another region with a data-protection authority, you may complain to yours. We would rather you told us first so we can put it right.
10 Children
Kinshire is family software, and children are part of the families that use it. A parent or guardian may add children as members or record information about them. On a server you run, that information stays there under your control and never reaches us. On a hosted account we store it on your behalf, on the instruction of the adult who opened the account, and it is covered by everything above.
We do not knowingly collect personal information directly from children, and accounts are opened by adults. This website is not directed at children.
11 Changes to this policy
If this policy changes, the updated version is posted here and the effective date at the top is revised. Where a change materially affects how we handle data on a hosted account, or how Google Photos data is handled, we will say so here before it takes effect, and notify hosted account holders by email.
12 How to contact us
For questions about this policy, to exercise a right described in section 9, or to report a concern:
Twice Baked Software LLC
privacy@craigory.dev
We aim to reply within a few days and, for requests under section 9, within 30 days.