Kith

Privacy Policy · Effective __EFFECTIVE_DATE__

This policy explains what __OPERATOR__ (“we”, “us”) does with information when you use the Kith mobile application and the service behind it at __APP_HOST__ (together, the “Service”). It is written to be read, not to be survived.

1. Who is responsible

__OPERATOR__ is the personal information handler (data controller) for the Service. Questions, requests, and complaints go to __CONTACT_EMAIL__. We answer within 15 working days. Reports of abuse or objectionable content go to __ABUSE_EMAIL__ and are acted on within 24 hours.

2. What we collect

Kith is a closed, invitation-style network: an administrator must approve your account before it works. That is the only reason we hold any account record at all.

What we deliberately do not collect

• No email address, phone number, or real name.
• No address book, contact list, or social graph import.
• No location data of any kind, precise or coarse.
• No advertising identifier, and no cross-app or cross-site tracking. We do not track you as the App Tracking Transparency framework defines it, and we never ask for permission to, because there is nothing to ask for.
• No analytics SDK, no crash-reporting SDK, no attribution SDK, no social login SDK. The application ships with none of these embedded.
• No behavioural profiling and no automated decision-making about you.

3. What we cannot see: one-to-one chat

Your one-to-one conversations use end-to-end encryption. Keys are generated on your device and the private half never leaves it. The server relays a message it cannot decrypt, and once the recipient's device confirms delivery, the server deletes its copy. The conversation then exists only on the two devices that took part in it.

Three honest consequences you should weigh:

• We cannot recover your one-to-one history. Not for you, not for law enforcement, not for anyone. If you lose your device or reinstall, that history is gone. This is the design, not a defect.
• One account, one active device. Signing in on a new device replaces the old one's keys and leaves the old history behind.
• Encryption protects the message, not the metadata. We necessarily know that an account sent something, when, and to whom, because that is what routing a message means.

4. What we can see: groups and files

We will not pretend otherwise: group chats, stored files, and avatars are not end-to-end encrypted. They are encrypted at rest with a key unique to your account or to the group, held in a separate key-management system, on top of full-disk encryption. That defeats a stolen disk, a leaked backup, or a stolen database dump. It does not defeat us. If you need a conversation that we genuinely cannot read, use a one-to-one chat.

Names are covered too: nicknames, group names, folder names, file names, and the private remarks you set on a contact are all sealed at rest rather than stored as readable text.

5. Push notifications

To alert you while the app is closed we send a notification through Apple Push Notification service or Firebase Cloud Messaging. The notification carries generic wording only — it never contains message text, a sender's name, a file name, or anything decryptable. Apple and Google therefore learn that your device was pinged, not what was said. Turn notifications off in your phone's settings and we stop sending them.

6. Who else gets your data

Nobody. We do not sell personal information, we do not share it for advertising, and we do not disclose it to third parties for their own purposes. The only external parties involved at all are:

• Apple / Google, who deliver the contentless push notification described in §5.
• Our hosting provider in __SERVER_REGION__, who supplies the servers. They hold encrypted storage, not a right to read it.

If we are ever compelled by valid legal process, we can produce only what we actually hold: account records and the metadata in §2. We cannot produce one-to-one message content, because we do not have it.

7. How long we keep things

• One-to-one messages: deleted from the server as soon as delivery is confirmed. Kept on your own device until you delete them or a timer expires.
• Self-destructing messages: deleted at the timer you set, and in every case no later than 90 days — that ceiling is enforced by the server and cannot be raised.
• Groups and files: kept until you or the owner deletes them.
• Dormant accounts: if you do not sign in for 90 days, the account is destroyed automatically. We warn you 14 days and 3 days beforehand.
• Administrative audit log: a tamper-evident record of administrator actions is retained. It records who approved or suspended an account — never message or file content.
• Abuse reports: when you report someone, what you write goes to our moderators in readable form — that is the point, and for a one-to-one chat your description is the only evidence that can exist, since we never held the message. Reports you file are deleted with your account. Reports about you are kept as a record of what we were told and what we did, in the same way the audit log is.

8. Deleting your account

Settings → Delete account, in the app, at any time, without contacting anyone. It takes two confirmations because it cannot be undone.

Deletion is cryptographic erasure: we destroy the encryption keys for your account first, which renders your stored content permanently unreadable instantly — including in any backup we hold, since backups contain only ciphertext. The empty rows and files are then reclaimed in the background. Your username is retired permanently and cannot be re-registered by anyone, including you.

9. Your rights

Under the Personal Information Protection Law of the People's Republic of China you may ask us to: tell you what we hold about you; give you a copy or transfer it; correct it; delete it; withdraw a consent you previously gave; or explain how we handle it. You may also complain to a regulator.

Write to __CONTACT_EMAIL__. We reply within 15 working days. Two limits, stated plainly: we may need you to sign in to prove the account is yours, and we cannot hand over one-to-one message content that we do not possess.

10. Where your data is processed

The Service runs on servers in __SERVER_REGION__. If you use Kith from within mainland China, your information is transferred outside it. By creating an account you give the separate consent that such a transfer requires. We transfer only what §2 lists, only to operate the Service, and to no third party for its own purposes.

11. Age

Kith is rated 17+ and is not for anyone under 17. We do not knowingly hold information about children. If you believe a child has an account, write to __CONTACT_EMAIL__ and we will remove it.

12. Security

End-to-end encryption for one-to-one chat; envelope encryption at rest for everything else; full-disk encryption underneath; Argon2id password hashing; biometric or PIN lock on the app itself; and an administration console built on a separate binary with a separate least-privilege database account that is structurally incapable of reading your content or unwrapping your keys.

No system is perfect, and we will not claim ours is. If you find a vulnerability, tell us at __CONTACT_EMAIL__.

13. Changes

If we change this policy we will update the date at the top and, for anything material, tell you in the app before it takes effect.

14. Contact

__OPERATOR__ · __CONTACT_EMAIL__ (privacy) · __ABUSE_EMAIL__ (abuse and objectionable content)