In effect from 23 September 2026

Privacy policy

Kinly holds very little about you, and the most sensitive thing it holds — where you are — is only ever shared during an alert you sent yourself.

1. The short version

This summary is not the policy — the sections below are — but nothing in them contradicts it.

Your location is shared only while an alert you sent is active. Not before, not after, and never with us for any other purpose. No feature in Kinly lets one person look up another.
Kinly does not sell data, and does not advertise. There is no tracking, no analytics profile, and no third-party advertising code in the app.
Nobody sees anything about you until you invite them and they accept.
You can delete your account from inside the app, or from this website. Section 9 says exactly what is deleted and what is not.

2. Who is responsible for your data

Kinly is operated by Apex Tracking Group Ltd, a company registered in England and Wales under company number COMPANY_NUMBER_TO_BE_CONFIRMED. For the purposes of UK data protection law, Apex Tracking Group Ltd is the data controller for everything described here.

Registered office: REGISTERED_OFFICE_TO_BE_CONFIRMED.

For anything about your data, write to privacy@kinly.help. That address reaches the person responsible for data protection directly, and is the fastest route for a request under section 10.

3. What Kinly collects, and why

This is the complete list. If something is not here, Kinly does not collect it.

Personal data Kinly collects, when it is collected, and why
What	When	Why
Email address	Sign-up	It is your account identity, and how you sign back in.
Display name	Sign-up	So your Circle knows who is asking for help.
Profile photo, phone number	Optional, if you add them	So the people in your Circle recognise you, and can ring you directly.
Precise location	Only while an alert you sent is active	So the people in your Circle can reach you, or direct someone who can.
Notification token and device type	After you sign in	So an alert reaches your phone. Without it, you could be in someone’s Circle and never hear about it.
Relationship labels	Optional, set by you about your own Circle	So a responder — and afterwards, if it comes to it, a paramedic or a police officer — can tell who is who. Labels are chosen from a fixed list, not typed.
Alert records	Each time an alert is sent or answered	What happened and when: who was told, who responded, and how it ended.
Response notes	Optional, if a responder writes one	Short free text — up to 140 characters — alongside a response.
Invite codes	When you invite someone	A short code, valid for seven days and usable once. Nobody but the app can read them.
Sign in with Apple token	Only if you sign in with Apple	Held for one purpose: so that deleting your account can also revoke Kinly’s access to your Apple ID, which Apple requires.

Kinly does not collect your contacts, your photo library, your calendar, your health data, or anything about what you do on your phone outside the app.

4. Location, in detail

This is the part of the policy that matters most, so it is spelled out rather than summarised.

Kinly records your location only while an alert you sent is active. Starting an alert starts it. Marking yourself safe, or cancelling, stops it.
While an alert is running, your position is updated roughly every fifteen seconds, or when you move about twenty-five metres, and is visible to the members of your Circle who were sent that alert.
Sharing continues while your phone is locked and the app is closed, because an alert you cannot see is still an alert. Your phone shows this is happening — Android displays an ongoing notification, iOS shows a blue indicator in the status bar — and that is deliberate: you should always be able to tell when Kinly is sharing.
There is no other time when your location is recorded or shared. Kinly has no feature that shows one person where another is on request. That is not a setting that is switched off by default; it does not exist.
You can refuse the location permission entirely and still use Kinly. Your alert will still be sent, and the people in your Circle will still be told — they will simply not be shown where you are.

5. Our lawful basis

Under UK GDPR, the reasons Kinly is permitted to process your data are:

Performance of a contract (Article 6(1)(b)) — for your account, your Circle, sending alerts and delivering notifications. This is the service you asked for; Kinly cannot provide it without these.
Vital interests (Article 6(1)(d)) — for sharing your location with your Circle during an active alert. That processing exists to protect someone from harm, which is what this basis is for.
Legitimate interests (Article 6(1)(f)) — for keeping the service secure and preventing abuse, such as limiting how many alerts one account can send in an hour so that Kinly cannot be used to flood someone with notifications.
Legal obligation (Article 6(1)(c)) — if we are ever lawfully required to retain or disclose something.

The location permission is a separate matter from the lawful basis: it is granted to the app by your phone’s operating system, and you can withdraw it at any time in your device settings without affecting the rest of your account.

The people in your Circle

Members of your Circle can see your display name, your photo and phone number if you added them, and — during an alert you sent — your live location. They see nothing else, and nothing at all until they have accepted your invitation.

Everyone who receives an alert can also see the responses of everyone else who received it, including their display name and the relationship label you gave them. That is the point: it stops four people all driving to the same place.

Service providers

Kinly uses a small number of processors. None of them is permitted to use your data for their own purposes.

Google (Firebase) — accounts, database and server code. This is where your data is stored.
Expo — the push notification service that delivers alerts to phones. A notification passing through it contains the name of the person who sent the alert and a short line of text, but never a location.
Apple — Sign in with Apple, if you use it, and the notification service that delivers to iPhones.
Google — Google Sign-In, if you use it, and the notification service that delivers to Android phones.

Nobody else

Kinly does not sell your data, does not share it with advertisers, and contains no advertising or analytics software. If we were ever legally compelled to disclose something — by a court order, for example — we would, and we would tell you unless the law forbade it.

7. Where your data is held

Your profile, your Circle, your alerts and every location point are stored in Google Firebase’s europe-west2 region, which is London. The server code that handles alerts runs in the same region.

Two things sit outside that, and it would be misleading not to say so:

Account sign-in records. Firebase Authentication holds your email address and sign-in identifiers on Google infrastructure that may be outside the UK.
Push notifications. Notifications are delivered through Expo’s service and then Apple’s or Google’s, whose servers are largely in the United States. The content of a notification is a name and a short line of text.

Where data leaves the UK, it is covered by the UK International Data Transfer Addendum or the equivalent standard contractual clauses in those providers’ terms.

8. How long it is kept

Your account, profile and Circle — for as long as you have an account.
Alert records, including location points — kept with the alert they belong to, so that what happened can be looked back at. They are deleted when you delete your account; see section 9.
Invite codes — seven days, or until used, whichever comes first.
Notification tokens — until you sign out, delete your account, or the token stops working, at which point it is removed automatically.

9. Deleting your account

You can delete your account from Settings inside the app, or request deletion from this website if you no longer have Kinly installed. Deletion is permanent and is not a deactivation.

What is deleted

Your account and sign-in, your profile, your name, photo and phone number.
Every Circle membership — the ones you own and the ones you belong to.
Any invite codes you created that have not been used.
Every location point ever recorded for you, including the last known position stored on each of your alerts.
Your devices’ notification tokens.
Your Sign in with Apple token, which is revoked with Apple and then deleted — so Kinly stops appearing under your Apple ID, rather than merely being forgotten on our side.

If an alert of yours is still running when you delete, it is cancelled first and your Circle is notified, so that nobody is left following a trail that has silently stopped.

What is kept, and why

The alerts themselves are not deleted. An alert is not only your record — it is also the record of everyone who was told and everyone who answered. Deleting it would rewrite their history of a night that happened to them too.

What remains in those records after your deletion:

The fact that an alert was sent, when it started and ended, and how it was resolved.
The fact that you responded to somebody else’s alert, if you did — but any note you wrote alongside it is removed.
Your name is replaced with “Deleted user” everywhere it had been copied into those records.
An internal account identifier remains attached to those entries. It is a random string, and once your account is gone it no longer refers to anything.

This is deliberately stated in full rather than summarised as “we delete everything”, because that would not be true.

10. Your rights

Under UK GDPR you have the right to:

Access a copy of the personal data Kinly holds about you — a subject access request.
Rectify anything inaccurate. Your name and profile can be changed in the app at any time.
Erase your data — see section 9 for what that does and does not reach.
Restrict or object to processing carried out under legitimate interests.
Data portability — receive your data in a structured, commonly used format.
Withdraw a permission, such as location or notifications, in your device settings at any time.

Email privacy@kinly.help to exercise any of these. You will get a response within one month. There is no charge.

If you are not satisfied with how a request was handled, you can complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you gave us the chance to put it right first, but you do not have to.

11. Children

Kinly is not intended for children under 13, and an account should not be created for one. Kinly has no guardian accounts, no parental controls, and no way for one person to monitor another — including a parent monitoring a child. A parent can be in a child’s Circle, in exactly the same way as anyone else, and will be told if that child sends an alert.

If you believe a child under 13 has an account, email privacy@kinly.help and it will be removed.

12. Security

Data is encrypted in transit and at rest by the underlying platform. Access to your data is enforced on the server by rules that check who is asking, not by the app asking politely — so a modified copy of the app cannot read somebody else’s Circle or location.

Invite codes are readable by nobody but the server, which is why an invite link can be shared in a message safely: the code alone reveals nothing about who sent it.

No system is perfect. If there were ever a breach affecting your rights and freedoms, you would be told, and the ICO would be notified within 72 hours as the law requires.

13. Changes to this policy

If this policy changes in a way that affects you, the date at the top changes and you will be told in the app before the change takes effect. This version is in effect from 23 September 2026.

14. Contact

Privacy and data protection: privacy@kinly.help
Anything else: support@kinly.help