CLEAR EXPECTATIONS

Privacy Notice

Alpha policy · Version October 20, 2026

Who controls your information

Kinden is operated by Devon under the FennX name. Contact devon@fennx.org for privacy requests. This notice covers Kinden’s application and backend. The website and release hosts also process connection information under their own policies.

What we process and why

Device notifications and account appeals

When you enable browser notifications, we store your device’s push subscription endpoint and encryption keys to deliver alerts through your browser or operating system’s push provider (such as Apple, Google or Mozilla). Message previews are off by default. Disabling device notifications or signing out removes that browser subscription. Queued alerts expire within one hour; delivery deduplication identifiers expire after seven days. Game activity becomes invisible after 90 seconds without a client update and stale activity records are removed after a day during normal activity updates. These records may remain in recovery snapshots until those snapshots expire.

Restricted accounts can authenticate through a separate, limited session to read their own moderation notices and send appeals. Appeal text, decisions and responses are retained with moderation records; administrative access and responses are audited. This session does not grant access to chats or calls.

What “private” means

Servers and DMs are restricted to their authorized members. The owner administration app has no unrestricted private-message browser. Human access to private content through that app requires a report or flag and is limited to the case’s referenced evidence. Reading evidence and taking moderation actions create audit records. Automated checks can examine content without a human opening a case.

The alpha does not provide end-to-end encrypted messages or calls. Connections use transport encryption when deployed with HTTPS/WSS, but the infrastructure operator can technically access server-side data. The current automated detector covers a narrow set of threat phrases; it is not a comprehensive detector of hate, illegality, or image abuse. Reports remain essential, and detection is not guaranteed. Additional classifiers must be reviewed and disclosed here before enabling a third-party content-processing service.

Who receives information

Your intended recipients receive your content; community members can see your chosen profile and relevant membership details. The operator receives support requests and case-scoped safety evidence. OVHcloud hosts the backend; self-hosted Matrix/Synapse, Keycloak, and LiveKit process messages, identity, and media on that infrastructure. GitHub receives ordinary network information when the app checks for or downloads updates. ChatGPT Sites and its hosting infrastructure receive ordinary website request information. Google Gmail/Workspace delivers verification and password-recovery email and processes the destination address and message contents for that purpose.

We do not sell personal information, use private conversations for behavioral advertising, or authorize training general-purpose AI models on private conversations. We may disclose information where legally required or where necessary and legally permitted to address an immediate threat to life, serious abuse, fraud, or a security incident. We limit such disclosures to their purpose. We do not promise to notify you when law prohibits notification.

Retention and deletion

Messages and uploads remain in active storage until deleted through an available control, removed by moderation, or addressed through a verified deletion request. Account/profile, membership, and points records remain while your account operates. Removing a displayed message is not a guarantee that all historical event records, recipients’ copies, caches, or backups immediately disappear. Retention required for safety evidence, legal obligations, disputes, and security may outlast an account.

Recovery snapshots run daily on the VPS, with the seven newest completed snapshots retained. They contain database records, media, and private service configuration and are restricted to the infrastructure operator. They are local recovery copies; off-host disaster recovery is not yet configured. Active content, support records, moderation evidence, and audit records are not automatically erased after a fixed age during this alpha. Deletion requests are reviewed against account ownership, safety, legal obligations, and the rights of other participants. Removing active data may take up to seven successful daily snapshots to age out of routine recovery copies, unless a specific copy is preserved for a legal obligation. You can request access, correction, export, or deletion through in-app support or the contact address. We verify account control, explain any lawful limits on a request, and respond within applicable legal deadlines. If you cannot sign in, use email. Do not email passwords or authentication codes.

Local storage and controls

The Windows app stores its session token using operating-system protected storage where available. Logging out removes its saved session and attempts to revoke the Matrix session. Appearance, service URL, and sound preferences may be kept locally. The browser app keeps session tokens in memory; identity-provider login cookies may persist according to their own session settings. The download site does not include advertising or analytics trackers. Its release lookup connects directly to GitHub to show the current installer. You can mute sounds, choose what to share in a call, stop sharing, block a person, leave a call, or stop using the app.

Children, international use, and rights

Kinden is intended for people aged 13 or older, subject to a higher local minimum age. If we learn that an account belongs to a child below the applicable minimum age, we will restrict it and address deletion as required. A parent or guardian can contact us. The initial backend is intended to run in the United States; service providers may process information elsewhere. Depending on your location, you may have rights to access, correct, delete, obtain a copy of, object to, or restrict processing of personal information, and to complain to a regulator. This notice does not limit nonwaivable rights. We do not claim that this alpha is ready for every jurisdiction.

Security and changes

We use access controls, encrypted connections, owner authentication, invite checks, rate limits, and case audit records. No service is perfectly secure. Never send highly sensitive information you cannot risk exposing. We will update this notice when practices change and provide legally required notice or consent choices. Review the version date and Terms of Service for further information.