Skip to content
01What never leaves your phone
Audio from the microphone is held in memory for a few seconds, analysed, and discarded. It is never written to storage and never transmitted. Your own speech is turned into text on the phone only to count words; that text is never saved and never leaves the phone. Your voice profile — a numeric representation of your voice used to tell you apart from other speakers — is created on the device and stays there. We have no copy of it and no way to obtain one.
02Voice profile and biometric data
A voice profile used to recognise a specific person is biometric data under Article 9 of the GDPR. Kyndsy creates one only after you agree on a separate screen, and only for one purpose: distinguishing your speech from other people’s so the counters mean something. You can delete it in Settings at any time; deleting it stops all recognition immediately. It is excluded from device backups, and it cannot be transferred to another device.
03People around you
A microphone hears everyone, so this is the point we take most seriously. Speech that does not match your voice profile is discarded at once. No profile is created for anyone else, their words are never recognised, stored or shown to you, and there is no mode — hidden or otherwise — that would let the app be pointed at another person.
04What is stored on the device
Counters and events: a category (rough expression, polite expression, filler, sharp tone), a timestamp, a confidence value, the language detected, and the number of the built-in dictionary entry that matched — an index into the app’s own word list, never free text. That number exists for one reason: without it the “not right?” button could not mute a word that keeps being counted wrongly. Diary entries you write yourself. Your settings. All of it lives in the app’s own storage and is erased when you delete the app or press “Delete all history”. The texts you checked — your own drafts and messages from other people — together with their scores, your test answers, practice rounds and exercise attempts together with the AI reviews you received. This is what lets you come back to what you already paid for; every entry can be deleted on its own.
05What reaches our server
A request for the app’s configuration and version policy. A one-time download of the recognition models. If you write to support, your message (see section 10). If you subscribe, a purchase receipt that we pass to Apple or Google for verification. Requests carry an IP address, as all internet requests do; we keep server logs for up to 35 days for security and then delete them. There is no account, no sign-up, no email address and no advertising or analytics SDK in the app. If you ask for an AI review, what you send goes through our server as well — see section 14. If you allowed notifications — your device token: the long number the phone’s notification service gives the app: on iPhone that is Apple’s service, on Android it is Firebase Cloud Messaging, a Google service. The notification travels through that service: Apple or Google sees that a notification was sent and its short text — and nothing else: no audio, no word of yours, no history. On Android there is no other way at all to reach a closed app. It is used for exactly one thing: telling you that the AI review you ordered is ready while the app is closed. We have no name and no email at all; the notification itself says only that the review is ready, without a single word of yours. The token is deleted with the app and by the "Delete all history" button. A few times a day the app also sends counts of its own: totals such as how many sessions or reviews there were that day, along with the app version, the platform and the interface language. It also carries the week the app was installed and how many days ago that was, so that retention can be counted without an ID. It has no anonymous ID, no token and not a single word you said; the numbers are added into daily totals the moment they arrive and the request itself is not stored, so nothing is left to link two days by. This can be switched off in Settings. If you delete the app, the server removes the notification token no later than 60 days after the app last started.
06Subscriptions
Payment is handled by Apple or Google, never by us. We never see your card details. We store the receipt identifier and the subscription state so the app knows what you are entitled to.
07Your rights
Because we hold no personal data about you beyond receipts and short-lived logs, the fastest route to erasure is the app itself: “Delete voice profile” and “Delete all history” remove everything locally and immediately. For anything else — access, rectification, erasure, restriction, objection, portability, or a complaint to a supervisory authority — write to us and we will answer within 30 days.
08Children
Kyndsy is for people aged 13 and over and is rated 13+ in the stores. It is not directed at children under 13, and we do not knowingly process their data. On a teenager’s phone a parent can turn on parental mode (section 13).
09Changes
If this policy changes in a way that affects what we do with your data, the app will show the change before it takes effect. The date at the top always reflects the current version.
10Your anonymous ID, and support
The app generates two random numbers on your phone the first time it runs: an ID you can quote to us, and a key that travels with each request as proof it comes from your phone — we keep only a one-way fingerprint of it. That pair is all we ever know about you. When you write to support, we store your message, our reply, the ID, your app version, platform and language — and nothing else. No email address, because we do not have one; the reply appears inside the app. Messages are deleted 90 days after the conversation ends, by a job that actually runs. You can generate a new ID at any time in Settings, which makes the old conversations unreachable to you and orphaned to us.
11No accounts, and moving to a new phone
Kyndsy has no accounts at all: no sign-up, no login, and no sign-in with Apple or Google. There is nothing to log into and nothing we could hold under your name. Moving to a new phone is a file you make and open yourself: the app encrypts your history with a password you choose, and the file goes wherever you send it — it never passes through us. A subscription is restored by the store itself with “Restore purchases”, which never needed a login.
12This website
Everything above is about the app. This website is a separate thing, and it does count visits — with analytics we run ourselves, on our own servers, not a third party’s. It stores an identifier for the browser you are reading this in, so a return visit is not counted twice. That identifier says nothing about who you are, and it never meets anything from the app: not your anonymous ID, not your voice profile, not a single counter — the app does not talk to the site’s analytics at all. The identifier is stored as soon as a page opens — the consent banner does not stop it, and you can delete it in your browser settings; and if your browser sends Do Not Track or Global Privacy Control, we do not count you at all. None of this changes what the app does: no audio, no transcripts, no account.
13Parental mode
A parent can lock settings, history, export and the voice profile behind a code, on their child’s phone. This changes who may change things; it does not change what is measured or where it goes — only the voice of the phone’s owner is analysed, speech that does not match it is discarded before it becomes words, no audio or transcript is stored, and nothing about the child is sent to us. The summary a parent reads is the same set of numbers the child sees, opened on that same phone. The child is told on screen that the mode is on and can stop a session at any moment without the code; that it was stopped early is recorded for the parent. Turning the mode on requires confirming that you are the parent or legal guardian and that your child knows.
14AI analysis (only when you ask)
Kyndsy can explain a self-check test result, the misses in the trainer, your evening reflection, a coaching attempt, your voice measurements, the balance of your conversations, or write a letter about the month or a map of the quarter. It never runs by itself: every request needs a separate tap on a screen that says what will be sent. What goes out is a summary — the numbers of that attempt, month or quarter, and your own written notes where you added them. No name, no audio and no transcript; with a letter about the month or a map of the quarter, the eight most frequent filler words go too. Our server passes the text to an AI provider (OpenAI, or Anthropic when OpenAI is unavailable), which processes it only to write the reply and does not use it for training. The finished text is kept for 30 days so the app can show it again after a dropped connection, together with the store receipt identifier that paid for it; then it is deleted. If you have a yearly subscription, every achievement you earn adds an AI review: the app tells the server only the achievement’s name — for example “streak, step three” — and the server keeps it next to the subscription number so it is never credited twice. The numbers of your history do not leave the phone. So that your review week starts at your midnight, the server keeps your phone’s time zone next to the subscription number — a single number. If you turn off auto-renewal on an iPhone, we send one offer: for that, an anonymous phone number and a ready notification text in your language are kept next to the subscription number. The “Before you delete” gift is given once: the server remembers this by subscription number, or without a subscription by the anonymous phone number. A week of the personal programme is reviewed the same way: only its numbers go out — how often each kind of slip occurred per 1000 words and how often the replacement was heard — never a word you said. So that one purchase cannot pay for a second review, the server keeps a one-way fingerprint of each spent single-purchase receipt for three years — without the text and without your ID. The anonymous phone number with the offer text and the time zone are deleted 400 days after their last update. The first review as a gift is given only to an app whose authenticity Apple (App Attest) or Google (Play Integrity) has confirmed: the app passes on the one-time answer from that service, our server checks it and keeps only a fingerprint of the one-time challenge — for no longer than a day and without any device details.
15The partner programme
The app has no place to enter a partner code. If you came through a partner’s personal link, two things can happen. When you open the link, our server keeps, for at most two days, a one-way hash of your network address (never the address itself), your platform (iPhone or Android) and the partner’s code, and sends you on to the store. When you first open the app, it makes one request; the server links you to that partner only if exactly one partner’s link was opened from your network in the last two hours, and then deletes the record. On Google Play the store also passes the code inside the link, and the app sends that code once instead. Nothing else about you or your device is compared. The partner sees numbers — how many people came through their link and how many bought — never who they are. Partners are a separate matter: a partner signs up on this website with a social account through Astrina ID, or with an email and a password, and adds a wallet address, because we have to be able to let them in and pay them. With a social sign-in we keep only an anonymous identifier from the provider — not your email or name. That account is not connected to any app data, and the app has no account at all.
16The newsletter
The newsletter is the one place where we hold a real email address, and only if you typed it into the form on this website yourself. Nothing in the app asks for it and the app never sends it. We keep the address, the language you were reading in, the date, and a hashed form of your IP address — hashed so that it cannot be read back, and kept only to stop one person subscribing thousands of others. We write to you only after you confirm by tapping a link in a first letter; until you do, nothing else is sent, and an unconfirmed record is deleted after two weeks. Once confirmed, the address is also held by our own mailing platform at yourtrend.online — our service, on our own server, not a third party's — because that is what sends the letters. Every letter carries a one-tap unsubscribe, and unsubscribing in a letter or on this site stops the letters in both places. Write to us and we will delete the address altogether. None of this ever meets anything from the app: not your anonymous ID, not your voice profile, not a single counter.
17Heart rate from your watch
Only if you turn it on in Settings, Kyndsy reads your heart rate from Apple Health (iPhone) or Health Connect (Android) — the readings your watch has already taken. It asks for one permission: to read heart rate. It never writes anything to Health, reads no other kind of health data and does not read in the background. The readings are used on the phone for one thing — a note next to a sharp moment of the day, such as “heart rate 94, 24 above usual” — and they do not change your score. They are not saved in the app’s history, not included in AI reviews or statistics, never sent to our server and never shared with anyone; health data is never used for advertising, and there is no advertising in the app. Turning the switch off stops the reading at once; the permission itself can be withdrawn in Health or Health Connect.
18The family count
If you share a family subscription, the app can add up how many days the family held together over one week. It stays off until you switch it on, on a screen that says what will be sent. What leaves your phone is two whole numbers: how many of the last seven days you held, and on how many of those days you spoke at all. One date goes with them — the day the week ends, so that a stale figure drops out of the total; no other dates, no scores, no events, not a word — those two numbers cannot be turned back into a day. They are kept next to your anonymous ID only so that sending again replaces your previous figure instead of adding to it, and they are deleted when you leave the count or when the family ends. They are shown to nobody, not even to the person who paid: what comes back is the family total, and only once at least three people are counting — with two, subtracting your own number would reveal the other person’s.
19Session recording on this website
If you allow analytics in the cookie banner, this website records how you use the page: pointer moves, taps, scrolling and what changes on screen. Password, email, phone and card fields are never sent — not even their length — and any other text you type is replaced with dots in your browser, before anything leaves it. This covers these web pages only; the app is untouched by it. Choose “Reject non-essential”, or choose nothing at all, and no recording happens. You can change your mind at any time with “Cookie settings” at the bottom of any page.
Questions about privacy: support@kyndsy.app