Privacy Policy

Last updated: October 31, 2026

A note on scale: this policy reflects Kinstodian's size today. We've committed to giving it a full review — not just for accuracy, but for whether it's still the right approach — once our combined base of users and partners passes 1,000, or sooner if anything material changes.

Kinstodian LLC ("Kinstodian," "we," "us") is designed so that there is very little of your information for a privacy policy to even cover. This policy explains what that means precisely: what we never receive, what we do, why, and what happens to it.

If anything here ever conflicts with how the product actually behaves, the product's behavior is the mistake to fix, not this page — but if you think you've found such a conflict, tell us at support@kinstodian.com and we'll look at both.

1. What Kinstodian is, in the terms this policy needs

Kinstodian is a browser-based tool for organizing an estate or care plan. It does not require an account. Your plan — the people, accounts, documents, and instructions you enter — is created and stored on your own device, inside your browser, encrypted with a key that is also generated on your device and never leaves it. We describe this in plain language, with diagrams, at kinstodian.com/trust; this policy is the formal version of the same facts.

This policy covers the Kinstodian web application, kinstodian.com, and the staff and partner tools we use to support the program. It does not cover third-party sites we link to, including Stripe's own payment pages (see Section 5).

If your organization is a Kinstodian partner, what we hold about it, and for how long, is set out in Section 6.

2. Information we never receive

We do not design Kinstodian to collect, and as a matter of technical fact do not receive, any of the following, ever, as part of normal use of the family application:

• Your name, or the name of the person the plan is for.
• Any bill, its amount, or who it's paid to.
• Any account, bank, or account number (even the last few digits).
• Any email address, phone number, or other contact information you enter into your plan.
• Any password, note, or document you store.
• Anything else that could identify you, your device, or your location.

This isn't a policy choice we could quietly change — it follows from how the product is built. Everything sensitive is encrypted with AES-256-GCM using a key created on your device that never transmits anywhere; in most modern browsers that key is held in a form the browser itself will not hand back out, even to our own code. We don't hold a copy of your plan and we don't hold a copy of the key, so there is nothing on our side capable of reading it. Section 8 explains what that means in both directions — including that we cannot recover your data for you if you lose access.

One limit worth stating plainly, because it belongs here and not only on the Trust page: the outline of your plan is not sealed the way its contents are. The following stay visible to anyone who has your device unlocked in front of them:

• Who the plan is for. The everyday name you gave them, and their city and county — not their full legal name, and not a street address.
• Bills. Each bill's name, its amount, and who it is paid to — not the account number behind it.
• Accounts. What type each one is — not the institution, and not the number.
• Contacts. What role each one plays — not their name, and not their phone number or email address.
• People sharing the plan. Their names, and their role in the plan.
• Property. Labels and running-cost figures — not the address, parcel number, or vehicle number.
• Vault entries. The label you gave each one, and whether it is a login, a note, or a document — never the username, the password, or the file itself.

The numbers, names, passwords, and documents behind that outline are what's encrypted. Encryption protects your information from someone who obtains your device or a backup of it; it does not protect it from someone using your device while it's already unlocked — nothing can, and we'd rather say that here than let this policy imply otherwise.

3. Information we do collect, and exactly why

Seven anonymous milestones. As you use the family app, your device reports up to seven single words — that a plan is in use, that setup was finished, that something is still missing, and four that describe how far a plan has progressed. Each is a bare signal with no content: never anything you typed, and nothing that identifies you or your device. We use these only in aggregate, to know whether the product is actually helping people ("14 families have finished setting up"), and to report that aggregate to an organization that referred you, if one did. There is no setting to turn this off; we say so directly rather than let you look for one that doesn't exist, because the count carries nothing about you for a setting to protect.

An enrollment code, if you enter one. We receive the code itself and return the referring organization's name and colors so your screen can identify who gave it to you. We do not learn anything else about you from this exchange.

A one-line status update, only if you choose to share one. If an organization referred you, you can choose to share a single status line with them. You see exactly what they see, and you can turn this off at any time — unlike the milestones above, this one is genuinely optional and genuinely reversible.

A support message, only if you send one. If you write to support, we receive what you typed, paired with a ticket reference number, and nothing else drawn from your plan. If resolving your request requires a specific detail, we'll ask you for it, and only send what you choose to give us.

Payment confirmation, only when you buy a plan. See Section 5 — this is handled by Stripe, not by us, and what we receive is your email address and which plan was paid for, only so we can email you your license.

4. What we hold on our servers

Because of the above, everything Kinstodian's servers hold reduces to four things: aggregate counts (e.g., how many families referred by one organization have completed setup), the individual status lines people have chosen to share, support notes with their reference numbers, and, if you ask us to send a license again, the record of that request described in Section 5. There is no database of plans, because there is no plan on our servers to have one of.

Separately, if your organization is a Kinstodian partner, we hold the records about it listed in Section 6.

5. Payment processing

Plans are purchased through Stripe, a third-party payment processor, at Stripe's own checkout page — not ours. We do not receive or store your card number, billing address, or other payment details; Stripe handles that under its own privacy policy and security practices. When you buy a plan, and each time a monthly or annual plan renews, Stripe gives us your email address and which plan was paid for, so we can email you your license. We use your address to send that license and do not keep it in our own records. Stripe and our email provider keep their own records of the payment and the message. If you ask us to send a license again, we keep a record of that request (your email address, plan, the dates, the payment reference, which team member handled it, and a short note) so we can help you. We keep this record for five years after the request. Nothing you have entered into your Kinstodian plan is ever sent to Stripe, and nothing about your plan's contents is visible to Stripe.

6. Organizations and referrals

If an organization gave you an enrollment code, they can see how many families they've referred and how that group is progressing, in aggregate — the same milestones described in Section 3, reported as totals, never as a list of individuals. They cannot see, and there is nowhere on their end for us to show them, any individual family's plan. If you choose to share a status line with them (Section 3), you see the identical line they see. If you found Kinstodian on your own rather than through an organization, the same counting happens, attributed to us directly rather than a referrer.

Partner organizations

This part is for organizations that join our partner program. While your organization's account is open, we hold:

• Your organization's name and type.
• The email addresses that your administrators and other team members use to sign in.
• Your branding, such as logo text and color.
• The enrollment codes you issued, and whether each one has been used.
• Aggregate counts, such as how many of the families you referred have finished setting up.
• The locations and referral links you choose to list.
• The notes our staff keep when they review your account.
• A record of each time the Partner Terms were accepted for your organization: the version, the date and time, the confirmation of authority, the email address used, and your organization's name.

If our staff close or delete your account, our staff activity log also records an entry that names your organization.

When your account closes, we delete your organization's account, sign-in addresses, codes and listings, and everything else in the list above, except the records described below. Families who already redeemed a code keep their plan, although we may be unable to look up that code afterwards.

If you close your account or ask us to delete your data, we keep a record that you accepted the Partner Terms (the version, the date and time, your confirmation of authority, your email address and your organization's name) for five years after your account closes, because we may need it to show what you agreed to.

Our internal staff activity log records the name of your organization, the date and a short reason when we close or delete your account. We delete those entries five years after they are made.

If a partner organization's account is terminated for cause, we retain minimal organizational data and administrator contact identifiers (such as organization name and administrative email addresses) on a secure suppression list. We maintain this limited record for up to five years following termination for the legitimate business purpose of preventing fraudulent re-enrollment, protecting program integrity, and enforcing our Partner Terms.

7. Children's privacy

Kinstodian is intended for adults planning for themselves or an aging or ill family member, and is not directed to children. We do not knowingly collect personal information from anyone under 13 (or the relevant age of digital consent where you live). Because the family application does not collect personal information from any user in the first place (Section 2), there is little for this section to add in practice — but if you believe a child has provided us information we shouldn't have (most plausibly, through a support message), contact support@kinstodian.com and we will delete it.

8. Data retention, deletion, and what "deletion" can and can't mean here

Your plan lives on your device, not ours, so deleting it is something you do — by clearing it from your device or uninstalling/clearing your browser data — not something we do for you. We retain aggregate counts indefinitely in de-identified form, since they were never tied to you. We retain status lines and support notes for as long as needed to provide support and improve the program, and delete them on request; contact support@kinstodian.com to ask.

Records about partner organizations, including counts tied to a partner, are kept and deleted on the schedule set out in Section 6.

Because we hold no copy of your plan and no copy of your encryption key, we cannot retrieve, back up, or restore your plan on your behalf under any circumstance — including a lost device, a forgotten recovery code, or a request from you. This is the direct consequence of the design described in Section 2, stated here as a data-handling fact rather than only as a product limitation.

9. Your choices and state privacy rights

Your choices:

• Status-line sharing: You can turn off status-line sharing with a referring organization at any time, in the app (Section 3).
• Support notes and data erasure: You can request deletion of any support note or status line we hold by emailing support@kinstodian.com.
• Device data and local storage: You can stop using Kinstodian and clear your device's data at any time. Because we do not retain a copy of your plan on our servers, there is no additional data on our end for that to delete.

State-specific privacy rights (e.g., California, Virginia, and other U.S. states). Depending on where you reside, local laws — such as the California Consumer Privacy Act, as amended by the CPRA — may grant you additional rights regarding your personal information, including the right to know, access, correct, or request deletion of your personal data, or to opt out of the sale of personal information or targeted advertising.

• No sale or sharing: Kinstodian does not sell your personal information or share it for cross-context targeted advertising.
• Exercising your rights: Because Kinstodian practices strict data minimization, we hold very little personal information. If you reside in a state with applicable privacy rights and wish to submit a request to know, correct, or delete personal data we store, contact us at support@kinstodian.com. We will process your request in accordance with applicable legal timelines.

If you ask us to delete your information, we will do so, except that we keep the records described in the Partner organizations section for the periods stated there.

10. Security

Everything sensitive in your plan is encrypted with AES-256-GCM, using a key generated on your device that never transmits anywhere and, on most modern browsers, cannot be extracted even by our own code. On a small number of older or less common browsers that can't support that protection, the key falls back to a form that could technically be extracted from the device itself; the app tells you plainly, in its Account screen, whether your specific device and browser are keeping your plan the way it should. We believe in stating limits rather than hiding them: this protects your data from someone who obtains your device or a backup of it, but not from someone using your device while it is already unlocked.

11. Changes to this policy

If we change how Kinstodian handles information in a way that matters, we'll update this page and change the "Last updated" date above. We won't make a change that reduces your protection without saying so here, plainly, not just in a changelog.

12. Contact

Questions about this policy, or requests under Section 9, go to support@kinstodian.com. Written correspondence may be sent to Kinstodian LLC, PO Box 183, Olathe, KS 66051.