Most software asks you to trust a company. Kinstodian is built so there's less to trust.
Because there's less anyone here can do with your information — including us.
Three facts, not three promises.
It lives on your device.
Your plan is created and stored on your own device, inside your browser. It is not uploaded anywhere as part of normal use. There's no login because there's no account for a login to unlock — nothing on a server is waiting to be reached.
It's encrypted with a key only your device has.
Everything sensitive is encrypted with AES-256-GCM: account numbers, recovery instructions, vault entries, document scans. Each encrypted value is tied to its exact place in your plan, so it can't be lifted out and made to mean something else somewhere else.
The key that does this encryption is created on your device and stays there — it's never transmitted, and in most modern browsers it's held in a form the browser itself won't hand back out, even to Kinstodian's own code. On a small number of older or less common browsers that can't support that, the key falls back to a form that could technically be extracted from the device itself — worth knowing, not worth hiding.
There's no account for anyone to break into.
There is no account, and no server holds your plan, so there is no company database of plans for anyone to break into — the way most people hear about this happening does not apply here. What Kinstodian does hold is listed below: totals, a status line if you chose to share one, and any support note you sent us.
The whole list of what crosses, and what never does.
Kinstodian reports seven moments, so that whoever offered it to you can tell the program is helping people. Each one is a single word leaving your device — never anything you typed. Everything else below leaves only if you send it.
Your device
Holds the whole plan, the key, and every backup you make.
What is never sent
- Your name, or the name of the person you are doing this for.
- Any bill, amount, or who it is paid to.
- Any account, bank, or the last digits of any number.
- Any email address, phone number, or contact.
- Any password, note, or document.
- Anything that could point back to you, this device, or where you are.
- Seven anonymous milestonesOne word each — that a plan is in use, that setup was finished, that something is still missing, and four about how far the plan has got. Never anything you typed, and nothing that points back to you or this device.
- An enrollment code, if you enter oneThe code itself, and nothing else. What comes back is the organization's name and colours, so your screen can say who gave it to you.
- A one-line status, only if you choose to share itIf an organization gave you a code, you can let them see a single line about how you're doing. You see the exact line they see, and you can turn it off.
- A support note, only if you write oneThe words you type in a note to Support, with a ticket reference — and nothing else from your plan. If Support asks you for a specific detail to solve it, only what you choose to send back.
Our servers
Hold totals, and whatever you chose to send. Nothing that can be opened to read a plan.
- Counts — "14 families have finished setting up"
- The status lines families chose to share
- Support notes, with a reference number
There is no switch to turn the milestones off, and we would rather say that plainly than have you hunt for one. Counting how many people get through the setup is how an organization knows the program is doing any good — and because the count carries nothing about you, there is nothing here that a choice would protect.
What's not hidden, stated plainly.
Two honest limits, because a page that only lists what's protected isn't the whole picture.
The outline of your plan is not sealed: the name of the person it's for and their city and county; each bill's name, amount, and who it's paid to; what type each account is (not the bank, not the number); what role each contact plays (not their name or number); the names of anyone sharing the plan; property labels and running-cost figures; and the label, title, or type on a vault entry. The numbers, names, passwords, addresses, recovery details, and documents behind that outline are sealed. So someone glancing at an unlocked device could see the shape of what you've stored, not what's in it.
Encryption protects your information from someone who gets hold of your files — a stolen drive, a device resold with the disk intact. It does not protect it from someone using your device while it's already unlocked. Nothing can.
We can't open your plan. We can't recover it either.
We can't open it.
There is no copy of your plan on our side and no key that would read one. A request to look inside — from us, from anyone — has nowhere to land.
We can't recover it.
If you lose your device and your recovery code, we can't rescue your plan for you. A company that could rescue your data on request is a company that could read it on request, and Kinstodian is built so that request has nowhere to land.
Those are the same fact from two directions.
Practical questions
Will it work on my phone?
Kinstodian works in any modern browser, on a phone, tablet, or computer — there's no app to install from a store, and nothing to buy a new device for. If your browser is too old to confirm it will actually keep your information safe, Kinstodian tells you so plainly the moment you open it, rather than leaving you to guess your own browser version. Open Account at any time and it says, in plain words, whether this device is keeping your plan the way it should.
If you're referred by an organization
An organization that gives you an enrollment code can see how many families they've referred and how that group is doing in aggregate — the seven moments above, as totals: "14 families have finished setting up," never a list. They cannot see any individual plan; there is nowhere on their side for one to be stored. If you choose to share your status with them, you see the exact line they see; nothing about you is shown to them that isn't also shown to you.
If you found Kinstodian on your own, the count is ours alone and works exactly the same way. What an organization sees, from their side
This website
This site sets no cookies, runs no analytics, and loads nothing from any other company — no fonts, no scripts, no images from elsewhere. There is nothing here that watches you read it.
The legal version
This page describes how Kinstodian actually works. The formal version is the Privacy Policy, which is being finalized — legal review is in progress, and it will be published before the site accepts real payments.
Questions in the meantime go to support@kinstodian.com.