Privacy Policy — KindaStart

DRAFT v2 — not published, not reviewed by the founder or a lawyer. Updated 2026-08-26 from the 2026-08-17 draft to match the app as it ships today. Every claim below must stay checked against the code; if the architecture changes, this document changes in the same PR. Placeholders in ⟨angle brackets⟩ need real values before publication.

Changes from the 08-17 draft: renamed Sidekick → KindaStart throughout; removed "or dictate" (voice input does not exist yet — re-add when it ships); removed "chosen voice style" from transmitted data and from preferences (the voice picker was removed 2026-08-18); added the "Make it smaller" step text to what leaves the device (the /v1/shrink call shipped 2026-08-22); added a brief EU/UK rights note (founder is EU-based — ⟨verify controller identity with a lawyer⟩).

VERIFIED IN CODE 2026-08-26 (working session), against mobile/src/api/client.ts and server/src/server.ts: (1) the device identifier accompanies the plan and "Make it smaller" requests only — not the app's configuration check — and serves both the per-minute and daily limits; it is generated the first time the app talks to the server. The identifier paragraph below was corrected to match. (2) Server logs carry technical telemetry only (timing, token counts, sizes, drop-reason counts); request bodies are redacted from logging and no log line includes dump, step, or plan text.

Last updated: ⟨date of publication⟩

The short version

KindaStart works without knowing who you are. There are no accounts. What you type is sent, once, to organize it into your plan — then it's gone from our systems. Your history lives on your phone and nowhere else.

What leaves your device

The text you type into the dump box is sent over an encrypted connection to our server, which passes it to Anthropic (the AI provider) to generate your plan and steps. If you tap "Make it smaller", the text of that one step is sent the same way to generate a smaller version. We do not store any of it. Our server logs record only technical details — timing, token counts, response sizes — never the content of what you wrote.

If you answered the one setup question ("What's hardest for you?"), your answer travels with each of these requests to shape your plan — it is processed to generate the result and never stored, same as the text itself.

Anthropic processes the text to produce the result, subject to its own privacy practices: https://www.anthropic.com/legal/privacy

A random device identifier is sent with those requests. It is generated on your device the first time the app talks to our server, identifies your installation (not you), and exists solely to enforce usage limits — the per-minute and daily ceilings. It is not linked to any personal information, and reinstalling the app resets it.

The app also fetches a small remote configuration from our server (for example, the free daily allowance). That request carries no identifier and no content — nothing you wrote, and nothing about your device beyond what any web request includes.

What never leaves your device

• Your plans, their steps, and your progress
• Your record of handled things and the lifetime counter
• Your preferences (such as onboarding state)

All of this is stored locally on your phone. Deleting the app deletes it. We could not hand it over, sell it, or lose it in a breach, because we never have it.

What we don't do

• No accounts, no sign-up, no email collection
• No analytics or behavioral tracking in the app
• No advertising, no data sales, no third-party marketing SDKs
• No contact lists, location, photos, or any other device data

Subscriptions

Payment is handled entirely by Apple through your App Store account. We never see your payment details. Manage or cancel in your App Store subscription settings.

If you're in the EU or UK

We designed KindaStart to process as little as possible: the text you send is used only to generate your result and is not retained, and nothing we hold can identify you. Because we keep no personal data, requests to access, correct, or delete server-side data have nothing to act on — your data is on your phone, in your hands. If you have any privacy question or concern, contact us at the address below. Data controller: ⟨founder/entity name and country⟩.

Children

KindaStart is not directed at children under 13 and we do not knowingly process their data.

Changes

If this policy changes materially, the app will say so before the new policy applies. The current version always lives at https://kindastart.app/privacy.

Contact

support@kindastart.app