Privacy policy

1. Overview

This privacy policy describes what data Kinhub ("we", "us", or "our") collects when you use the Kinhub family operating system, how that data is stored, and the choices and rights you have over it. It applies to the Kinhub web application served at kinhub.polsia.app and the associated account, notification, and email features.

This page is a template. It is structured to follow standard privacy-policy conventions so that a final, counsel-reviewed version is mostly a copy-and-rename exercise. Do not rely on the wording below as legal advice.

2. Data we collect

To run the service we collect a small amount of data directly from you, plus operational data the service generates as you use it.

Account and sign-in

• Account email and a hashed password, stored in the users table.
• Last login timestamp, used to power re-engagement nudges and inactivity detection.
• Magic link / password reset tokens, short-lived single-use tokens stored in magic_links and password_reset_tokens.

Family data you save

The data you save to plan and run your household is the core of what Kinhub holds. All of it is scoped to your family and visible only to members you invite:

• Family-member fields: name, emoji avatar, role, points (stored in family_members).
• Calendar events: title, date/time, color coding (stored in events).
• Meal plans: date, type (breakfast / lunch / dinner / snack), name, recipe (stored in meals).
• Grocery lists and grocery items (stored in grocery_lists and grocery_items; items may be linked back to specific meals).
• Chores and chore-completion history (stored in chores and chore_completions).
• Parsed school emails and the events / action items we extract from them (stored in school_emails).

Operational data

• Web push subscription endpoints when you opt in to notifications (stored in push_subscriptions).
• Notification preferences per user (stored in notification_preferences).
• Onboarding drip state (which of the Day 0 / Day 1 / Day 3 emails has been sent for your account; stored in user_onboarding).
• Payment metadata flowing through the platform's Stripe Connect integration when you upgrade to Pro. Card numbers and bank credentials never touch our database — payment metadata processed by the platform's Stripe Connect integration is what reaches us.

Analytics and diagnostics

• An anonymous visitor identifier used to count unique page views (set by a first-party analytics beacon; not tied to your account unless you sign in).
• Server-side page-view entries (path, referrer, hashed user agent) for traffic shape understanding, stored in page_views.

3. How we store data

All application data is stored in a managed PostgreSQL database hosted on Neon. The database connection string is supplied to the application through the DATABASE_URL environment variable; the application connects through the pg Node.js connection pool. Data is encrypted at rest by the database provider, in transit over TLS from the application to the database, and TLS-protected in transit from your browser to the Kinhub web app.

Passwords are hashed using a strong adaptive hashing algorithm before they are stored; we do not store passwords in plaintext. Authentication tokens (magic link and password reset) expire automatically and are single-use.

4. How we use data

We use the data above only to run the core service:

• To authenticate you, keep you signed in, and let you recover access to your account.
• AI meal planning and dinner suggestions, powered by a language model accessed through the platform's OpenAI proxy.
• School email parsing, extracting events and action items from messages you paste or forward.
• Push reminders via the Web Push protocol (VAPID) using the web-push library.
• Weekly digest emails summarizing upcoming events and meals (services/weeklyDigest.js).
• Onboarding drip emails on Day 0, Day 1, and Day 3 after signup (services/onboardingEmails.js).
• To diagnose issues, prevent abuse, and improve the service.

We do not sell your data, and we do not run third-party advertising.

5. Third-party processors in scope today

The following third-party processors handle data on our behalf as part of operating Kinhub:

• Polsia OpenAI proxy — meal-planning AI, school-email parsing, and AI summary features. Prompt content you submit (meal preferences, school email bodies) is sent to the proxy and returned to the application.
• Polsia Email proxy — transactional email (welcome, password reset, family invitations, re-engagement nudges). Your email address and message content are sent to the proxy for delivery.
• Polsia R2 — file storage for icons, artwork, and other static assets uploaded to the platform bucket.
• Stripe / Stripe Connect (via Polsia) — payment processing for Pro subscriptions. Payment metadata flowing through the platform's Stripe Connect integration is what is stored or processed; we never see or store your card number.
• Web Push (VAPID) — push notifications to your device using the web-push library. The push-subscription endpoint your browser generates is stored in push_subscriptions and used as the delivery address.
• Neon — managed PostgreSQL hosting for our primary database.

6. Your rights

You have the following rights over the personal data we hold about you:

• Access — request a copy of the personal data we hold about your account and family.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — close your account and have your account, family, and history permanently deleted.
• Export — receive a portable copy of your data in a common machine-readable format.

To exercise any of these rights, email privacy@kinhub.polsia.app from the address on your account. We will respond within a reasonable timeframe.

7. Children and school data

Kinhub is intended to be operated by adults managing a household. We do not knowingly collect personal data directly from minors. School emails you parse through Kinhub are forwarded or pasted in by the adult account holder at your initiative; the parsed events and action items are stored within your family and are not shared externally. If you believe a minor's personal data has been submitted in a way that should be removed, contact us and we will assist.

8. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date above and, where appropriate, notify active accounts by email or in-app notice before the change takes effect. Non-material edits (clarifications, typo fixes) may be made without notice.

9. Contact

For any privacy-related question, request, or complaint, email privacy@kinhub.polsia.app.