Privacy & Data Terms
Version 2026-11-10.4
Honesty and informed consent start with clear answers about what happens to your data.
Data facts
What You Need To Know First
Private Age Information
Chosen presence and the last interaction time inside Kine support optional automatic Away status; this does not record typing content or activity in other apps. Your self-reported birth date is encrypted on the host and is not shown to friends. It is used to enforce age limits, not to verify identity. Accounts require age 13 or older. People aged 13–17 can use basic chat, trusted Pokémon artwork, trading, and interests; adult topics and uploaded-image exchange are unavailable. Accounts with missing age information remain restricted until private age setup. Uploaded images require both people to be 18 or older. Messages containing profanity are rejected when either account is under 18 or awaiting age setup. Between adults, recipients can choose to mask profanity in their view with asterisks. Older stored content may be redacted when viewed. Adult choices remain off until selected, including after turning 18. Esme Kintsugi, the host administrator, can decrypt this information to operate the service; contact support for a birth-date correction.
Profiles and Friend Request Context
APP ACTIVITY Kine records which tabs, subtabs, and dialogs you use, when you use them, and how long you are actively using them. Activity events are linked to your signed-in account and an app session. Leaving a window open in the background or being idle is not counted as active use. These events do not include your message text, typed input, conversation names, or the contents of dialogs. Esme Kintsugi and authorized moderators can view totals and charts over a selected time period to understand which features are used and improve the app. Analytics are not available to other users. Individual activity events become eligible for deletion after 90 days and are removed by periodic cleanup. This activity collection does not monitor other applications.
OPTIONAL CONTRIBUTIONS Kine records when you open Support Kine and choose a payment provider, including the time, provider, and amount selected when available. These events use a random visit identifier; when you are signed in, they can be linked to your account. A click is not proof of a payment. Where a configured provider sends a verified confirmation, the host can match the contribution to that visit and record its transaction reference, amount, currency, and payment status. Some providers cannot confirm payments to Kine, so those clicks remain unconfirmed. Esme Kintsugi can review this activity to understand support for the project. Kine does not collect your card or bank credentials. Contributions are optional and do not change your access to the app.
PRIVATE CHOICES AND SHARING Your gender is private. Sharing it with a particular friend in one-to-one Messages requires your explicit approval; general consent defaults do not publish it. Requests, approvals, declines, and withdrawals are stored for that relationship. Gender does not appear on public profiles, posts, group chats, or interest discovery. You can withdraw approval, but this cannot erase something already seen.
Basic Messages can be set to Yes, Ask Me First, or No. Ask Me First requires a request and your approval before that friend can start sending personal messages. Accepting a request does not send their saved draft automatically. The host stores these requests, decisions, and revisions. You can separately turn off new friend requests or group invitations in Setup. These account settings are stored on the host and do not remove existing friends, conversations, or pending requests.
MESSAGE DELIVERY AND READ RECEIPTS The host records message delivery acknowledgements from recipient devices. Delivered means a message record reached encrypted client storage; it does not promise that every attachment has downloaded. Read sharing is off by default. If you turn it on, senders can see read status for eligible new messages after their content is displayed. Room senders see counts. Turning read sharing off stops sharing and hides earlier read counts. These indicators cannot prove that someone understood a message. Your private unread reminders are separate.
POSTS AND AUDIENCES Personal posts, comments, replies, edits, image attachments, and their dates are stored on the host. The author chooses an audience for each new post: Public, Friends, Friends Except, or a named group of selected friends. Audience choices and named-group membership can change later; access is checked again as content loads. A public post can be visible to other signed-in members, including teens, subject to age restrictions. Private family labels, feed-mute choices, and named audience groups are not displayed as public profile information. Notifications are checked against current access and receiving choices. Offline clients and previously delivered operating-system notifications cannot be recalled immediately.
IMAGES, DOWNLOADS, AND CAPTURE Uploaded personal images and normalized previews are encrypted on the host and in the app's local cache. Deleting an image or its post removes ordinary access after synchronization; retained encrypted moderation records remain available to the host administrator. Replaced and removed profile photos are also retained in an encrypted moderation archive. Downloading an image outside the app requires the image owner's permission as well as current viewing and age permissions. A saved download is a normal file outside Kine's protected cache. Withdrawing permission or deleting content cannot recall previously saved files.
Screenshots and recording use a separate mutual setting for each conversation. Kine displays a notice when capture is mutually allowed. Moderators may capture content they are already authorized to view; this exception grants no access to additional conversations. TEST windows allow capture. Windows protection applies only to supported capture methods and cannot prevent every recorder, a modified client, or an external camera. Consent changes take effect when clients receive them; content already captured cannot be recalled.
UPCOMING FEATURES The host stores official upcoming-feature titles, descriptions, and each account's thumbs-up choices. Other users see vote totals, not a list of voters. Signed-in users can open public feature discussions and read comments and replies, including the author's display name and posting time. Comment reactions and the display names of people who reacted are also visible in that discussion. Comments are shared with adults and teens; follow community rules and do not post private information. Comment text is encrypted on the host. Deleted comments are hidden from ordinary discussion views, while retained encrypted records and reports remain available for moderation. Administrators and moderators manage official entries and can remove comments. New feature suggestions go directly to Esme Kintsugi; existing private feature requests remain separate.
PROFILES AND FRIEND REQUEST CONTEXT Your profile can show your display name, About Me text, and interests to signed-in members. Shared interests are highlighted, but your other interests are also visible. Profiles do not disclose your location, email address, or birth date. You can edit your biography and remove optional profile content. Adult accounts can upload a profile photo. Kine keeps encrypted, normalized versions for display and thumbnails, removes image metadata, and does not retain the original profile-photo upload. Teen accounts cannot upload or view uploaded profile photos. Other viewers’ image choices and age restrictions control whether a photo appears or can be deliberately revealed.
A friend request can show how someone found you, such as through an interest or a particular post. The host stores the source type and references needed for that context, not a quoted copy of the post. Context links are checked against current access and deletion rules; inaccessible or deleted content is not exposed through the request. Profile information and request context are available to Esme Kintsugi, the host administrator, for operating and moderating Kine.
What This Host Stores
Your username, display name, and email address; a salted password hash rather than your account password; optional profile details you provide; content category choices and private blocked-phrase filters; account and session records; friends and friend requests; per-friend content-agreement acknowledgments, policy revisions, and acceptance timestamps; recent activity used for online presence; messages, edit versions, image attachments and their normalized previews and retained originals, and trade records; collectible-character collection and message-count progress; and feature requests with sender and date information; support-ticket subjects, messages, reply email addresses, known submitting accounts, delivery status, and dates. Display-name changes, administrator access, and moderation actions are audited with account identifiers and timestamps.
This information supports sign-in and recovery, delivery and history across devices, friendships, trading, rewards, support and moderation. Your friends see your display name, online presence and the messages and collectible characters you share. Feature requests are available to the host administrator. Invitation and recovery emails use the host's configured email provider.
Access Records, App Installations And Interests
Esme Kintsugi’s Kine host records requests that reach it, including failed sign-ins and registrations: UTC time, outcome, route category, known account, authentication status, client version, and the app installation identifier when supplied. Connection IP addresses are recorded; a forwarded visitor IP is accepted only from the explicitly configured trusted local Tailscale proxy. Otherwise the host records the observed connection address without claiming it identifies the visitor. Access metadata containing IP addresses is encrypted and available only to Esme Kintsugi for security review. Access records are eligible for automatic deletion after 90 days, with hourly bounded cleanup while requests arrive; older records can remain until cleanup completes. Passwords, authentication tokens, message bodies, query strings, and raw download invitation codes are not included in these access records. Interrupted requests can have an unknown outcome.
A random app installation identity is stored using Windows user-bound encryption, or an HttpOnly browser cookie for web sign-up. The host stores a hash of its credential and links the identifier to successfully authenticated accounts. Esme Kintsugi may block a known installation as well as an account; this can affect other accounts using that installation. Installation/account associations and moderation decisions are retained for ongoing enforcement unless the retention policy changes. This is not hardware fingerprinting: a new PC, cleared app data, or a client without an identity may not be linkable. Sharing an IP address alone does not cause an account or installation ban. No remote uninstall or device administration occurs.
To help fix connection and installation problems, Kine records the failure type, time, app version, installation identifier, and outcome. These records do not include your messages, reports, or other written content.
Optional interest selections are stored for your account; friends can see all selected interests, with shared interests shown first. Matching ignores capitalization; existing interest labels use the spelling and capitalization in the shared catalog. Labels contributed to the shared interest-suggestion dictionary remain without attribution even after you remove your selection, so a disappearing suggestion does not identify who removed it.
Rooms, Discovery And Places
PUBLIC ROOMS, GROUPS, AND DISCOVERY Hashtag and Nearby Chats and Open groups are public within Kine: other signed-in users, including adults and teens, can enter and read permitted posts. Open groups appear in group discovery with their names and member counts. Posting there shares your display name, message, and its date with those readers. A room is not a private conversation just because you enter it from an interest or a place. Invite Only and Closed groups are not listed in public group discovery. Members can invite current friends to Invite Only groups. Nobody can invite someone into a Closed group until its access setting changes. Invitations disclose the group name, access mode, and inviter to the recipient, who can accept or decline. Current members can change access for Open and Invite Only groups. Only the current leader can change a Closed group’s access; contact Esme Kintsugi if the group needs a new leader. Private group history is available to current group members, including people added later. Making a group Open allows new members to join and read permitted group history, including earlier posts; consider that before changing access. Copies already seen or retained by members cannot be recalled by changing access. The host stores room names, access modes, and revisions, topics or places, membership, invitations, and responses, pins, read markers, messages, edits, attachments, and reports. Adult private groups show shared Group Consent and member acknowledgment status. Every member must acknowledge the current agreement before new messages or edits; changes to membership, access, or shared boundaries can require renewed agreement. Individual non-shared preferences are not displayed as part of Group Consent. The host stores shared agreement versions and acknowledgments. Groups involving teens keep mandatory age protections. Message and attachment content is encrypted on the host, but Esme Kintsugi, the host administrator, can decrypt it for moderation. Room metadata is not all encrypted. Deleted room messages and edits remain in the host's encrypted moderation history under the same retention policy as other messages.
PUBLIC CHAT PRESENCE Public chats show display names under Active when people are currently viewing the chat and marked Online. Elsewhere lists other joined members; location chats show only recent visitors. Away and Offline do not appear as Active. Offline visitors are omitted from location chat lists. The host temporarily keeps chat-view activity in memory to update these lists; changes may take a short time to appear. These lists do not reveal private pins or saved places.
VIDEO LINKS Kine checks message links and redirects through the host to apply video receiving settings. The destination sites may receive requests from the host during these checks. Hovering over or focusing a permitted YouTube link asks the host to retrieve the video title, and your app requests its thumbnail directly from YouTube, which receives your network address and the requested thumbnail. Opening a link uses your browser and the destination website’s privacy practices. Kine has no way to know whether a video is safe or appropriate for your viewing. Use your own discretion.
PUBLIC MODERATION Esme Kintsugi, the administrator, can grant or revoke the Moderator role. Moderators can review eligible public-room reports and retained reported text, respond to reporters, and remove public messages. Their role does not grant access to private conversations, private group history, or private report details, including reasons that could quote private content. Public moderation access requires both current public-room access and public message origin; changing a private group to Open does not expose its earlier private-origin history to moderators. Administrator access remains separate. Role grants and revocations, public report reads, and moderation actions are audited with account identifiers and timestamps. Applicable age restrictions still apply to moderator views.
Interest discovery is optional and is selected by default. When enabled, other signed-in users can find your display name and selected interests and send a friend request. Discovery includes both adults and teens. Counts and popularity include eligible people whose discovery setting is enabled, excluding the person viewing the list. Turning discovery off removes you from subsequent discovery results and counts, but cannot erase something someone already saw. Your existing friends can still see your interests.
MANUALLY CHOSEN PLACES Nearby Chats starts with an empty place search. Kine does not use GPS, your IP address, or a map provider to guess or prepopulate your location. Everyone can manually browse named places and neighborhoods. A place you browse or a room you pin is not a declaration that you live there. Adults can explicitly save one optional personal place privately; this choice is encrypted on the host, can be cleared, and is not displayed to other users. Teen accounts cannot save a personal location. Room pins, read markers, and posts can still associate an account with a place's public room. Avoid posting a home address, school, routine, or other identifying details. The host stores a shared open-data place catalog and cached distances for browsing; these are not device-location readings.
ROOM CONTENT AND YOUR CHOICES Automatic topic screening is not active in this release. Messages in public rooms and private groups appear without automatic screening. Kine cannot automatically tell whether every post respects your topic preferences, and unwanted or upsetting content may be visible. Public rooms are shared by adults and teens. Mandatory age, profanity, and uploaded-image restrictions still apply, as do available content-category and receiving-setting controls. Extra permissions granted to an individual friend do not apply to public rooms. Reporting and moderation remain available.
When automatic screening is enabled in a future release, a model running locally on the host may examine post text and supported images, including edits, to suggest content categories. That screening path does not send content to a cloud model. The host can retain screening status, category results, revision references, and model identifiers, plus cached classification results, to apply rules and support moderation. Automated screening can miss harmful material or flag harmless material; it is not a guarantee of safety or consent.
Where a post is hidden by an available content control, an age-permitted, deliberate one-time reveal offers a choice. Mandatory age restrictions cannot be bypassed by reveal. Respect other people's boundaries, avoid sharing identifying details, and report concerning posts. Esme Kintsugi, the host administrator, can review retained reported content even when a reader cannot reveal it.
How Protection Works
The Windows message vault uses Windows data protection tied to the current Windows user. Public app and website connections use HTTPS to protect data in transit. Server message history and retained moderation copies are encrypted using keys available to the host.
Encryption helps protect stored data; it does not make the host unable to read it. Account details and service metadata are not all encrypted in the database. The host administrator has access needed to operate the service. Someone with access to an unlocked account or device may be able to read its messages.
What Deletion Means
Deleting a sent message removes it from both participants' normal histories. Removing a received message hides it from your own history. Connected clients clear the affected text, edit versions and quoted copies when they synchronize; a disconnected device needs to reconnect first.
The host retains an encrypted moderation copy of deleted messages and edits. Deleting from a conversation is not a promise of permanent erasure from the host. It also cannot erase screenshots, exports, backups or copies held by another person. Retained moderation history is kept indefinitely unless the retention policy changes.
Your Choices
Optional profile details can be left blank. You can mute notifications, remove friends, and delete or remove messages in the app. Permitted message notifications may show the sender and message text. Held content stays generic, and blocked content is not previewed. Windows controls notification display, including Do Not Disturb; Kine does not submit notifications while the session is locked. Notification previews may be stored by the operating system outside Kine’s encrypted vault. Deleting a message in Kine cannot erase those operating-system copies. Ask the person who shared this host with you about privacy or retention questions before registering; signed-in users can also use Request Feature to contact the host administrator.
Content Agreements And Their Limits
Content boundaries are an agreement between two friends. Only the mutual overlap is shown under Mutual Consent. Individual choices that do not overlap remain private. Both adults must review and acknowledge their shared boundaries before messaging. Conversations involving a teen skip this setup while mandatory age restrictions remain. Shared preferences are not blanket permission, and either person may change their mind. Your Open To baseline is shown as locked choices in friend setup; review your defaults in Setup to change them. Friend-specific additions remain separate.
Adult conversations require mutual acknowledgement; conversations involving a teen do not. Age restrictions and applicable profanity rules still apply. You choose which optional topics and images to open to, ask before showing, or keep closed. Optional categories start off, including images. Friend-specific choices can add to your current baseline; changing the baseline or shared choices can require renewed agreement. Strict Reveal holds permitted incoming content until you choose to reveal it.
Labels and recognition checks are secondary aids, not a substitute for respecting the agreement. No filter can promise to catch every trigger. Sender labels can be incomplete or wrong, and keyword checks cannot understand every topic, image, euphemism or personal context. Private blocked phrases add another control; they do not create a perfect safety guarantee.
Image Attachments
Images may be sent with or without a caption, up to 10 MB. Supported files are normalized for display with metadata stripped from the delivered preview; GIFs preserve their animation in sanitized previews. Delivered image attachments, including encrypted originals, follow the same host moderation-retention policy after message deletion. Normal viewers receive the normalized preview; retained originals are available only through authorized administrator review. Original files may contain embedded metadata, including camera details or location, which the host retains with the original. Keeping images closed does not hide otherwise permitted text. Authorized images may download in the background into the encrypted local cache before they are opened; visual permission and age restrictions still apply. A closed image can be opened once through an explicit inline confirmation when its other content boundaries permit it. This does not change your Open To choices or create a lasting image-viewing grant; the closed placeholder returns after the viewer closes.
Support Requests
Support tickets submitted in Kine are encrypted on the host and visible only to its administrator. A copy is emailed using private host configuration. When mailbox import is enabled, the host checks its support inbox once a minute and imports only new messages identified as Pokemail Support, including sender, subject, message text, and received date. Import starts from enablement, excludes unrelated mail and attachments, and does not mark messages read or delete them. Signed-out usernames or email addresses are claims, not verified account identities. Deleting a support ticket removes its stored message and reply-email payload; creation, delivery, and deletion metadata remain. Deleting it in Kine cannot erase an email copy already delivered to support.
Using Kine
Creating an account or continuing after this notice requires explicit acceptance of these data terms. Acceptance confirms that you understand the host's access to history and its retention of moderation copies. If you do not agree, do not create an account or choose Sign Out. Acceptance does not make encryption end-to-end or guarantee complete erasure, uninterrupted availability, or perfect security.