PRIVACY POLICY

1. Purpose and data controller

This policy explains how KINITY processes your data when you use the KINITY mobile app, the kinity.fr website and their associated services.

Controller

KINITY, SASU with share capital of 100 €

SIREN

108 997 883

Registered office

6 rue d’Armaillé, 75017 Paris, France

For any questions or requests relating to your data, contact KINITY at contact@kinity.fr or on 01 84 16 45 61.

2. Key principles

• KINITY does not sell or rent your personal data.
• Data is limited to what is necessary to operate, secure, moderate and fund the service.
• Your phone’s precise location is used only with system permission and when you request a feature that needs it.
• Refusing tracking or personalised advertising does not block access to KINITY; limited, contextual or non-personalised ads may still be displayed where permitted by law.

3. Data processed in the app

Account and profile

KINITY processes your email address, an internal identifier, technical authentication information, your name or display name, your username, date of birth, age, selected gender, biography, profile photo, declared city or geographical area, and preferences. Your password is managed securely by Supabase’s authentication service; KINITY never accesses it in plain text.

Activities and participation

When you create, join or manage an activity, KINITY processes its title, category, description, images, date and time, address and geographical coordinates, visibility, capacity, status, organiser, participation requests and participant list. Activities hidden from your list and your notification choices are also recorded to respect your settings.

Connections, blocking and reports

KINITY processes friend requests, connections, invitations and activity shares, as well as blocked profiles. A report may include its reason, your additional details, the profile, activity or message concerned, contextual identifiers, its priority level, processing status and the action taken. The person reported cannot access the identity of the person who submitted the report through the app.

Messages, photos and attachments

Direct messages and activity-related exchanges include the text, sender, recipients or participants, date, read status, technical conversation events and, where applicable, photos or attachments. This content is visible only to people authorised to participate in the conversation, subject to the security, moderation and support needs described below.

Notifications and device

If you allow notifications, KINITY processes Expo, Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) notification tokens, the device platform, delivery preferences, events requiring a notification and technical delivery information. The content displayed on your lock screen depends on your iOS or Android settings.

4. Location

With your permission, the app may obtain your precise location while in the foreground to display nearby activities, centre the map, calculate a distance or help you select a place. KINITY does not continuously track your movements in the background or create a permanent history of your phone’s location.

However, the location chosen for an activity — address, label and coordinates — is stored with that activity and may be visible to authorised users depending on its visibility. A city or location that you add to your profile may also be visible on it. You can withdraw location permission in your device settings; nearby features will then be limited.

5. Moderation and abuse prevention

To protect the community, KINITY checks certain content intended to be public: name, username, biography, activity description and profile photo. Content subject to this check is sent to OpenAI through a secure server function to identify, in particular, hateful, sexually explicit, threatening, graphically violent or dangerous content. Private conversations are not sent to OpenAI as part of this automated moderation.

An automated decision may prevent content from being published. It does not produce legal effects or similarly significant effects. You can request a human review or challenge a refusal by emailing contact@kinity.fr. KINITY primarily retains a cryptographic hash of the content and the technical decision for a short period, rather than an additional copy of the raw content solely for this purpose.

Rate limits and pseudonymised technical logs may also be used to prevent automated sign-ups, spam, intrusion attempts and misuse of the contact form.

6. Advertising and consent

The app uses Google AdMob to display ads. Depending on your region, choices and phone permissions, the Google Mobile Ads SDK may process your IP address, an estimated general location, device or advertising identifiers, diagnostic information, and the ads displayed and interactions with them. This data is used to serve and measure ads, combat fraud and, only when you agree and the law permits, personalise advertising.

In the European Economic Area, the United Kingdom and Switzerland, your choices are collected through Google’s consent management platform. You can review them from Paramètres → Confidentialité publicitaire (Settings → Ad privacy) in the app when this option is available. On iPhone, tracking permission can also be changed in iOS settings. See Google’s privacy policy.

7. Data processed on the website

The contact form processes your name, email address, subject, message and consent to send your request to KINITY. Pseudonymised cryptographic hashes derived from the IP address and email address limit abuse; the raw IP address is not stored in plain text in the database used for this rate limiting.

The Account deletion page allows you to submit a request when the app is inaccessible. It processes the account email address, the name or display name provided, confirmation of the request and any additional information needed to verify it.

8. Purposes and legal bases

Swipe the table sideways to read both columns.

9. Visibility and recipients

Depending on your settings and use of the service, your profile, photo, activities and certain participation details may be visible to other users. A private activity and its exchanges remain limited to authorised people. Before publishing an address, photo or message, check that they do not reveal information you wish to keep private.

Within KINITY, only authorised people can access data when necessary for support, security, moderation, handling a report or compliance with a legal obligation. Authorities may receive data when a legally valid request requires it.

10. Service providers

• Supabase: authentication, database, image and attachment storage, server functions and real-time synchronisation.
• OpenAI: automated analysis limited to public content submitted for moderation, including text and profile photos.
• Google: AdMob for advertising; Google Maps Platform and Places for maps, addresses and place searches; FCM for Android notifications.
• Apple: APNs for notification delivery on iOS and app distribution services.
• Expo: technical build services and, depending on the available channel, notification routing.
• Resend: sending authentication, support and user feedback emails and website messages.
• Vercel: hosting and security for the kinity.fr website.
• OVHcloud: hosting for KINITY’s business email service.

Each provider receives only the data necessary for its task and acts according to its applicable legal role and commitments. Some services, particularly advertising services, may also act as independent controllers for their own processing.

11. International transfers

Some providers may process data outside the European Economic Area, particularly in the United States. Depending on the service and country, these transfers rely on an adequacy decision, the EU–US Data Privacy Framework where the recipient holds valid certification under it, or standard contractual clauses supplemented, where necessary, by additional measures. You can request information about the applicable safeguards at contact@kinity.fr.

12. Retention periods

• Account, profile, connections and preferences: for the life of the account, followed by deletion or anonymisation when the account is deleted, subject to the information that must be retained as set out below.
• Activities, participation and conversations: while they remain available in the service. When an activity is removed from a participant’s list, it may remain necessary for other participants. If an account or activity is deleted, information useful for continuing exchanges may be anonymised rather than erased where this protects other users’ rights.
• Photos and attachments: for as long as they are associated with an accessible profile, activity or conversation, followed by deletion depending on the user’s action and backup constraints.
• Phone location: used as needed for the requested feature and not retained as a continuous history. An activity’s location remains stored with it.
• Notification tokens: until they become invalid, notifications are disabled, the device is signed out or the account is deleted. Delivery logs are retained for the period necessary to diagnose issues and secure the service.
• Moderation and abuse prevention checks: publication permissions are short-lived; quota requests are retained for no more than 24 hours. Reports and associated measures are retained while being handled, then with restricted access for the period necessary for security and the defence of rights, as a rule no more than five years after they are closed.
• Contact requests: for the time needed to respond, then no more than twelve months after the last exchange, except for contractual follow-up or litigation.
• Requests to exercise rights: for the time needed to process them, followed by retention of strictly necessary evidence for the applicable limitation period, as a rule five years.
• Advertising data: according to the periods defined by Google and the partners listed in the consent interface.

Backup copies are gradually overwritten according to the provider’s cycles and are restored only in the event of an incident. Data may be retained for longer where a legal obligation, an investigation or the defence of a right requires it, with access limited to that purpose.

13. Account deletion

You can delete your account directly in the app from Paramètres → Supprimer le compte (Settings → Delete account). If you can no longer access the app, use the KINITY account deletion page.

Deletion closes the account and erases or anonymises the associated data, except where limited retention is necessary for security, other users’ rights, a legal obligation or the defence of a right. KINITY may request reasonable verification of your identity to prevent a third party’s account from being deleted.

14. Your rights

Depending on your situation, you have rights of access, rectification, erasure, restriction, objection and portability. You can withdraw consent at any time without affecting processing already carried out lawfully, and give instructions on what should happen to your data after your death.

Send your request to contact@kinity.fr, stating the right concerned and the account email address. KINITY normally responds within one month; this period may be extended by two months for a complex request, in which case you will be informed. Proof of identity may be requested only where there is reasonable doubt and to the extent necessary. You can also lodge a complaint with the CNIL.

15. Security

KINITY implements measures appropriate to the risk: encrypted communications, access controls, separation of privileged functions, access rules at the data and storage level, rate limiting, content validation and error monitoring. As no system is infallible, KINITY assesses incidents and informs individuals or authorities where required by regulations.

16. Adult users

KINITY is limited to people aged 18 or over. The date of birth is used, in particular, to check this requirement and display the age on the profile. If KINITY learns that an account belongs to a minor, it may suspend it and delete the associated data. A parent or legal representative can report such an account to contact@kinity.fr.

17. Cookies and similar technologies

As of the date of this policy, the kinity.fr website does not use advertising cookies or audience measurement tools that require consent. Strictly necessary mechanisms may be used to ensure the website’s operation and security. If new optional cookies are added, appropriate information and a choice will be provided before they are placed.

In the app, the identifiers and technologies of Google’s advertising SDK are governed by your privacy choices described in section 6 and your device settings.

18. Changes to this policy

This policy may change to reflect a new feature, a new provider or a change in the law. The date and version number will be updated. In the event of a significant change, KINITY will inform you in the app or by another appropriate means before it takes effect where required.