Privacy Policy

Kinora OS is a family organisation platform that helps households manage shared calendars, task lists, important documents, medical information and private photos. Because Kinora OS may hold sensitive information about your family — including special personal information such as health data and information relating to children — we take a conservative, privacy-first approach to everything we do.

By downloading, installing or using Kinora OS, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of it, please do not use the Service.

The Responsible Party (as defined in POPIA) for the processing of your Personal Information is:

Our Information Officer is registered with the Information Regulator of South Africa and is responsible for overseeing our compliance with POPIA. You may contact them directly with any privacy-related enquiry, access request or complaint.

We only collect information that is necessary to provide, secure and improve the Service. The categories of Personal Information we may process include:

• Account information: name, email address, phone number, country, password (hashed with bcrypt), profile picture and family/household role.
• Family content you create: calendar entries, tasks, lists, notes, uploaded documents and photos, family member profiles, emergency contacts, pets, household assets and staff records.
• Special personal information: health, medical aid, prescriptions, allergies, healthcare providers and children's information — only where you choose to add it and only within your family workspace.
• Device & usage information: device model, operating system, app version, language, crash logs, audit logs and anonymised diagnostic data.
• Billing information: card last-4 digits only — we never store full card numbers. Full payment details are handled by our payment processor (e.g. Google Play Billing) directly.
• Communication data: messages you send to support and feedback you submit.

We do not sell your data, we do not use it for third-party advertising, and we do not scan the contents of your vault for marketing insights.

We process Personal Information on the following lawful bases under section 11 of POPIA:

• Consent — where you actively opt in (for example, uploading medical records or enabling notifications).
• Contractual necessity — to deliver the Service you have signed up for.
• Legitimate interests — to secure the Service, prevent abuse and improve reliability.
• Legal obligation — where we must comply with applicable laws, including POPIA itself.

We use Personal Information to: (a) provide core features (calendar, lists, documents, medical hub, photo vault); (b) authenticate users and secure family workspaces; (c) provide customer support; (d) send service-related notifications; (e) diagnose and fix bugs; and (f) comply with legal obligations.

Your family's data belongs to your family. We do not sell, rent or trade Personal Information. We only share information in the following limited circumstances:

• With members of your own family workspace as directed by you, using per-entity permissions that you can revoke at any time.
• With trusted operators (processors) essential to operation — cloud hosting, storage, email delivery, payment processing (e.g. Google Play Billing), and AI providers used strictly for summaries you explicitly request. All operate under contractual confidentiality obligations and POPIA-level safeguards.
• Where required by law, regulation or valid legal process.
• In connection with a business transfer (merger, acquisition or restructure) subject to confidentiality obligations and prior notice to affected users.

All uploaded files and photos are stored in the Emergent Object Store and are encrypted at rest using AES-256, with TLS 1.2+ in transit. Access is gated by JWT-authenticated sessions and short-lived, cryptographically signed URLs tied to your session. Passwords are stored as salted bcrypt hashes — never in plain text. Family sharing uses per-entity permissions with revocation.

Kinora OS is designed for family use. A parent, legal guardian or competent person may add a child's information to their private family workspace for the purpose of household organisation, medical tracking and safekeeping.

In accordance with sections 34 and 35 of POPIA, we require that only a parent, guardian or duly authorised adult adds or manages information relating to a child. We will not knowingly allow a child under 18 to create their own independent account, and we do not use children's information for marketing or profiling.

As a Data Subject you have the following rights, which you may exercise at any time by contacting our Information Officer at info.officer@embercoredigital.co.za:

• Right of access — to confirm what Personal Information we hold about you.
• Right to correction or deletion of inaccurate, irrelevant, excessive, outdated, misleading or unlawfully obtained information. Delete your account and all data at any time via Account → Delete my account — see our Account & Data Deletion page.
• Right to object to the processing of your Personal Information, on reasonable grounds.
• Right to withdraw consent where processing is based on consent.
• Right to data portability — request a machine-readable export of your family data at any time via Account → Export my data.
• Right to lodge a complaint with the Information Regulator (see section 10).

We will respond to verified requests within a reasonable period, and in any event within the time frames prescribed by POPIA.

The Kinora OS mobile application uses a minimal set of on-device tokens (analogous to cookies) strictly to keep you signed in and to remember your preferences. Our marketing website uses only essential and, where you consent, anonymous analytics cookies.

We retain Personal Information only for as long as necessary to provide the Service and comply with our legal obligations. Backups are rotated and permanently purged on a rolling schedule not exceeding 90 days from deletion. If you delete your account, we will delete or de-identify your Personal Information within 30 days, subject to legal hold requirements.

Some of our operators may process data outside the Republic of South Africa. Where this occurs, we ensure that the receiving party is subject to laws, binding corporate rules or agreements which uphold principles substantially similar to POPIA, in line with section 72 of POPIA. Family photos and documents stored in the Emergent Object Store are held in encrypted form under such arrangements.

We would prefer to resolve any concern directly. Please contact our Information Officer at info.officer@embercoredigital.co.za in the first instance.

You also have the right to complain to the Information Regulator:

We may update this Privacy Policy from time to time to reflect changes in the Service, the law or industry practice. Any material change will be communicated in-app or by email at least 14 days before it takes effect. The "Effective date" at the top of this page always reflects the current version.

Questions about this Privacy Policy or your Personal Information? We're a real team of humans and we'd rather hear from you directly.