Kinsera Privacy Policy

This policy explains what Kinsera processes to provide family controls on iPhone and iPad, what stays on the device, and which choices you have. Mandatory rights in your country of residence prevail where they provide stronger protection.

1. Controller and contact

The controller is Lester Romero Bernardo (RomeroDev), based in Valencia, Spain. For privacy, support, or data requests: romerodev.app@gmail.com.

2. Data Kinsera processes

Kinsera stores profiles, preferences, policies, Family Controls selections and tokens, timers, schedules, time requests, and aggregate counts on the device. Extensions use a local App Group to enforce the policy. If you enable a family connection, the app can sync protection commands and receipts; when the related family features are enabled, it can also share protection state, battery, and location observations with their timestamps. Each link uses a private one-time invitation, not a reusable public URL. The URL is not bound to an Apple Account before redemption: whoever receives it can claim it first, so send it directly to the intended device.

3. What we do not collect or send

Kinsera does not operate its own backend, show ads, or track people across apps or sites. It does not send child names, app names, bundle IDs, domains, Screen Time tokens, messages, photos, or browsing/activity history to analytics. Child Mode may send an opaque Apple selection in an encrypted CloudKit field to enforce a session on a linked device; the family flow can sync location only when the location feature is configured and authorized.

4. On-device processing and permissions

Family Controls authorization, Managed Settings enforcement, and aggregate reports run locally through Apple's frameworks. Local controls continue to work offline. Remote control depends on iCloud/CloudKit, the family connection, and Apple's command delivery; remote state is confirmed only after the device receipt arrives. Notifications, Face ID, and location are requested according to the features you enable, and permissions can be revoked in Settings.

5. Reports and diagnostics

When you authorize Device Activity, Kinsera shows totals and aggregate counts on the device. Extensions remain network-free. Diagnostics are limited to technical states and counts; they do not include names, domains, tokens, or policy contents.

6. Apple and purchases

Apple processes Screen Time authorization, system notifications, device services, and purchases through StoreKit. Kinsera uses RevenueCat to validate receipts, sync subscriptions, and manage Premium entitlements. RevenueCat receives purchase history and the anonymous subscriber identifier generated by its SDK; it uses this data for subscription functionality and its service analytics, not for advertising tracking. Apple handles payment, and Kinsera does not receive your full card details. Kinsera does not send family profiles, child names, location, Family Controls selections, routes, or child activity to RevenueCat. Read RevenueCat's [privacy policy](https://www.revenuecat.com/privacy-policy) and its [developer privacy guide](https://www.revenuecat.com/docs/platform-resources/apple-platform-resources/apple-app-privacy).

7. Roles, children, and responsible use

The person configuring a policy must have authority to do so and should explain the active limits to the protected user. Kinsera does not provide secret surveillance or message reading. Location is not part of Child Mode; another family feature can share location observations if configured and authorized. The responsible adult must follow applicable law, respect the child's autonomy and safety, and never use the app to control another adult without consent.

8. Retention, deletion, and rights

Synced records are hosted in Apple's iCloud/CloudKit container. Privacy lets you export one connection at a time as JSON; the file may contain location, battery, protection state, time requests, and command/receipt history. It excludes participant identities and opaque Family Controls selection tokens. A guardian can permanently delete one device's complete zone only after that client confirms Child Mode has ended. If the share has another client, participant or pending invitation, Kinsera retains the zone because one receipt cannot confirm every device; remove extra participants through Apple's share controls first. A participant can leave after the session ends and guardian controls are unlocked: their access is revoked while the owner's copy and other participants remain. This feature is implemented in the development version and is pending physical validation and release. Until it is published, contact support for access or erasure requests. Uninstalling Kinsera does not guarantee that iCloud records are deleted.

9. Changes

Material changes will be published here with a new update date and, where appropriate, an in-app notice.