Privacy Policy
Last updated: [DATE]. Effective: [DATE].
Check with Kin (“we”) checks messages that you or your family forward to us and tells you whether they look like scams. This policy explains what we collect, why, how long we keep it, and what we never do with it.
The short version
- We only read messages that a registered family member sends to kin@checkwithkin.com or texts to (555) 010-0000. Messages from anyone else are discarded unread.
- Forwarded messages and screenshots are encrypted and deleted automatically after 30 days. We keep only the verdict, the scam category, the sender's domain, and timestamps.
- We never use your messages to train AI models, and we contract with our AI provider so that they do not either.
- We never sell or share personal information for advertising. There are no advertising or analytics trackers on this site.
What we collect
- Early-access list: if you join the list on our website, we keep your email address, which channels your parent gets suspicious messages on, how many parents you'd sign up, and the date. We use it only to contact you about early access, and delete it if you ask or if early access closes without you joining. The form uses Cloudflare Turnstile to block automated sign-ups; Cloudflare processes basic browser signals for that check under its own privacy policy.
- Account information (from the adult child who signs up): name, email, phone number, billing details handled by Stripe. We do not store card numbers.
- Parent contact information: the parent's email address and/or mobile number, used only to recognize their messages and reply to them.
- Forwarded content: the emails, text messages, and screenshots a registered family member sends us, including any personal information those messages happen to contain (which may include third-party names, account details, or health-related lures such as fake Medicare notices).
- Verdict records: our result (Scam / Unsure / No red flags found), the category of scam, the sender's domain, and the time. These power the weekly digest and are kept while the account is active.
- Service logs: timing and error information. Logs never contain message content or screenshots.
How we use it
- To analyze the forwarded message and send the verdict back to the person who sent it.
- To alert the adult child(ren) on the account when a verdict is 🚩 Scam, and to send the weekly digest.
- To run quality checks on flagged messages. [Founder: specify who may review, under what conditions, and that the account holder consented in the Terms.]
- To bill, support, and secure the service.
Who else sees it
Service providers acting on our instructions only: [Cloudflare] (hosting, email routing, storage), [Anthropic] (AI analysis, under terms that prohibit training on our data), [Twilio] (text messages), [Stripe] (payments), and lookup services that receive only a website address or domain, never your message ([RDAP registries], [Google Safe Browsing]). We do not sell personal information. We will disclose information if legally required and will tell you when we are allowed to.
Retention
- Forwarded messages and screenshots: deleted 30 days after receipt, automatically. Copies held by our text-message provider are deleted as soon as we have received them.
- Verdict records: kept while the account is active; deleted [90] days after the account closes.
- Account and billing records: as long as required for tax and legal purposes.
Your parent's rights and consent
The parent is told, at setup and on the printed card, that verdicts marked Scam are also sent to the adult child(ren) on the account. The parent may stop those alerts at any time by replying STOP ALERTS and may stop all texts by replying STOP. [Founder: address capacity/POA situations and how a parent may request deletion directly.]
Your rights
You may request a copy of your information, correct it, or delete it by emailing [privacy@domain]. We honor these requests for all account members regardless of state of residence. [Founder: add CCPA/CPRA, Virginia, Colorado, Connecticut, Texas etc. notices as applicable, and a “Do Not Sell or Share” statement.]
Security
Content is encrypted in transit and at rest; forwarded messages are additionally encrypted with keys held separately from storage. Access is limited to the founder and protected by hardware two-factor authentication. [Founder: summarize incident-response and breach-notification commitments.]
Children
The service is for adults. We do not knowingly collect information from anyone under 18.
Changes
We will email account holders before any change that reduces these protections.
Contact
[Legal entity name], [mailing address], [privacy@domain].