Kinpack Privacy Policy

Last updated: 2026-10-28 · Effective date: 2026-10-28

Kinpack is a family packing app. It holds what it needs to build your packing lists — who is travelling, where you are going, and what you are taking — and nothing else. It has no advertising and no trackers. It does send a small, fixed set of usage counts and crash reports so we can fix what breaks, and those contain nothing about your family's trips, lists or travellers — see No ads, no tracking. You can turn the usage counts off in Settings › Privacy & data › Share usage analytics; see Turning analytics off.

Who we are

Kinpack (“we”, “us”) is operated by Long Software LLC, 8401 Mayland Dr #6010, Richmond, VA 23294, USA. For anything in this policy, including access, correction, export and deletion requests, contact support@kinpack.app.

Where the EU or UK General Data Protection Regulation (GDPR) applies, Long Software LLC is the controller of the personal data described here. Kinpack is intended for adults; see Children's information.

What we collect, and where it goes

Everything below is data you enter, data your sign-in provider or app store gives us, or technical data your device sends when the app connects to a service. We do not buy data, and we do not receive data about you from data brokers.

DataWhere it is storedWhy
Email address, display name, and either the identifier from your Google or Apple sign-in or — if you sign up with an email address — a password Firebase Authentication (a password is stored only as a salted hash, which we cannot read) and your profile document in Firestore To sign you in and to identify you to the people you share a household with
Traveler names, including the names of children in your household, and whether each person saved to your household is an adult or a child Firestore (household and trip documents) To build a packing list per person. See Children's information
Trip destinations, dates, and packing list content Firestore The core function of the app
Photos you attach to items Firebase Cloud Storage So you can recognise your own things in a list
Destination names and coordinates Sent to Open-Meteo — see Third parties To look up a place and its forecast so the list can suggest weather-appropriate items
Travel documents and their attachments On your device only, encrypted — see Travel documents To keep confirmations and passes to hand without putting them on a server
Notification preferences, and a per-device record — including a push notification token — used to schedule and deliver reminders Firestore. A reminder pushed to your device travels through Google's Firebase Cloud Messaging and, on iPhone and iPad, Apple's push notification service, and carries the reminder's text (an item name or note and the trip name) So a reminder fires once, on your devices, at the right local time — even when the app is closed
Household invitations you send (the invited person's email address) Firestore To let someone join your household
Subscription purchase records — if you buy Kinpack Plus: the store's transaction identifiers, the product, and its expiry, renewal and refund status. Never your payment details, which only Apple or Google hold A server-only record in Firestore that the app cannot read, and sent to RevenueCat together with your account identifier — see Third parties To confirm with the store that your household is entitled to Plus, and to turn it off when the subscription ends or is refunded
Web purchase records — only if you buy Kinpack Plus on the web: your Stripe customer identifier, the subscription's status, plan, period dates and trial status, and the identifiers of the payment events Stripe tells us about. Never your card number A server-only record in Firestore that the app cannot read; the payment itself, your billing details and receipts are held by Stripe — see Third parties To turn Plus on for your household when you pay on the web, keep it in step with renewals, failed payments and cancellations, give you one free trial at most, and open your billing portal
Product analytics and crash diagnostics — counts and event names only (for example “a trip was created”, “the trip limit was reached”, an error type and where it happened) Sent to Datadog, stored in the United States — see Third parties To see which parts of Kinpack are used, whether the free tier is drawn in the right place, and what is breaking
Technical data: your device's IP address, and the device type, operating system and app version, which any internet connection or app request carries. With our analytics and crash reports, Datadog also records an approximate location worked out from the IP address (country, region and city, including that city's latitude and longitude — not GPS), your network provider, and your device's language and region setting and time zone Received by Google (Firebase), and by Open-Meteo, Datadog and RevenueCat when the app talks to them — see Third parties. Datadog stores it, and the approximate location, with those reports in the United States for up to 30 days. We do not use it to locate you precisely To deliver the service, keep it secure and prevent abuse, and diagnose errors and performance problems
Advertising and cross-app tracking data None collected See No ads, no tracking

We do not collect precise device location. When you pick a destination you type a place name; we do not read your device's GPS. A service that receives your IP address can infer an approximate (city- or country-level) location from it; see Third parties. Datadog does this for our analytics and crash reports and stores the result, to city level with that city's coordinates; see Datadog.

Travel documents stay on your device

Travel Documents — your booking confirmations, boarding passes and itineraries, the details you type into them, and any files you attach — are stored only on the device you entered them on. They are encrypted with AES-256-GCM in the app's private storage, and the key is held in the device's secure keystore (Keychain on iOS, Keystore on Android).

They are never uploaded to us, never sent to any third party, and are not part of any backup we hold. They stay only on this device: they are not included in your device's backups (iCloud, your computer or Android backup), and they don't move to a new phone. That also means we cannot recover them for you: if you lose or replace the device, restore it from a backup, delete the app, or delete your account on that device (see what deletion removes), they are gone. The feature is unavailable in the web version of Kinpack for the same reason.

Kinpack is not a place for your passport or other IDs. The feature is scoped to bookings, the app tells you so where you add a document, and identity documents cannot be filed as a type. A document is free text, so anything you type into one is held as you typed it — and a document saved on an older version of Kinpack, before that scope was narrowed, is still readable on the device it was saved on, under the same encryption and subject to everything in this section.

Third parties

Google (Firebase) — our processor

Kinpack runs on Google Firebase: Authentication, Firestore, Cloud Storage, Cloud Functions and Hosting. Google processes this data on our instructions as a processor under the Google Cloud Data Processing Addendum. Our Cloud Functions run in Google's us-central1 region, and project data is stored in the United States (Cloud Firestore in Google’s us-east1 region). If you use Kinpack from outside that region, your data is transferred there; transfers out of the EEA and UK rely on the Standard Contractual Clauses incorporated into Google's DPA.

We require each processor named in this section, by contract, to use your data only to provide its service to us and to protect it to at least the standard described in this policy.

Open-Meteo — place lookup and forecasts

To look up a destination and its forecast, Kinpack sends the destination name you typed, or its coordinates, to Open-Meteo (geocoding-api.open-meteo.com and api.open-meteo.com). No account identifier, email, traveler name or trip content is included in that request. The request is made directly from your device, so Open-Meteo also receives your device's IP address, as any website you visit would. Open-Meteo is an independent service with its own terms, not our processor. Apart from the services named on this page — Google, Datadog, RevenueCat, and Apple and Google as sign-in, push-notification and app-store providers — Open-Meteo is the only third party that receives any data from Kinpack.

Datadog — product analytics and crash diagnostics

Kinpack sends a small, fixed set of product events and crash reports to Datadog, so we can see which parts of the app are used and fix what breaks. The events are counts and names we chose ourselves — “a trip was created”, how many items a generated list had, that the free trip limit was reached, that the Plus screen was opened. Crash reports contain the type of the error, the code location it happened in and where it was caught.

They contain nothing about your family. No trip names, no destinations, no dates, no traveler names — including children's names — no packing list contents, no photos, no email addresses, no household, trip or item identifiers, and no text you typed. Screen names are sent as a route pattern such as /trips/:id/pack, never with the identifier filled in. The only account information attached is your Firebase account identifier, which is a random string. We will send you the complete list of events on request.

Turning analytics off. In the app, go to Settings › Privacy & data › Share usage analytics. It is on until you turn it off. While it is off, Kinpack sends Datadog no usage events — no screens viewed, no features used and no periodic count of your trips and household — starting immediately, including for the rest of the session you are in. Crash and error reports are still sent, because they are how we find and fix what breaks; they contain only what is described above, and they still reach Datadog with the connection details described below. The setting is kept on your device, so it applies to whoever signs in on that device; if you use another device or reinstall the app, check the setting there. You can also email us to object to analytics instead — see Our legal bases.

What Datadog records about the connection. Every analytics event and crash report reaches Datadog from your device's internet connection, and we have chosen to keep Datadog's IP-address and location collection switched on. So each one is stored with: your device's IP address, in full; an approximate location worked out from that IP address — country, region and city, with the latitude and longitude Datadog assigns to that city, not a position from your device's GPS; your network provider (internet provider or mobile carrier); and device, operating-system and app details, such as the device model, operating system and version, app version, language and region setting, time zone and connection type. Because they are stored with the same events, while you are signed in they are linked to your Firebase account identifier. We use them only to diagnose errors and performance problems — for example, whether a crash affects one device model, one app version or one part of the world — and never for advertising or to track you. They are kept for the same retention window as the events themselves (see How long we keep it).

Datadog processes this data on our instructions as a processor, under the data processing addendum that forms part of our agreement with Datadog. It is stored on Datadog's US5 site, in the United States. That is where the data of every Kinpack user is held, including users in the EEA, the UK and elsewhere outside the United States. If you are in the EEA or the UK, this is therefore a transfer of your data to the United States. That transfer is protected by the European Commission's Standard Contractual Clauses (with the UK's International Data Transfer Addendum for UK users), which are part of that data processing addendum, and by Datadog's certification under the EU–U.S. Data Privacy Framework.

RevenueCat — subscription validation

If you buy Kinpack Plus, the purchase itself is made with, and billed by, Apple's App Store or Google Play. To check that the purchase is genuine and to keep your household's Plus status in step with renewals, cancellations and refunds, Kinpack uses RevenueCat. RevenueCat receives your Firebase account identifier (a random string), the store's records of your subscription — product, purchase and renewal dates, expiry and refund status, and the store's transaction identifiers — and, from the app, its version and your device's IP address. It receives nothing about your trips, your travelers or your lists, and it never sees your payment details: those stay with Apple or Google, and so do we. RevenueCat processes this data on our instructions as a processor. RevenueCat is based in the United States; if you are in the EEA or UK, this data is transferred there under the safeguards in RevenueCat's data processing agreement with us. If you never buy Plus, nothing is sent to RevenueCat.

Stripe — web payments

If you buy Kinpack Plus on the web, Long Software LLC is the seller and Stripe, Inc. processes the payment, calculates and collects sales tax, sends your receipts, and runs the portal where you manage or cancel the subscription. You enter your payment card, billing name, billing address and email on Stripe's own checkout page; Stripe collects them under its privacy policy, and also uses them, and device and network information from that page, to prevent fraud. We never receive your full card number. We send Stripe your Firebase account identifier, your household identifier, the email address on your Kinpack account (so the receipt reaches you) and which plan you chose. Stripe sends back the customer and subscription identifiers, the subscription's status, plan and dates, and the last four digits and brand of your card if you open the portal. Stripe receives nothing about your trips, your travelers or your lists. For the payments it processes for us Stripe acts as our processor, and as an independent controller for its own fraud-prevention and legal duties. Stripe is based in the United States; if you are in the EEA or UK, data is transferred there under Stripe's data processing agreement and the EU–U.S. Data Privacy Framework. If you never buy Plus on the web, nothing is sent to Stripe. Purchases in the iPhone, iPad and Android apps never go through Stripe.

Sign-in providers

If you sign in with Google or Apple, that provider authenticates you and gives us an identifier, and — depending on what you allow — your email address and name. We do not receive your password. Apple's Hide My Email is supported: if you use it, we only ever see the relay address. If you sign up with an email address and password instead, Firebase Authentication stores that password only as a salted hash; we never see it, and password-reset emails are sent by Firebase on our behalf.

When else we may disclose data

We disclose personal data outside the services above only (a) if the law requires it, for example a valid court order, and then only what is required; (b) where necessary to protect someone's safety or to defend our legal rights; or (c) to a successor if Long Software LLC or Kinpack is sold or reorganised, in which case this policy continues to apply to your data and we will tell you before it becomes subject to a different policy.

No ads, no tracking

Kinpack contains no advertising SDK and no third-party trackers. We do not track you across other apps or websites, we do not access the advertising identifier (IDFA / Advertising ID), and we do not build advertising profiles. Under Apple's App Tracking Transparency framework, Kinpack performs no tracking, so you are never asked for tracking permission.

Kinpack does contain first-party product analytics and crash diagnostics, added in v1.5. “First-party” means the events are ours, they describe this app only, and they are used only to understand which parts of Kinpack are used and to fix what breaks. They are counts and event names from a fixed list we wrote — “a trip was created”, “the free trip limit was reached”, “the Plus screen was opened” — and they contain no trip names, no destinations, no dates, no traveler names, no children's names, no packing list contents and no photos. They are recorded with your device's IP address, an approximate city-level location worked out from it, and device details, which we use only to diagnose errors. The provider is Datadog and the data is stored in the United States; see Datadog under Third parties. We will send you the complete list of events on request.

This is not advertising, it is not sold or shared, and it is not combined with data from other companies. No data is ever shared with a data broker.

What we do not do

Children's information

Kinpack is not directed to children, and children may not have accounts. Kinpack accounts are for adults aged 18 or over (see our Terms). A child in Kinpack is a name on a packing list, entered by their parent or guardian — never an account holder, and never someone we knowingly collect data from directly.

The only details Kinpack asks for about the child themselves are a name and a person type (for example “child”), entered by the adult account holder so the app can build that person a packing list. When you save someone to your household, Kinpack keeps their name and whether they are an adult or a child, so later trips give them the right kind of list. We do not ask for a child's date of birth, age, school, contact details, location, identity document or anything biometric.

Beyond that, a child is linked to the packing list their parent or guardian builds for them: the items and bags on that list, the trip it belongs to with its destinations and dates, and any photos the adult attaches to those items. Those are described in the table above and are held the same way as anybody else's; we are naming them here so this section is not read as a promise that a child's name is all we hold.

The adult account holder is responsible for the information they enter about their family members and confirms they are entitled to enter it. We process a child's information only to provide the packing features the adult uses it for; under the GDPR our legal basis is our and the family's legitimate interest in that (see Our legal bases), and we never use it for marketing, analytics or profiling, and never send a child's name to Open-Meteo, Datadog or RevenueCat. A child's information is covered by exactly the same access, correction, export and deletion rights as the account holder's own. Deleting your account erases the children you recorded on it. Deleting your account does not delete a shared household that other people are still using, so a child you recorded there stays with the people who remain — but you no longer have to delete anything to fix that. An owner or adult of the household can rename or remove any traveler without an account, including a child, from Household settings in the app. Removing someone there takes them off the household's list. A packing list already made for that person on a trip stays with the trip it belongs to, as the person who made it wrote it; remove that traveler from the trip, or delete the trip, to clear it. If you are no longer in the household and need a child's information removed from it, ask us at the address below.

If you share a household, the family members you have added become visible to everyone in that household. That is the point of sharing, but it is worth knowing before you invite someone.

If we learn that an account is held by someone under 18, we will close it; if we learn that we have collected personal information directly from a child under 13, we will delete it promptly. If you believe a child's information has reached Kinpack in some way other than an adult entering it, or that a child has an account, email support@kinpack.app and we will delete it.

Sharing inside a household

When you join or create a household, the other members can see the household's travelers, trips, packing lists and the item photos attached to them, according to their role in the household. Trips can also be shared with people outside a household by inviting them to the trip. Sharing is something you do deliberately; nothing is public, and nothing is visible to other Kinpack users you have not invited.

How long we keep it, and what deletion removes

We keep your data for as long as your account exists. You can delete your account at any time in Settings → Delete your account, or by following the instructions here if you cannot sign in. If you are paying for an active Kinpack Plus subscription bought in the app, the app tells you first that deleting your Kinpack account does not cancel it — the App Store or Google Play keeps charging you until you cancel it in your store account's subscription settings, which we cannot do for you — and links you there. If you bought it on the web, deleting your account does end it: we turn off auto-renewal as soon as you ask, and cancel anything still running when the account is erased. You can still delete your account straight away.

Deletion is scheduled, not immediate.

When you ask us to delete your account, it enters a 30-day grace window. Sign in again within those 30 days and everything comes back. After 30 days a scheduled job erases the account irreversibly: your profile, your trips and their packing lists, your library of learned items, kits and templates, the photos attached to those trips, and your sign-in record. We cannot recover it afterwards.

Shared trips survive — and so do their photos. A trip that other people are still on is not deleted when you leave — it stays with the remaining members, and if you owned it, ownership passes to one of them. Because that trip still belongs to them, the item photos attached to it are kept too; erasing them would take pictures out of somebody else's packing list. Deleting your account removes you from those trips; it does not destroy other people's copies of shared content, and it does not delete a household that other people are still using.

Travel Documents work differently, because they never leave the device you saved them on and the scheduled job cannot reach them. Deleting your account erases the Travel Documents it saved on the device you delete it from, straight away: they do not come back if you sign in again within the 30 days. Documents the account saved on any other device stay on that device, still encrypted, until you delete the app there.

Product analytics and crash diagnostics are kept separately. Those events sit with Datadog on our account for up to 30 days, not with your trips. They carry no name, no email and no trip content — the only account information on them is your Firebase account identifier — and they are stored with the IP address, approximate location and device details described under Datadog, which expire with them. Deleting your account erases everything described above; the analytics and crash events expire with that retention window instead. If you want them removed sooner, write to us and we will have them deleted for your identifier.

Purchase records go too. If you bought Kinpack Plus, the subscription record we hold for you and the billing-webhook audit rows that name your account are erased with the account; we keep no separate copy of them afterwards. We also instruct RevenueCat, our subscription processor, to delete its record for your account. The store you bought through (Apple or Google) is the merchant that charged you; it keeps its own record of the transaction under its own policies, and we cannot delete that for you. Our own tax and accounting records for store purchases are the aggregate payout statements the stores send us; they do not name you.

Web purchases are the exception. On the web we are the seller, so the law requires us to keep the record of the sale: the Stripe customer, its invoices and receipts, the tax charged, and the record that you agreed to the auto-renewal terms are kept by Stripe on our account after your Kinpack account is deleted — for as long as tax and consumer-protection law requires (typically seven years for tax records, and at least three years for proof of consent to automatic renewal), and then deleted. They are marked as belonging to a deleted account and are used for nothing else. Our own copy in Firestore — the customer mapping and the payment-event rows — is erased with the account.

Your rights

Depending on where you live, you have some or all of the following rights. We honour them for everyone, not only where they are legally required.

Email support@kinpack.app from the address on your account. We may need to confirm the request comes from you before acting on it, and an agent you have authorised may make a request for you where the law allows. We respond within one month (45 days where California law applies), and will tell you if we need longer and why. If we decline a request, we will explain why, and you can ask us to reconsider by replying to our answer. If you are in the EEA or UK you also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office); if you are in a US state with a privacy law, you may contact your state Attorney General.

Security

No system is perfectly secure, but we will tell affected users about a breach without undue delay and as required by law.

Changes to this policy

If we change this policy we will update the “Last updated” date at the top, and post the new version here. For a change that materially affects how we use your data — for example a new purpose or a new kind of third-party recipient — we will tell you by email or in the app before it takes effect, and where the law requires your consent we will ask for it.

Contact

Long Software LLC · 8401 Mayland Dr #6010, Richmond, VA 23294, USA · support@kinpack.app