DRAFT — not yet reviewed. This text has not been approved by Terence or reviewed by a lawyer. Do not rely on it, and do not publish it as final.
Kiekie Privacy Policy
- Last reviewed: pending
- Applies from: pending
Placeholders to fill in before approval
privacy@kiekie.example: replace with the real privacy contact email (it appears several times below). Proposed address, now that the marketing domain is kiekie.online: privacy@kiekie.online. The mailbox is not confirmed. Do not treat the proposal as live until this placeholder is replaced. Seedocs/landing-page.md.[POSTAL ADDRESS]: a postal address in South Africa for privacy requests.[INFORMATION OFFICER]: the registered Information Officer under POPIA (usually Terence).[RETENTION]: confirm the deletion wording against Google Cloud's current data-deletion terms (its own backups are cleared on Google's schedule).[EU/UK REPRESENTATIVE]: decide whether a GDPR art. 27 representative is needed, and name them or delete the line.[EFFECTIVE DATE]: the date this policy applies from (the "Applies from" line above).- Confirm the subprocessor list against the live setup (K-020) before approving.
The short version
- Kiekie is a private place for your family to share one photo a day. Only your family sees your photos.
- Your photos are yours. You can export them any time, and deleting your account removes them.
- We never sell your data, never show you ads, and never use your family's photos to train AI.
- There is no feed and no algorithm. We do not profile you.
- Your photos and family data are stored in South Africa (Johannesburg). A few services we rely on work outside South Africa; we explain which below.
Who we are
Kiekie is run by Terence Hinrichsen (trading as Kiekie), South Africa. Terence is the "responsible party" under South Africa's Protection of Personal Information Act (POPIA) and the "controller" under the EU and UK General Data Protection Regulation (GDPR).
- Email: privacy@kiekie.example (placeholder, to be replaced)
- Post: [POSTAL ADDRESS]
- Information Officer: [INFORMATION OFFICER]
- EU/UK representative: [EU/UK REPRESENTATIVE]
What we collect, and why
We collect only what Kiekie needs to work.
| What | Why we need it |
|---|---|
| Email address | To sign you in with a one-time code. |
| Phone number (only if sign-in by text message is switched on later) | To sign you in with a one-time code by SMS. |
| Display name | So your family knows who posted. |
| Family membership (which families you belong to, which one the app is showing, and whether you organise each one) | So your photos reach the people in that family and nobody else. You can belong to more than one family. Your name, time zone and waking hours are kept separately for each family. |
| Photos you post | This is the point of Kiekie: showing your family your day. Photos are shrunk on your phone before upload and the location and other hidden details are removed. A small thumbnail copy is kept with each photo for quick previews, and it is deleted with the photo. |
| Reactions (the emoji you send) | So your family sees your reaction. |
| Push token (a code from your phone) | To send your daily nudge to your phone. |
| Time zone and waking hours | So your daily nudge arrives during your own day, wherever you live. |
| When you agreed to these terms and confirmed you are 13 or older | To show that you agreed. We keep this with your account, not with your family, so it stays if you leave a family, and it is deleted with your account. |
| Photo reports (if you report a photo: which photo, the reason you picked and any short note you add) | So a person at Kiekie can look at a photo that should not be there. The report does not say who sent it (see "Reporting a photo" below). |
| Photos you hid (which photos you reported and hid for yourself) | So they stay hidden for you on all your devices. Nobody else sees this list. |
| Family members whose photos you hid | So their photos stay hidden for you on all your devices, in that family. Only you can see this list, and the person is not told. A hide in one family does not hide them in another. It is deleted if either of you leaves or is removed from that family, or deletes their account. |
| Your IP address (the internet address your phone or browser uses when it talks to our server) | To keep Kiekie secure and running. Google Cloud's standard request logs record the IP address of requests to our server and keep them for 30 days. Our own records never keep the address itself: to stop anyone flooding Kiekie with sign-in attempts or fake error reports, our server turns it into a keyed hash, a scrambled code that cannot be turned back into the address without a secret key only our server holds. See "How long we keep things". |
| Basic technical logs (for example times of sign-in and of reports, and whether they worked) | To keep Kiekie working and secure, and to fix problems. |
| Anonymous error reports (when the app hits an unexpected error: the kind of error, where in Kiekie's own code it happened, the app version, phone or web, and which screen was open) | To find and fix bugs. Email addresses, phone and other long numbers, codes, ids, IP addresses, web addresses' details and file names are removed on your device before a report is sent, and again on our server. A report never contains your name, your photos or anything about your family. |
We do not ask for your contacts, your location, or anything about your health, beliefs or finances.
Our lawful basis
- To provide Kiekie to you (POPIA section 11(1)(b); GDPR article 6(1)(b), performance of a contract). Most of the data above is needed simply to run the service you signed up for.
- Your consent, where relevant (POPIA section 11(1)(a); GDPR article 6(1)(a)), for example push notifications, which you can switch off in your phone's settings at any time.
- Keeping Kiekie safe and lawful (POPIA section 11(1)(c) and (f); GDPR article 6(1)(c) and (f)), for example security logs and answering lawful requests.
What we never do
- We never sell your data.
- We never use your data for advertising, and Kiekie has no ads.
- We never use your family's photos to train AI, and we do not let anyone else do so.
- There is no feed and no algorithm. We do not rank, recommend or profile you.
Who can see your photos
Only the members of your family in Kiekie. Not the public, not other families. A small number of people who run Kiekie can technically reach stored data, and only do so when needed to fix a problem, keep the service safe, or follow the law.
Reporting a photo
If a photo in your family should not be there, you can report it from the photo itself. The report goes to the person who runs Kiekie, by email and in our database. It contains the photo, the family it is in, the reason you picked, any short note you write, when you sent it and whether it has been dealt with. It also holds two scrambled codes (keyed hashes, which nobody can turn back into an account without a secret key only our server holds): one made from your account, so we can stop one person sending too many reports, and one made from the account of the person who posted the photo, so the report is deleted if they leave. It does not contain your name, email address or account, and the person reviewing it cannot tell from it who you are. The emailed notice includes where the photo is stored, which identifies the account of the person who posted it. A person, never an automatic system, decides what happens; if the photo breaks our terms, they remove it, and if the person who posted it should not be in Kiekie at all, they can remove that person by deleting their account, with all their photos and reactions, for good. The photo is hidden for you straight away, and you can show it again at any time. Reports are deleted automatically 90 days after they are sent. If the person who posted the photo deletes their account, every report about their photos is deleted straight away, and if they leave the family (or are removed from it), every report about their photos in that family is. If you delete your own account, reports you sent stay until those 90 days are up: they never said who you are, and they are about someone else's photo. Deleting your own account deletes the list of photos you hid.
Hiding someone's photos
If you would rather not see a family member's photos, choose "Hide Anna's photos" (with their name) from the More menu on one of their photos, or from their row in Settings > Your family. Their photos and reactions disappear for you in that family, and the person is not told. Only you can see who you hid: Settings > Your family lists them under "Hidden for you", with "Show again". A hide ends by itself if either of you leaves that family, is removed from it, or deletes their account (or has it removed by us). If someone is causing real harm, please report their photo too, or ask that family's organiser to remove them.
Where your data is kept
- Photos and family data are stored by Google Firebase in Johannesburg, South Africa (region
africa-south1). - Scheduling only: the timer that starts our daily prompt and clean-up jobs runs in Google Cloud in Belgium, EU (region
europe-west1). It holds only scheduling settings, no personal data; the jobs themselves run, and read your data, in Johannesburg. - Sign-in identities (your email address, and your phone number if SMS sign-in is switched on) are processed by Firebase Authentication in the United States.
- Push notifications are delivered by Google Firebase Cloud Messaging, which works worldwide.
- Anonymous error reports are received in Johannesburg and kept in Google Cloud Logging and Error Reporting, which may store them outside South Africa. They hold no personal data (see above) and are deleted automatically after 30 days.
- Sign-in emails, and the notice the person who runs Kiekie gets about each photo report (the family, where the photo is stored, the reason and the note), are sent by Resend (Plus Five, Inc.) from the United States, from an address at kiekie.online. Resend is not asked to track whether you open the email, and the sign-in email has no links. kiekie.online is verified for that sending. Until the server is next updated, the copy of Kiekie that is running still sends these emails through Brevo (Sendinblue SAS) from the European Union. We will take Brevo off this page once that update is live.
- Abuse protection: the first time you ask for a sign-in code in a web browser, Kiekie loads Google reCAPTCHA (and, in that browser, again each time Kiekie opens after that), which checks that the request comes from the real app. Google processes technical details about your browser and device for this, in the United States. In the phone apps, the same check uses Google Play Integrity (Android) or Apple App Attest with Apple DeviceCheck as a fallback (iPhone), which confirm to us that the request comes from a real copy of Kiekie on a real device.
Where data leaves South Africa, we rely on POPIA section 72: the providers are bound by written agreements that give protection substantially similar to POPIA. For people in the EU and UK, transfers are covered by the European Commission's Standard Contractual Clauses (and the UK Addendum) in those providers' data processing terms.
The companies that help us (subprocessors)
| Company | What they do for Kiekie | Where |
|---|---|---|
| Google LLC / Google Firebase (Cloud Firestore, Cloud Storage, Cloud Functions, Authentication, Cloud Messaging) and Google Cloud (Cloud Logging, Error Reporting) | Stores photos and family data, runs the service, signs you in, delivers push notifications, keeps anonymous error reports | South Africa (data), United States (sign-in), worldwide (push, error reports) |
| Resend (Plus Five, Inc.) | Sends your sign-in code by email, and photo-report notices (family, photo location in storage, reason, note) to the person who runs Kiekie, once the server is updated. kiekie.online is verified for that mail. No open or click tracking. | United States |
| Brevo (Sendinblue SAS) | Sends those same emails from the server that is running today, until that update. Removed from this page after it. | European Union (France) |
| Google LLC / Google reCAPTCHA Enterprise (through Firebase App Check) | Abuse protection: checks that a sign-in request comes from the real Kiekie app, not an automated attack. On the web it loads the first time you ask for a sign-in code in a browser, and each time Kiekie opens in that browser afterwards. | United States |
| Google LLC / Google Play Integrity (through Firebase App Check) | The same check in the Android app | United States |
| Apple Inc. / Apple App Attest and DeviceCheck (through Firebase App Check) | The same check in the iPhone app | United States |
We will update this list before we add a new company.
How long we keep things
- We keep your photos and data while your account exists.
- When you delete your account, we remove your photos, reactions and family membership, and the other data linked to you, from our systems straight away, and in any case within 30 days. Our hosting provider (Google) keeps short-lived copies for its own disaster recovery and clears them on its own schedule; we cannot access or restore them.
- Basic technical logs are kept only as long as needed to run and secure Kiekie, and then deleted. Anonymous error reports are deleted after 30 days.
- IP addresses: Google Cloud's standard request logs, which record the IP address of each request to our server, are deleted after 30 days. Our own keyed hashes of it: for sign-in, each one sits in a counter that is deleted automatically about two hours after it starts (Google's clean-up can take up to a day longer), and our sign-in logs keep only a short piece of it, for 30 days. For error reports, the hash is held only in the server's working memory and is not saved by us.
- Photo reports are deleted 90 days after they are sent (see "Reporting a photo"). The counter that stops one person sending too many reports in a day is deleted automatically two days after it starts (Google's clean-up can take up to a day longer).
- Your hidden photos and hidden members are kept until you show them again or delete your account. A hidden member is also removed from your list for that family when either of you leaves it, is removed from it, or deletes their account.
- When you leave a family, or the organiser removes you from it, we delete your photos and reactions in that family straight away: they are yours, so they go with you. Your account stays, and so does every other family you belong to. You can start or join another (up to five). When the organiser removes someone, that family's earlier invite links stop working. An invite link works for 7 days and for up to 10 people. The organiser can reset it, which stops every link shared so far. Links created before these limits no longer work.
- Each family's organiser hands the role to someone else before leaving that family. If you delete your account as the organiser, the longest-standing member of that family takes over. When the last member leaves, that family is deleted. Leaving one family is not deleting your account.
Your rights
Wherever you live, you can:
- See your data. Export all your photos and data from Settings at any time ("Export my photos and data").
- Correct it. Ask us and we will correct it.
- Delete it. Delete your account from Settings, or email us and we will do it for you.
- Object or withdraw consent. For example, switch off notifications, or ask us to stop something you are not happy with.
- Complain. You can complain to:
- South Africa: the Information Regulator, inforeg.org.za, complaints.IR@inforegulator.org.za
- EU: your local data protection authority
- UK: the Information Commissioner's Office, ico.org.uk
To use any of these rights, email privacy@kiekie.example (placeholder). We will reply within 30 days, and we will not charge you. We may ask you to confirm it is really you before we act.
Children
Kiekie is not for children under 13 on their own. You must confirm you are 13 or older to sign up, and we do not allow independent accounts for anyone younger. If we learn that a child under 13 has signed up, we will delete the account.
Child profiles managed by a parent are not part of Kiekie yet. If we add them, we will update this policy first and ask for a parent's consent.
Keeping your data safe
Your data is encrypted while it travels and while it is stored. Only members of your family can open your family's photos, and those rules are checked on our servers, not just in the app.
If something goes wrong (data breaches)
If we find that your personal information may have been accessed by someone who should not have it, we will:
- Act straight away to stop it and limit the harm.
- Tell the Information Regulator (and, where GDPR applies, the relevant supervisory authority) as soon as reasonably possible (within 72 hours where GDPR requires it).
- Tell you as soon as reasonably possible, in plain words: what happened, what it means for you, and what you can do.
- Keep a record of what happened and what we changed so it does not happen again.
Changes to this policy
If we change this policy in a way that matters, we will tell you in the app before the change applies. The "Last reviewed" date at the top always shows the current version.
Contact
Questions about your privacy? Email privacy@kiekie.example (placeholder, to be replaced). A real person reads it.