Withkin Privacy Policy

Last updated: October 16, 2026

Withkin is a private app for families, with optional invitation-only family circles. This policy explains what we collect, what we don't, and how you can get your data out or delete it. It's written to be read, not skimmed past.

What Withkin collects

• Your app account email address. Used only to sign you in and to send invites you explicitly create. Stored by our authentication provider (Supabase).
• Website testing requests. If you request a beta invitation on our website, we collect your email address, your selected phone platform, and basic request metadata such as your IP address and browser information. These submissions are processed by Netlify and used to arrange testing invitations and follow-up. Supabase coordinates the requested setup email and keeps a private delivery record to prevent duplicates; Resend delivers the email. Recipient details and email content are removed from that delivery record after the email provider accepts it. Android tester Google Group membership is handled by Google separately from your Withkin app account.
• What you write and upload. Wins, journal entries, goals, photos you attach. Stored in our database and object storage (Supabase). Photos are compressed on device before upload.
• Your family's structure and circle membership. The names, avatars, and roles of the members you add (including kids), plus the households and memberships in family circles you create or join. Kids do not have their own accounts — an adult in the family manages them.
• Basic device info. App version, operating system, whether the app crashed. Used to fix bugs. Handled by Sentry.
• Pseudonymous usage events. Optional explicit action names and coarse options, linked to your account and server-resolved household in Supabase; not anonymous. Approved product operators see aggregates, not individual event rows. If configured, PostHog receives the same allowlisted metadata and account identifier. Never win or journal text, goal titles, prompt text, topic or emotion values, names, emails, photos, replay, or automatic screen capture. Turn this off in You → Product usage analytics; family features work either way. Collection pauses until the saved preference is confirmed. Turning off stops this device immediately and deletes first-party history on server confirmation; retry an unsuccessful save to apply it across devices.
• Moderation reports. If you report a family-wall post, we collect the reason, optional details you provide, your account ID, the reported post ID, and the report time. Reports are used only for safety, moderation, and enforcing our Terms.

What Withkin does not collect

• The Withkin app does not collect contacts, location, advertising identifiers, browsing history, or anything from outside the app.
• We do not sell data to anyone. We do not run ads.
• Content is shared inside Withkin only as described in “Who sees your content” below. We do not share it with outside third parties other than the infrastructure providers listed below, and only as necessary to run the app.

Who sees your content

• Family-wall wins and photos, and family-visible goals: visible to members of your family. Personal goals default to private, with server-enforced owner access; family administrators cannot read another adult's private goals. Private milestones become visible only through an explicit structured share. Joining a circle does not open your household wall, private goals, or journal to other households.
• Family circles: when you post or move a win to a circle, that win and its attached photo are visible to members of that circle. Circle members also see the household names and member profiles shown in that circle. These are invitation-only spaces, not public feeds.
• Journal entries and journal photos: visible only to you. No other family or circle member can see them. Our database has row-level security rules that enforce this at the server side, not just the app.
• Kids' accounts: kids do not have independent accounts. An adult in the family acts on their behalf.
• Reported content: a Withkin moderator may review a submitted report and the referenced family-wall post only to investigate safety or Terms violations. Private journal entries are not reportable and are never included in moderation reports.

Third parties that help run the app

• Supabase — database, authentication, file storage, first-party product usage, and website testing-email coordination. Our primary backend.
• Netlify — website hosting and beta-request form processing.
• Sentry — crash reporting.
• PostHog — optional pseudonymous usage processor, never family content. Disabling stops new sends. Already-sent records require separate processor deletion through privacy@withkin.family; Supabase account deletion does not itself erase them.
• Resend — transactional account emails, family invitations you explicitly send, and website testing instructions you request.
• Apple / Google — app delivery and testing access, including Android tester Google Group membership; subscription handling when you subscribe.

Each of these providers has their own privacy terms. We send them only what they need to do their job.

Children

Withkin is designed to be used by families, including kids. Kids do not create their own accounts; an adult in the family adds and manages them. We do not send marketing email to kids. We do not share kids' information with advertisers. If you are a kid's parent or legal guardian and want that kid's profile and associated content removed, follow the deletion steps below.

Data deletion

In Withkin, open You → Privacy and data → Delete account to review and initiate account deletion. If you cannot access the app, email privacy@withkin.family from your sign-in address. We complete verified requests within 30 days.

We delete your authentication credentials, private journals and journal photos, active profile and membership, wins you authored and their photos, goals you owned or created, check-ins, push tokens, notification preferences, moderation reports you submitted, and first-party product usage, observation/activation timestamps, and analytics settings linked to the deleted Auth account. Wins another person wrote about you remain in that author's family record, but your identity is removed. If yours is the family's only authenticated account, the family record is deleted instead of being left inaccessible.

You can also delete individual journal entries and wins from the app at any time — see how to delete specific data or how to delete your whole account.

First-party raw usage is purged after 90 days by a daily database-only job whose configuration and execution are monitored by operators. Minimal first-observation and first-meaningful-action timestamps remain while the account exists, until opt-out or account deletion. Dashboard aggregates are calculated on demand, not retained anonymous records. Optional PostHog deletion requires separate verified processor cleanup through privacy support. Backup retention follows the hosting provider's configured period, not a promised fixed purge cycle.

To prevent unsafe photo reuse, we permanently retain an opaque cryptographic hash of each attached win-photo storage path, including after photo or account deletion. It contains no photo, raw path, owner, post identifier, timestamp, or writing and cannot be read by app clients. A privileged operator who already knows a candidate path could compare its hash. It is not analytics.

Data export

Email privacy@withkin.family from your sign-in address and we will send back a machine-readable export (JSON) of your wins, journal, goals, and family metadata within 30 days.

Where data is stored

Our Supabase project is hosted in the United States. If you use the app from elsewhere, your data is transferred to and processed in the US.

Changes to this policy

If we materially change what we collect or who we share it with, we will note it in the app before the change takes effect.

Contact

Withkin is run by Joseph Floyd.

• Privacy, deletion, safety, and moderation: privacy@withkin.family
• General contact: hello@withkin.family
• Postal address available on request.