Kindness Connection Privacy Policy

Last updated August 13, 2026

Information Kindness Connection may collect

• Account information: authentication identifier, username, email address and/or phone number.
• Verification information: consent timestamps, camera/location permission status, trust score, baseline-photo fingerprint and enrollment state.
• Kindness interactions: act, description, giver/recipient role, timestamps, confirmation status, points, badges, optional community and AI summary.
• Optional location information: coordinates and accuracy may be used as a verification signal when you allow location access. Exact coordinates are not displayed publicly.
• Optional photos: interaction photos you choose to upload and the sharing consent associated with them.
• Guest acknowledgements: a phone number or email used to privately connect an acknowledgement to a future account, plus an optional message or photo.
• Sponsor information: business and contact details submitted through sponsor registration or sponsor administration.

Baseline selfie and biometric information

In the current Kindness Connection build, the raw baseline selfie is stored in browser-local IndexedDB on the device where it is captured. Kindness Connection's server receives the photo fingerprint and verification record, not the raw baseline selfie. Automated face matching is not enabled in the current build. If Kindness Connection later enables an approved biometric provider, we will require appropriate consent and update this policy before using that feature.

Why we use information

Kindness Connection uses information only for purposes connected to operating and protecting the service, including:

• creating and authenticating accounts;
• recording and confirming acts of kindness;
• reducing fraud, duplicate claims and abuse of points or rewards;
• awarding points, badges and sponsor rewards;
• creating a share card or community-feed post when the user chooses to share;
• sending acknowledgements or reminders requested or authorized by the user; and
• operating, securing, debugging and improving Kindness Connection.

Service providers

Kindness Connection uses service providers to operate the platform. These may include Clerk for authentication, Neon/PostgreSQL for application data, Vercel for hosting, Twilio when SMS is enabled, and OpenAI when AI summaries are enabled. Kindness Connection sends a provider only the information needed for the feature being used. For example, the current AI summary request uses the kindness gesture and description, not the participant's private phone number or email address.

Sharing and public information

Your username and information you deliberately publish to the goodwill feed may be visible to others. Phone numbers, email addresses, exact verification coordinates, baseline-photo fingerprints and other private verification data are not placed on public Kindness Connection pages. Kindness Connection does not currently sell personal information or use personal information for third-party targeted advertising.

Kindness Connection-delivered email acknowledgements are intended to come from Kindness Connection so one participant does not have to reveal personal contact information to another. Sharing a name, username or contact information with another participant should be an explicit user choice.

Retention

Kindness Connection's goal is to retain personal information only while reasonably needed for the service, verification, fraud prevention, rewards, security or legal obligations. Interaction photos currently receive a 90-day retention date when uploaded. Temporary guest acknowledgement photos are designed for shorter retention. Security logs, service-provider backups or records required by law may persist for a limited period after active application data is removed.

Your choices and requests

You can choose whether to share a kindness interaction publicly, allow location access, upload a photo and approve optional social sharing. Depending on the law that applies to you, you may also have rights concerning access, correction, deletion or portability of personal data.

Signed-in users can open My Kindness → Privacy & Data to submit a permanent deletion request. A deletion request is recorded separately so Kindness Connection can verify and complete it safely.

Permanent account deletion

Completing a verified deletion request means deleting the Kindness Connection user account and active Kindness Connection-hosted personal content associated with it, including interactions the account created or participated in, associated active hosted images, points, badges, reward grants, reactions, guest acknowledgements tied to the account and verification data. The authentication account is also removed as part of completion.

The raw baseline selfie in the current build lives in browser-local storage. The device used to request deletion can clear that local baseline, but a copy saved in another browser or device may need to be cleared on that device separately. Kindness Connection may retain the minimum non-content record needed to document that a privacy request was received or completed, or where required for legal or security reasons; it will not be used to recreate the deleted account.

Children

Kindness Connection is not designed to knowingly collect children's personal information in a way that bypasses required parental consent. Before a broad launch directed to children under 13, Kindness Connection should implement and validate a dedicated age/parental-consent and child-data retention process.

Security and changes

Kindness Connection uses authentication, role-based access, limited public exposure, verification controls and data minimization to reduce privacy and security risk. No online system can guarantee absolute security. Kindness Connection may update this policy as features, providers or legal requirements change; the update date will remain visible here.