Privacy Policy

Renji Labs, Inc. ("we," "our," or "us") operates Kaiary, a privacy-first AI-powered family journaling application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services.

We are committed to protecting your family's privacy. Your family memories are yours: we never sell your data, we never use your content for advertising, and we never allow your content to be used to train AI models. Kaiary's AI features run on a combination of AI systems hosted on our own infrastructure and a small number of carefully selected AI service providers, each contractually bound to our privacy standards — including a prohibition on training on your content and strict limits on how long it may be retained — as described in Sections 3 and 5. Where available and enabled, face recognition runs on Kaiary-controlled servers. Numerical recognition patterns are not sent to external AI models; contracted infrastructure providers operate the hosting and storage.

Contact Information:
Renji Labs, Inc.
7775 Walton Pkwy Ste 100
New Albany, OH 43054 USA
Email: [email protected]

2.1 Account Information

When you create an account, we collect: your name, email address, phone number (for SMS verification), and authentication credentials. If you sign in using Apple or Google, we receive only the authentication token and basic profile information you authorize.

2.2 Family Content

The core of Kaiary is storing your family memories. This includes: memories and text content you create, photos and images you upload, videos you upload, audio recordings and voice notes, milestone events and dates, and any captions, tags, or descriptions you add to your content.

You can separately choose a photo for a family member’s storybook portrait. We store the selected, sanitized photo reference, the resulting reusable artwork, and a record of your illustration-purpose permission. This choice does not enroll the person in recognition or search your library for their face.

2.3 Biometric Information

Facial recognition is optional and unavailable for families assigned to our no-recognition setting (Biolock). If enabled, Kaiary measures faces in family photos and creates numerical face patterns to recognise approved family members, organise photos and make them searchable in Ask Kaiary. You can import and keep photos without facial recognition and add names manually.

Before temporary face discovery starts, the uploader sees a separate disclosure. Each person needs recognition permission before durable enrollment. Adults can approve directly. In the normal setup, a family keeper (the owner or a co-owner) may instead confirm that they explained Kaiary’s facial recognition to another adult, that adult agreed, and they authorised the keeper to record that permission. A parent or legal guardian may approve for their child. Family ownership alone does not provide another person’s permission.

Numerical face patterns are generated and matched only by Kaiary’s own recognition service, isolated by family. They are not sent to third-party AI models. Contracted hosting and storage providers operate the infrastructure. Original photos and selected reference images can separately be processed by the AI providers in Section 5.4 for other requested features; those providers never receive our numerical face-recognition patterns.

2.4 Device and Usage Information

We automatically collect certain information when you use the app, including: device type, operating system, and version; unique device identifiers; app usage patterns and feature interactions; crash reports and performance data; and IP address and general location (country/region level only). At account creation, we use the server-observed IP address to estimate country and state or province and store that estimate, its source and the applicable recognition policy. We do not obtain precise GPS location for this decision. The estimate stays attached to the account; contact [email protected] if it is wrong.

We use your information to: provide and maintain the Kaiary service; process and store your family content securely; generate AI-powered features such as storybook illustrations, automatic captions, and searchable transcriptions; enable face recognition for photo organization (if you opt in); send you service-related communications; improve and optimize the application; ensure security and prevent fraud; and comply with legal obligations.

3.1 AI Processing

Kaiary's AI features — such as image and video captioning, voice transcription, storybook illustrations, and search — are powered by a combination of AI systems hosted on our own infrastructure and a small number of carefully selected third-party AI service providers, listed in Section 5.4.

Every third-party AI provider we use is bound by contractual terms that meet our privacy standards:

No training: your content is never used to train or improve any AI model.
Limited retention: your content is processed only to fulfill your request; providers either retain nothing after processing or delete your content within 30 days, as described for each provider in Section 5.4, except in the rare case that retention is required by law.
No other use: providers may not use your content for any purpose other than performing the requested processing for Kaiary.

Face recognition is the exception to all of the above: it never uses a third-party AI provider and runs on Kaiary-controlled servers (see Sections 2.3 and 6).

Local Magic Import selection is separate from recognition. On supported devices, it can detect people and assess photo quality and image-level duplicates to help you select photos. It does not identify people or track the same person across photos. These selection hints stay on the device; the photos you choose are uploaded normally. Child/baby classification is controlled separately and is off by default in Biolock.

Your data is stored on secure Amazon Web Services (AWS) infrastructure that we control. We implement industry-standard security measures including: encryption in transit (TLS/SSL) and at rest (AES-256); secure authentication with multi-factor options; regular security audits and monitoring; access controls limiting employee access to user data; and automated backup and disaster recovery systems.

Your content library — your photos, videos, and memories — is stored only on infrastructure we control. When content is processed by an AI service provider (see Section 5.4), it is transmitted over encrypted connections and used only to complete the requested processing; providers either retain nothing after processing or delete your content within 30 days, except where retention is required by law.

In addition to hosting AI systems on our own infrastructure, we use a small number of third-party service providers for specific functions. Each provider receives only the information needed for its function and is bound by confidentiality and data-protection obligations:

5.1 Authentication Services

Supabase: Provides secure user authentication. Supabase receives only authentication credentials and tokens, not your family content.

Apple Sign-In / Google Sign-In: If you choose to sign in with Apple or Google, these services provide authentication tokens. They do not receive access to your Kaiary content.

5.2 Communications

Twilio: Used to send SMS verification codes for phone number authentication. Twilio receives only your phone number for this purpose.

SendGrid and Brevo: Used to deliver service and lifecycle emails, such as family invitations and account notices. These providers receive your email address, your first name, and the content of the emails we send you, along with account and subscription details used to decide which emails to send and when — your role in the family, how you found Kaiary, your time zone, your signup and trial dates, your subscription status, and product-usage figures such as how many entries you have created and how many days you have used the app. They never receive your family content.

5.3 Analytics and Error Reporting

PostHog: We use PostHog for product analytics to understand how users interact with the app. PostHog collects anonymized usage data, device information, and feature interaction patterns. We also use PostHog session replay in limited areas of the app to understand where users run into problems. Recordings mask user information—text you type, images, and personal details such as names—so they show the screens you moved through rather than your content. PostHog does not have access to your family content, photos, or memories.

Sentry: We use Sentry for crash reporting and error monitoring. Sentry collects technical information about app crashes and errors to help us improve stability. Sentry does not have access to your family content.

AppsFlyer: We use AppsFlyer to understand how new families discover Kaiary (install and campaign attribution). AppsFlyer receives device identifiers and install information, subject to your device's tracking permission settings. AppsFlyer does not have access to your family content.

5.4 AI Service Providers

Some AI features may be processed by the following AI service providers, in every case under agreements that prohibit using your content to train AI models and strictly limit how long it may be retained, as described for each provider below:

Anthropic: language and image understanding — for example, generating titles, story text, and photo and video captions. Accessed exclusively through AWS Bedrock, under Bedrock's retention terms below.

Amazon Web Services (AWS) Bedrock: a managed AI service through which we access Anthropic's models, Amazon's embedding models (which make your library privately searchable, and for a video take in its sound as well as its picture), and Mistral AI's speech-to-text models — configured so that no content is retained after processing.

OpenAI: storybook illustration and likeness rendering. OpenAI receives the text descriptions we compose and selected reference images, which may include your photos, still frames from your videos, cropped portraits, and previously generated illustrations, to help drawings resemble your family. We do not send voice recordings or face-recognition embeddings to OpenAI. OpenAI may retain what it receives for up to 30 days solely for abuse monitoring, after which it is deleted. OpenAI never uses your content to train AI models.

Which system processes a given request depends on the feature. Our numerical face-recognition patterns are never sent to these AI models. Photos and reference images may include faces and are processed for the separate image features described above (see Section 6). We will update this Privacy Policy before adding a new AI provider or weakening these protections.

5.5 Purchases

RevenueCat: Manages subscriptions and in-app purchases. RevenueCat receives purchase and subscription status information from the app stores — never your family content. Payment details are handled by Apple and Google; we never receive your full payment information.

Purpose and choice. Optional facial recognition helps a private family find and organise photos of approved family members, including future uploads and the existing library. It is not used to authenticate accounts, identify people across families, advertise or train AI models. Manual names and photo import remain available if you decline.

Permission before enrollment. We explain the purpose, processing and retention before asking for an affirmative, unchecked permission. Adults can approve directly; a parent or legal guardian may approve for their child. In the normal setup, a family keeper (the owner or a co-owner) can separately confirm each adult’s informed agreement to the stated purpose, face-data use, retention and withdrawal choices, and their authority to record it. Kaiary records this as a keeper confirmation, not as direct approval from the adult. Permission-first setup requires other adults to approve directly. A private email invitation lets an adult agree or decline without creating a Kaiary account. This permission does not grant journal access. Do not identify someone as yourself or claim guardian authority that you do not have.

Regional setup. Kaiary uses normal, permission-first (Biostrict), or no-recognition (Biolock) settings. Normal setup can use temporary Magic Import discovery after the uploader accepts its separate disclosure, and allows a family keeper to confirm another adult’s informed agreement. Permission-first setup requires permission and deliberately selected reference photos before recognition. A region estimate is a product routing control, not a statement that every person photographed has the same location or legal requirements.

No-recognition setting (Biolock). This family setting disables identity recognition, face enrollment, temporary identity grouping, recognition invitations, and transient face-pattern extraction. Magic Import keeps non-identifying local photo selection. Uploaded photos can still receive scene descriptions and ordinary search indexing; names come from manual labels and explicit journal text. A storybook photo reference is used only for illustration, not to identify someone in other photos. No geography is newly assigned to Biolock by this policy update.

Temporary discovery. Discovery creates temporary patterns of faces in an import so the uploader can identify family members. Unenrolled patterns become unavailable when the import ends plus 24 hours, or 48 hours after the import starts, whichever is earlier, and are scheduled for deletion. Choosing “Someone else” discards that group immediately. An invitation never extends these deadlines. An adult who approves after the patterns expire needs new reference photos.

Matching in group photos. Where recognition is available and a person is approved and enrolled, our server compares faces in family photos, including group photos, with that family’s approved patterns. This can temporarily measure faces of people who are not enrolled. Unmatched patterns are discarded from the matching process and are not saved, except during separately enabled temporary discovery. Declining durable enrollment does not remove a person from original group photos or prevent every transient comparison. The family owner must use photo and recognition features consistently with the rights of the people pictured.

Retention and destruction. Saved patterns, recognition reference photos and automatic identity tags are removed when permission is withdrawn, when the purpose ends, or 12 months after the person, guardian, or—in normal setup—the keeper last expressly confirms permission, whichever comes first. Background matching and ordinary app use do not renew permission. We send reminders 30 and 7 days before expiry where we have usable contact information. Guardian permission also ends when a known birthday shows the child has reached 18. After expiry, new permission and references may be required.

Withdrawal. Use Settings → Privacy → Family recognition, or your guest consent link. If a family keeper recorded your agreement, ask them to stop recognition or contact [email protected] directly; you do not need a Kaiary account to contact us. Recognition stops when permission ends. Database patterns and automatic identity associations are deleted in the withdrawal transaction; reference files and affected search indexes are deleted or rebuilt by queued jobs that retry failures. Withdrawing leaves original family photos and manually entered labels in place. Generated artwork already saved in the journal is separate content and is not automatically deleted. You can ask [email protected] for help with images or labels concerning you.

Sharing and security. We do not sell, lease or trade face patterns, use them for advertising, or send them to external AI models. Contracted infrastructure providers process them only to operate Kaiary. Family access controls apply to photos and results. Backup handling and limited permission evidence are described in Section 7.

Family content stays while needed to provide the account’s services, unless you delete it. Account deletion starts removal of account content from active systems within 30 days. Biometric deadlines in Section 6 apply independently and do not wait for account deletion.

Encrypted, restricted disaster-recovery backups can retain earlier database copies for up to 30 days as backups rotate. These copies are not available to the app or used for recognition. Deletion and expiry must be reapplied before a restored database is returned to service. Deletion from active storage does not mean every backup is instantly rewritten.

We retain limited permission, renewal, withdrawal and verification evidence for up to five years to demonstrate the choices made and handle related disputes. This evidence includes the disclosure, time, actor or verified email and relevant security information, but no numerical face pattern. Permission links expire, verification codes expire after 10 minutes, and verified browser sessions expire after 30 minutes. We do not keep expired codes as reusable credentials.

AI-provider retention is described in Section 5.4. A provider’s existing permitted retention period does not become shorter merely because recognition permission is withdrawn. Records that must be preserved under a specific legal obligation may be retained as required, restricted to that purpose; this is not a general extension of active facial recognition.

Storybook photo references. We keep one current sanitized illustration reference for each person until it is replaced or removed. Unfinished uploads expire after 24 hours. Replaced references and superseded reusable portraits are queued for deletion with retries; a pending render cannot publish from a removed reference. Removing only the reference keeps the approved portrait and completed journal images. Removing storybook personalization cancels pending work and deletes its reusable references and portraits, while completed journal images remain until removed through the usual content controls. The 12-month recognition renewal period does not apply to this independently chosen illustration reference. Illustration-purpose choice records remain with the family account and are removed with the family; they are separate from recognition-permission evidence.

8.1 All Users

Regardless of your location, you have the right to: access your personal data; correct inaccurate data; delete your data and account; export your data in a portable format; opt out of face recognition at any time; and withdraw consent for specific processing activities.

8.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including: the right to know what personal information we collect, use, and disclose; the right to delete your personal information; the right to opt out of the sale or sharing of personal information (note: we do not sell your personal information); the right to non-discrimination for exercising your privacy rights; and the right to correct inaccurate personal information.

To exercise these rights, contact us at [email protected]. We will respond to verifiable requests within 45 days.

8.3 European Economic Area Residents (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation, including: the right to access your personal data; the right to rectification of inaccurate data; the right to erasure ("right to be forgotten"); the right to restrict processing; the right to data portability; the right to object to processing; rights related to automated decision-making and profiling; and the right to withdraw consent at any time.

Legal Basis for Processing: We process your data based on: contractual necessity (to provide the Kaiary service); your consent (for optional features like face recognition); and legitimate interests (for security and service improvement).

Data Transfers: Your data is stored on servers located in the United States. We rely on Standard Contractual Clauses and other appropriate safeguards for international data transfers.

You have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights.

Kaiary accounts are for adults aged 18 or older. Family content can include children’s names, birthdays, photos, videos and memories supplied by adult family members. We protect this content using the family’s access settings and the safeguards described in this policy.

Optional recognition of a child requires a parent or legal guardian’s separate permission. Adult relatives who are not the parent or legal guardian cannot give that permission merely because they belong to the family. Where we know a child’s birthday, guardian recognition permission ends at 18 and new adult permission is needed under the family’s recognition setup. Contact [email protected] to correct a child’s information, withdraw permission, or report a child-created account.

We honor Do Not Track signals and do not track, plant cookies, or use advertising when a Do Not Track browser mechanism is in place.

We update the version and effective date when this policy changes. We provide additional notice of material changes in the app or by email. Where renewed acceptance or permission is required, affected processing remains unavailable until the required choice is recorded. Accepting this policy does not itself enable facial recognition or provide biometric permission for another person.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

Email: [email protected]
Mail: Renji Labs, Inc., 7775 Walton Pkwy Ste 100, New Albany, OH 43054 USA

We will respond to all privacy-related inquiries within 30 days.

This policy explains how Kaiary handles information. Acceptance of the service terms and acknowledgement of this policy are separate from the affirmative permissions used for optional facial recognition. You may decline or withdraw recognition permission and continue using photo storage and manual organisation.

Our complete safeguards—administrative, technical, and physical—are described in our Information Security Program. The retention periods for app and account data, and how that data is destroyed when no longer needed, are set out in our Data Retention & Destruction Policy. Website analytics and choice storage are covered in Section 14.4 below.

Voice-to-text input. When you use the live "talk to type" feature to dictate journal entries, the audio is processed by your device's built-in speech recognition framework (Apple Speech on iOS, Google Speech Services on Android). Depending on your device, language, and OS settings, that framework may send brief audio samples to Apple's or Google's servers for transcription. Once your speech has been converted to text, only the resulting text is stored by Kaiary—we do not retain the live audio. This is separate from voice memos and audio recordings you save as journal content, which are uploaded to our infrastructure and transcribed by the AI systems described in Sections 3.1 and 5.4.

Push notification tokens. If you enable push notifications, we store the push token issued to your device by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM). The token is delivered to us via Expo's push service, which we use to dispatch notifications. Tokens contain no personal information about you, but are linked to your account so we can send you the notifications you've subscribed to.

14.1 Location Information

With your permission, we collect precise location data from your device. Location is used to:

• Suggest contextual journaling prompts based on where photos and entries were created
• Personalize features and content for your area
• Add automatic location tags to entries and memories you create

Location access is requested when you first use a location-aware feature, and you can change or revoke it at any time in your iOS settings (Settings > Privacy & Security > Location Services > Kaiary). Precise location is linked to your account, but we do not use location for advertising and we do not share precise location with our advertising partners.

Maps. When you view memories on a map, we use the device's default map provider—Apple Maps on iOS and Google Maps on Android. Map tiles and search queries you submit while interacting with the map are handled by Apple or Google according to their respective privacy policies; Kaiary does not send your stored memories to those providers.

14.2 Purchase Information

If you subscribe to Kaiary's paid features through Apple's in-app purchase system, we receive purchase history information from Apple, including subscription tier, transaction identifiers, and renewal status. We do not receive your payment card details—those are handled directly by Apple. We use purchase information to:

• Provide access to features you've paid for
• Handle customer support and billing inquiries
• Analyze our subscription business performance
• Measure the effectiveness of our advertising campaigns by linking subscription conversions to the ad, channel, or campaign that brought you to Kaiary

14.3 Identifiers and Marketing Data

We collect or generate the following identifiers and marketing-related data:

• A Kaiary User ID assigned to your account
• Device identifiers—including Apple's Identifier for Vendor (IDFV), and, only with your explicit permission via the App Tracking Transparency prompt, the Identifier for Advertisers (IDFA)
• Advertising data—such as which ad you clicked, install attribution information, campaign source, and conversion events you complete in the app

We use these identifiers and the associated event data to: measure the effectiveness of our advertising on platforms such as Google Ads, Meta (Facebook/Instagram) Ads, and AppsFlyer; understand how users discover and engage with Kaiary; personalize content within the app; and promote Kaiary to potential new users (including through lookalike audience targeting). These identifiers, along with related usage and purchase events, are shared with the advertising and analytics partners listed in Sections 5 and 14.5.

Under Apple's App Store privacy framework, this activity is classified as tracking, because identifiers and event data may be linked with data those partners collect from other apps and websites for advertising or attribution purposes. We do not sell your personal data, we do not share your photos, videos, journal entries, or audio with these partners, and on iOS we do not access your IDFA without your consent (see Section 15: App Tracking Transparency).

• Amazon Web Services (AWS): Hosts our encrypted database, file storage, serverless functions, and the AI systems we run on our own infrastructure. AWS Bedrock, a managed AI service we also use, is described in Section 5.4.
• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM), via Expo Push: Deliver push notifications to your device. Receive your device push token and the notification payload we ask them to deliver (such as activity alerts and reminders).
• Expo / EAS (Expo Application Services): Provides our mobile app build and over-the-air update infrastructure. Receives anonymous device, OS, and app-version metadata when checking for updates.

14.4 Website Analytics

Google Analytics 4 (Google LLC) and PostHog (PostHog, Inc., hosted in the United States) for the website: If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, or we cannot determine where you are visiting from, optional website analytics runs only after you accept it in Cookie settings. If you visit from anywhere else, website analytics runs automatically and you can turn it off at any time in Cookie settings. To apply the right option, the website looks up only the country your connection comes from; your browser keeps that country code for the browsing session, and it is not sent to the analytics providers. While analytics runs, each configured provider receives the public pages you view, approved campaign labels and technical browser information. We do not keep IP addresses for website analytics: Google Analytics uses the IP address only to derive an approximate location such as country or region and then discards it, and PostHog is set to discard client IP data and the approximate location it would derive from it, on every website event. Google Analytics associates the data with a cookie identifier and PostHog with a random identifier kept in your browser's storage; neither is linked to a Kaiary account, app data or a person profile. The only website events we send are pageviews and a short list of named interactions: App Store link clicks, website language changes and page-speed measurements. We exclude private app content, creator lookup values, raw queries/fragments, names, email addresses and other personal identifiers from our website events. We use no website session replay, heatmaps, automatic click capture or advertising cookies.

You can decline or withdraw at any time in Cookie settings in the website footer. Wherever you visit from, Global Privacy Control or Do Not Track signals keep website analytics off. Withdrawal stops new website analytics and clears analytics storage we control; it does not itself erase information already received by a provider.

Necessary browser storage remembers your choice, its date and the notice version, without creating a consent receipt identifier. A choice to allow analytics expires after 365 days or when the notice changes; a choice to turn analytics off stays in effect until you change it. Expiry ends the choice's validity; the stored record remains until replaced or cleared in your browser. Google Analytics cookies are configured for up to 365 days without renewal on each visit; PostHog's identifier stays in browser storage until you withdraw or clear it. These website storage rules are separate from the app's product analytics and account consent records in our Data Retention & Destruction Policy.

Google Analytics retains website event data for 2 months. PostHog retains website event data for the period of our PostHog plan, and you can ask us to delete it at any time. To request access to or deletion of information already received by a provider, contact [email protected].

Loading an external YouTube or Vimeo video is a separate choice that connects to that provider and may disclose your IP address or use provider storage. External images outside Kaiary's configured first-party media origins require a separate loading choice that connects to the displayed host and may disclose your IP address. Images served by Kaiary or its configured first-party media origins load directly. Loading external media does not allow website analytics.

14.5 Advertising and Attribution

We work with the following partners to measure the effectiveness of our marketing and to reach potential new users. These partners may receive identifiers (such as IDFA, where you have granted permission via Apple's App Tracking Transparency prompt, IDFV, hashed email, or click identifiers) along with conversion events such as app installs, account creation, and subscription purchases. They may combine this data with information collected from other apps and websites for advertising and measurement purposes.

• Google Ads (Google LLC): Ad delivery and conversion measurement on Google's properties (Search, YouTube, Display).
• Meta Ads (Meta Platforms, Inc.): Ad delivery and conversion measurement on Facebook, Instagram, Messenger, and the Audience Network, including via Meta's Conversions API.
• AppsFlyer: Mobile measurement and attribution. Receives install events, in-app conversion events, and device identifiers in order to attribute installs and conversions to the correct ad campaigns.

These advertising partners are the basis for the data types disclosed as "Used for tracking purposes" in our App Store privacy nutrition label. You can limit this activity at any time by declining the App Tracking Transparency prompt on iOS, or by adjusting your ad personalization settings with each partner directly.

On iOS devices, we comply with Apple's App Tracking Transparency (ATT) framework. Before we use your Identifier for Advertisers (IDFA) or otherwise link your activity in Kaiary with data collected about you in other companies' apps and websites, we will present you with the system prompt asking whether to allow tracking.

• If you allow tracking, we may share your IDFA and conversion events with our advertising partners (Google Ads, Meta Ads, AppsFlyer) to measure ad performance and personalize advertising.
• If you decline tracking, we will not access your IDFA, and we will rely on Apple's privacy-preserving alternatives—such as SKAdNetwork and AdAttributionKit—for aggregated, non-identifying campaign measurement. Apple permits this measurement without ATT consent.

You can change your tracking preference at any time on your iOS device under Settings > Privacy & Security > Tracking, either globally or per app.

Regardless of your ATT choice, we still collect first-party data linked to your Kaiary account (such as your User ID, in-app events, and crash data) for app functionality, analytics, and our own marketing measurement, as described in Sections 2 and 3.