Privacy Policy

Last updated: 14 July 2026 · Effective immediately

Kith is a personal WhatsApp AI agent for families. This page explains what data we collect, why, and how we protect it — in plain English.

1. What we collect

Account info: the family admin's email, billing details via Stripe, and the WhatsApp phone number used to link your agent.
Family config: names, ages, and interests of family members you add during onboarding, plus the house rules you set (bedtime, tone, safe topics).
WhatsApp messages: the message text and metadata that flow through your family agent while it's active. This is what the agent reads to do its job.
Operational metadata: timestamps of messages processed, per-message routing decisions, and aggregate counters (e.g. "50 messages handled today").

2. What we do NOT collect

Location data. Live-location shares and one-off location pins are dropped at the bridge before they reach the agent. We never store, see, or log them. Aggregate counters only — no per-user location data, ever.
Media files you don't reference. Images, voice notes, documents, and stickers are downloaded only when the agent needs to reply about them, and are cached temporarily on the server.
Your contact list. WhatsApp provides a per-member allowlist of family JIDs. We don't see, store, or process anything outside that allowlist.

      The location rule is policy, not a feature. Even if a
      family member shares their live location in a group where the agent
      is active, the agent is designed to never see those messages. This
      is enforced at the bridge level and audited weekly.
    

3. How we protect your data

All traffic between WhatsApp, our bridge, and the agent is encrypted in transit (TLS).
Family config and operational data are stored on a single secured server (VPS) with no third-party access except our payment processor (Stripe).
Access to the production server is limited to one operator (the founder) with full audit logging.
Per-family data is sandboxed — no cross-family reads, writes, or lookups, ever.

4. Who we share data with

Stripe — processes your payment. We send them the price tier and your email; they return a subscription ID. We never see or store your card number.
Meta / WhatsApp — delivers messages between your family and the agent. We use the personal WhatsApp web session (linked device) for the 5 family test cohort, and the official Cloud API for production. Both routes are covered by Meta's platform terms.
OpenAI / Anthropic / xAI / DeepSeek — process the message text you send through the agent to generate replies. Messages are sent to whichever model is best suited to the request. No data is used to train their models under the standard API terms.

We do not sell your data, share it with advertisers, or use it for any purpose other than operating the Kith service for your family.

5. Your rights

Export: on request, we will email you a copy of all data we hold for your family within 7 days.
Delete: when you cancel, all family data is purged within 30 days. Stripe records are retained for tax/audit purposes per their policy.
Change your mind: you can edit family rules, member details, and the agent's tone at any time from the dashboard.

6. Children's data

Kith is designed for family groups that include children. The account holder must be 18 or older. We do not knowingly collect data from children under 13 outside the scope of the family config the parent provides. If you want a child removed from the family config, contact us and we'll purge their data on the same timeline as section 5.

7. Changes to this policy

If we make a material change, we'll email the family admin at least 14 days before the change takes effect. Minor clarifications may be made silently with a new "Last updated" date at the top of this page.

8. Contact

Questions or requests: privacy@kith.website.
We aim to respond within 3 business days.

9. Email & Authentication

To create a Kith account, we collect your email address for login verification and account recovery. Passwords are never stored in plain text — they are hashed using bcrypt (industry-standard, one-way hashing).

Session cookies are set as HttpOnly and Secure, meaning they cannot be accessed by JavaScript and are only transmitted over HTTPS. Sessions expire after 7 days.

Password reset tokens expire after 1 hour and can only be used once. Email verification links expire after 24 hours. We do not share your email address with third parties.