Privacy Policy

1. Introduction

Renji Labs, Inc. ("we," "our," or "us") operates Kaiary, a privacy-first AI-powered family journaling application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services.

2. Information We Collect

2.1 Account Information

When you create an account, we collect: your name, email address, phone number (for SMS verification), and authentication credentials. If you sign in using Apple or Google, we receive only the authentication token and basic profile information you authorize.

2.2 Family Content

The core of Kaiary is storing your family memories. This includes:

• Journal entries and text content you create
• Photos and images you upload
• Videos you upload
• Audio recordings and voice notes
• Milestone events and dates
• Any captions, tags, or descriptions you add to your content

2.3 Biometric Information

Face recognition is entirely opt-in. You may choose to manually tag photos instead. You can delete your facial recognition data at any time without deleting your photos.

2.4 Device and Usage Information

We automatically collect certain information when you use the app, including: device type and operating system, app version, general usage patterns and feature interactions, crash logs and performance data, and IP address (used only for security purposes).

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Kaiary service
• Process and store your family content securely
• Generate AI-powered features including automatic photo descriptions, searchable content summaries, and storybook-style illustrations (all processed on our self-hosted infrastructure)
• Enable face recognition for photo organization (if you opt in)
• Send service-related communications
• Ensure security and prevent fraud
• Comply with legal obligations

4. Data Storage and Security

Your data is stored on secure servers operated by Amazon Web Services (AWS) under our direct control. We implement industry-standard security measures including:

• Encryption in transit (TLS 1.3)
• Encryption at rest (AES-256)
• Regular security audits
• Access controls and monitoring

All AI processing, including image analysis, text processing, and face recognition, occurs on our self-hosted infrastructure. Your content is never sent to third-party AI services like OpenAI, Google AI, or AWS Rekognition.

5. Third-Party Services

We use limited third-party services that receive only the minimum data necessary:

• Supabase: Authentication only—receives your email and authentication credentials
• Twilio: SMS verification only—receives your phone number for one-time codes
• PostHog: Analytics—receives anonymized usage data, no personal content
• Sentry: Error reporting—receives technical crash data, no personal content
• Apple/Google Sign-In: If you choose these options, they provide us only with an authentication token

None of these services have access to your photos, videos, journal entries, or other family content.

6. Biometric Data Disclosure

For users who opt into face recognition, we provide the following disclosures in compliance with biometric privacy laws including the Illinois Biometric Information Privacy Act (BIPA):

• Purpose: Facial geometry data is collected solely to enable automatic face tagging and photo organization features.
• Retention: Biometric data is retained until you disable face recognition, delete the associated photos, or delete your account.
• No Sale: We will never sell, lease, or trade your biometric data.
• Storage: Biometric data is processed and stored exclusively on our self-hosted servers.
• Deletion: You may delete your biometric data at any time through the app settings without deleting your photos.

By enabling face recognition, you consent to the collection and processing of facial geometry data as described in this policy.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide services. You may delete individual content items at any time. When you delete your account, we will delete all your personal data—including all photos, videos, journal entries, and biometric data—within 30 days. Some information may be retained longer if required by law or for legitimate business purposes such as fraud prevention.

8. Your Privacy Rights

8.1 All Users

Regardless of your location, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data and account
• Export your data in a portable format
• Opt out of face recognition at any time
• Withdraw consent for specific processing activities

8.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including:

• The right to know what personal information we collect, use, and disclose
• The right to delete your personal information
• The right to opt out of the sale or sharing of personal information (note: we do not sell your personal information)
• The right to non-discrimination for exercising your privacy rights
• The right to correct inaccurate personal information

To exercise these rights, contact us at privacy@kaiary.ai. We will respond to verifiable requests within 45 days.

8.3 European Economic Area Residents (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation, including:

• The right to access your personal data
• The right to rectification of inaccurate data
• The right to erasure ("right to be forgotten")
• The right to restrict processing
• The right to data portability
• The right to object to processing
• Rights related to automated decision-making and profiling
• The right to withdraw consent at any time

Our legal basis for processing your data includes: performance of our contract with you (providing the service), your consent (for optional features like face recognition), and our legitimate interests (improving the service, ensuring security).

9. Children's Privacy

Kaiary is intended for users who are 18 years of age or older. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@kaiary.ai.

Note: Kaiary is designed for families to document their lives, which may include photos and stories about children. This content is provided and controlled by adult account holders and is protected with the same security measures as all other content.

10. Do Not Track

We honor Do Not Track signals. When we detect a Do Not Track signal from your browser, we limit data collection to what is strictly necessary for the service to function.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy in the app and updating the "Last Updated" date. For significant changes, we will provide additional notice such as in-app notifications or email. Your continued use of Kaiary after changes become effective constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

We will respond to all privacy-related inquiries within 30 days.

13. Acknowledgment

By using Kaiary, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.