Privacy policy

Kindred HQ of Lagos, Nigeria operates Kindred and is the data controller for the personal data processed through the Service. This policy explains what we collect, why, and the choices and rights you have. It applies to the Kindred website, web app and mobile apps.

We comply with the Nigeria Data Protection Act 2023 (NDPA) and the guidance of the Nigeria Data Protection Commission (NDPC), and with the data protection laws of the other countries where Kindred is available, including the EU and UK General Data Protection Regulation (GDPR), South Africa's Protection of Personal Information Act (POPIA), Kenya's Data Protection Act 2019, Ghana's Data Protection Act 2012 and US state privacy laws such as the California Consumer Privacy Act (CCPA). See section 9 for region-specific details.

Information you give us:

• Account data: username, first and last name, email address, phone number, date of birth, gender, who you want to meet, and your password (stored only as a salted, one-way hash).
• Profile data: photos, bio, prompts, interests, languages, occupation, relationship intent, city and neighbourhood.
• Values answers: your questionnaire answers, how important each one is to you, and your dealbreakers.
• Verification data: a liveness selfie and the result of comparing it with your profile photos.
• Communications: messages, reactions, voice notes, date proposals, follow requests, reports, appeals and messages to our support team.
• Safety tools: trusted contacts you choose to add, and the details you share through Safety Share.
• Purchases: your plan, subscription status, Coin balance and transaction history, and payment references. Paystack or your app store processes your card or account details; we never see or store your full card number.

Information created when you use Kindred: likes, passes, matches, connections, blocks, game moves, results and ratings, and notification and feature settings.

Device and technical data: device and browser type, operating system, app version, language, IP address, an approximate country derived from it (to pick your language and currency), session and device identifiers, crash logs, and security signals used to detect fraud, spam and abuse. We do not collect your precise GPS location: your location on Kindred is the neighbourhood you choose.

Information from others: reports and messages other members send about you, and information from our payment and verification providers (for example, that a payment succeeded or a liveness check passed).

Some information is sensitive (“special category”) personal data under the law: for example values answers that reveal your religious or philosophical beliefs, information about your sex life or sexual orientation that can be inferred from who you want to meet, and the biometric data used for selfie verification. We process sensitive data only with your explicit consent, which we ask for separately during onboarding, and only to match you, explain your matches, and verify that you are a real person.

You choose whether faith answers appear on your profile, you can skip any question, and you can change answers at any time. You can withdraw your consent at any time in Me → Settings → Privacy; this does not affect processing before you withdrew it, but it means we stop using that data for matching, which may reduce the quality of your introductions.

We delete the raw liveness selfie within 30 days of a completed check and keep only the verification result. We never use sensitive data for advertising.

• To provide the Service (performance of our contract with you): creating and securing your account, building your daily introductions and compatibility explanations, messaging, games, leaderboards, date planning, syncing your data across devices, and processing subscriptions and Coins.
• To keep members safe (legitimate interests, legal obligation and, where relevant, vital interests): verification, detecting scams, spam, fake accounts and abuse, scanning messages for risky content such as early requests for money or contact details, moderating content and reports, and enforcing our Terms.
• Sensitive matching and verification (explicit consent): using values answers and biometric verification as described in section 3.
• To improve Kindred (legitimate interests): understanding how features are used, measuring performance, fixing bugs and testing new features, using aggregated or de-identified data wherever possible.
• To communicate with you (contract, legitimate interests or consent): service and security messages, receipts, renewal reminders, and optional notifications and news, which you can turn off at any time.
• To meet legal obligations: tax and accounting records, responding to lawful requests from authorities, and handling your privacy requests.

Other members see your public profile (photos, first name, age, neighbourhood, bio, prompts, interests, compatibility reasons and, if you choose, faith answers), your username in search, your game results and ratings on leaderboards, and, after you match or connect, the messages you send. They only ever see your neighbourhood, never your exact location. A Safety Share link shows your trusted contact the venue, time and your match's first name, and expires after the date.

Service providers (processors) who handle data on our behalf, under written contracts that require confidentiality and security and forbid them from using it for their own purposes: cloud hosting (Vercel), database hosting (Neon), payments (Paystack and app stores), SMS and email delivery, image and content moderation, liveness verification and customer support tools.

Authorities and others where required: law enforcement, regulators or courts when the law requires it, or when we believe in good faith that disclosure is needed to prevent serious harm, investigate fraud, or protect the rights and safety of members and the public.

Business transfers: if Kindred HQ is involved in a merger, acquisition or sale of assets, your data may be transferred to the new owner, who must continue to protect it in line with this policy. We will tell you before that happens.

We do not sell your personal data and we do not share it with third parties for their own advertising.

Kindred is a global service, so your data is processed in other countries, including the United States, where our main hosting and database providers operate, and in the countries of the members you interact with. Whenever we transfer personal data out of Nigeria, the European Economic Area, the United Kingdom, South Africa, Kenya or another country with transfer rules, we use a lawful transfer mechanism, such as an adequacy decision, standard contractual clauses approved by the relevant authority (including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum), or your consent where that is permitted, together with additional safeguards such as encryption. You can ask us for a copy of the relevant safeguards through the Help page.

We keep personal data only for as long as we need it for the purposes in this policy:

• Account, profile and values data: while your account is active.
• When you delete your account: your profile is hidden immediately, and your personal data is deleted or anonymised within 30 days, and from backups within a further 90 days.
• Raw liveness selfies: deleted within 30 days of the check; the pass or fail result is kept while your account is active.
• Reports, moderation actions and ban records: up to 3 years after the account is closed, to protect members and prevent banned users returning.
• Payment and transaction records: up to 6 years, as required by tax and accounting laws.
• Inactive accounts: if you do not sign in for 2 years, we may delete your account after giving you notice.

Messages you sent to other members may remain visible to them in their conversations until they delete them or their own account.

Depending on where you live, you have the right to:

• access your data and receive a copy in a portable format: Me → Settings → Blocked & your data → Download my data gives you a file instantly;
• correct inaccurate data, by editing your profile or asking us;
• delete your account and data: Me → Settings → Blocked & your data → Delete my account;
• object to or restrict certain processing, including processing based on legitimate interests and direct marketing;
• withdraw consent at any time, without affecting processing that took place before;
• not be subject to decisions based solely on automated processing that significantly affect you. Permanent bans are always reviewed by a person, and you can ask for any automated decision to be reviewed;
• complain to a data protection authority (see section 9).

To exercise any right, use the in-app controls or contact our privacy team through the Help page. We may need to verify your identity before acting on a request. We respond within 30 days (or sooner where the law requires), and we do not charge a fee unless a request is manifestly unfounded or excessive. We will never treat you differently for exercising your rights.

• Nigeria: your rights under the NDPA 2023 include access, rectification, erasure, restriction, portability, objection and the right to withdraw consent. You can complain to the Nigeria Data Protection Commission (NDPC).
• European Economic Area and United Kingdom: our legal bases are those listed in section 4. You have the rights in section 8, including data portability, and you can complain to the supervisory authority where you live or work (in the UK, the Information Commissioner's Office). Where required by law, we appoint a representative in the EU and the UK.
• South Africa: we process personal information in line with POPIA's conditions for lawful processing. You can complain to the Information Regulator.
• Kenya: you have the rights under the Data Protection Act 2019 and can complain to the Office of the Data Protection Commissioner.
• Ghana: you have the rights under the Data Protection Act 2012 and can complain to the Data Protection Commission.
• Brazil, India, Canada and other countries: you have the rights given by your local law, such as the LGPD in Brazil, the Digital Personal Data Protection Act 2023 in India and PIPEDA in Canada, and can complain to your national data protection authority.
• United States (including California): in the last 12 months we collected the categories of personal information described in section 2 (identifiers, account and profile information, sensitive personal information such as account login and the data in section 3, commercial information about purchases, internet and device activity, and inferences about compatibility), for the purposes in section 4, from you, your device and our providers. We disclose it only to the categories of recipients in section 5. We do not sell or “share” personal information for cross-context behavioural advertising, and we use sensitive personal information only for the purposes permitted by law. You can ask to know, access, correct or delete your personal information, and you can use an authorised agent. We will not discriminate against you for using these rights.

Kindred is for adults only. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete the data, except what we must keep to protect children or report to the authorities. If you believe a minor is using Kindred, please report the profile or contact us through the Help page.

We protect your data with technical and organisational measures appropriate to the risk, including encryption in transit, salted and slow password hashing, hashed session tokens, strict access controls on a need-to-know basis, two-factor authentication and audit logs for staff and moderator actions, and regular testing of our systems. No system is perfectly secure, so please use a strong, unique password and keep your devices safe. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires, in Nigeria within 72 hours of becoming aware of it.

We use a small number of cookies and browser storage that are needed for Kindred to work, such as keeping you signed in, remembering your language and keeping the app usable on weak connections. We do not use advertising cookies. See our Cookie policy for the full list and your choices.

We may update this policy as Kindred and the law change. We will tell you in the app or by email before a material change takes effect, and ask for your consent again where the law requires it. The “Last updated” date at the top shows when this policy last changed.

Kindred HQ has appointed a Data Protection Officer who oversees how we handle personal data. For any privacy question or request, contact our privacy team and Data Protection Officer through the Help page (choose Privacy), or from Me → Help in the app. If you are not satisfied with our response, you can complain to your data protection authority (see section 9).