Android app
privacy policy.

KITEDALE — ANDROID PRIVACY POLICY Version 2 · Updated 3 November 2026

Kitedale is an invitation-only family messaging and calling test operated by Felipe Franciosi. This notice covers the Android app and its Matrix, calling and notification services. The website account service has a separate notice at https://www.kitedale.com/privacy.

PRIVACY CONTACT AND REMOVAL REQUESTS For privacy questions, corrections, account removal or deletion of associated data, email [email protected]. A parent or guardian should identify the affected account and explain the request. Do not email account passwords, access tokens or encryption keys. This is not an emergency contact.

WHAT THE APP USES The app shows names and KDO IDs. Its underlying account, device and conversation identifiers and approved people come from Kitedale. A signed-in, approved guardian connects a device by approving a short-lived device code and choosing a child they currently manage. The device does not ask for the child’s account password. The service records device identifiers, approval and device times, and the approving guardian. Pairing codes and the device’s private proof are stored as hashes; credential delivery receipts are encrypted and removed after the ten-minute pairing window. Device sign-in lasts 30 days and can be revoked by a current guardian. Device-enrollment metadata is removed after 90 days; separate account audit history follows the website retention process.

The saved device session and its database key are encrypted using Android Keystore. The encrypted Matrix SDK database, server-supplied contact and conversation cache, block list, guardian PIN verifier and policy acceptance version/time remain in this app’s private device storage. Replacing an old sign-in preserves an encrypted local archive; it does not recover history for another account. App backup is disabled. Clearing app storage or uninstalling removes this local state, but does not delete the server account or other people’s copies.

MESSAGES AND CALLS Messages use Matrix end-to-end encryption. Calls use LiveKit frame encryption with keys exchanged through encrypted Matrix device messages. Kitedale prepares encrypted, invitation-only conversations for currently approved contacts. Server operators process account/device IDs, room membership, sender/event IDs, timestamps and connection metadata even when content is encrypted. Intended recipients can read messages and hear/see calls. Encryption cannot prevent a recipient from saving or sharing what they receive.

Camera and microphone access is requested only for a call you start or join, after an in-app explanation. Call participants receive the enabled audio/video. LiveKit relays call media and processes connection/participant metadata. A call may continue in the background until you end it. The app does not intentionally record calls on the server. Device-level permissions can be changed in Android settings.

NOTIFICATIONS AND PROVIDERS After guardian setup, Google Firebase Cloud Messaging uses a Firebase installation identifier and registration token and processes device/connection information to deliver notification signals. We register that token with our Matrix push service, alongside the app ID and device manufacturer/model. Our push configuration sends identifiers needed to fetch an event, not the plaintext message body. Notification previews say “New message” rather than showing its text. The app may briefly reconnect and sync in the background after a signal. Notifications can be disabled in Android settings; messages remain available when the app is open.

Our hosting providers deliver Matrix, the push gateway and LiveKit. Google operates Firebase and Google Play. Network and infrastructure providers process IP addresses and security/connection metadata. There are no ads, advertising identifiers or location permissions in this app, and we do not sell personal data. We do not enable Firebase Analytics, Crashlytics or app marketing analytics. Embedded calling diagnostics must also remain disabled in the released configuration.

REPORTS AND BLOCKING Reports send your Matrix ID, the reported person’s ID, your reason and, for a message report, the room/event IDs to the server administrator. Message text is not automatically included. If you tick the evidence option, that selected message’s readable text is sent securely over HTTPS outside the end-to-end encrypted conversation so the administrator can review it. Do not include unnecessary private information. Reports are stored by Synapse, and the operator must review them and act on abuse. Reports are not emergency assistance.

The block list is local to this app installation. Blocking hides direct and group conversations containing that person and stops messages/calls/alerts involving those conversations on this device. Account-wide contact revocation is a separate guardian action on the family website.

RETENTION AND DELETION This prototype does not automatically expire all message, account or report records. They remain until the operator removes them under the project’s retention/removal process. Operational logs rotate according to server configuration; private backups may retain older copies until those backups are removed. The operator must explain the scope and timing of a removal request, including any necessary security/abuse records retained and their reason. Deletion cannot remove recipients’ copies or material they have shared elsewhere.

The app does not offer account registration. A parent or guardian can ask the administrator for access, correction, account removal or deletion of associated data; disabling an account alone is not deletion. The operator must retire the account, revoke sessions and push registrations, and handle server data and backups according to the removal request and applicable obligations. Website-only profile deletion must not be represented as complete Matrix data deletion.

CHILDREN AND CHOICE Families participate with parent/guardian involvement and explicit device setup. A child’s Google sign-in, Play installation, account label or local PIN is not independently verified parental consent. Guardian relationships and contact approvals are administered separately. Please use only the data needed for this limited family test, and stop if the app behaves unexpectedly.