Kith

Privacy Policy · Effective 2026-09-05

This policy explains what Xu Jin (“we”, “us”) does with information when you use the Kith mobile application and the service behind it at chatwithkith.app (together, the “Service”), the internal tool we run for the staff of GaoYun (高运). It is written to be read, not to be survived.

1. Who is responsible

Xu Jin is the personal information handler (data controller) for the Service. Questions, requests, and complaints go to contact@chatwithkith.app. We answer within 15 working days. Reports of abuse or objectionable content go to contact@chatwithkith.app and are acted on within 24 hours.

2. What we collect

You choose your own username when you register; the account does nothing until our administrator approves it. Here is everything that account consists of.

What the app does not collect

• No email address, phone number, or real name — inside Kith you are a username.
• No address book, contact list, or social graph import.
• No location data of any kind, precise or coarse.
• No advertising identifier, and no cross-app or cross-site tracking. We do not track you as the App Tracking Transparency framework defines it, and we never ask for permission to, because there is nothing to ask for.
• No analytics SDK, no crash-reporting SDK, no attribution SDK, no social login SDK. The application ships with none of these embedded.
• No behavioural profiling and no automated decision-making about you.

3. One-to-one messages

A one-to-one message is relayed to the recipient, and once their device confirms delivery, the server deletes its copy. From that point the conversation is stored only on the two devices that took part in it.

Three honest consequences you should weigh:

• We do not hold your one-to-one history. If you lose your device or reinstall, that history is gone, and we cannot restore it — for you or for anyone else. This is the design, not a defect.
• One account, one active device. Signing in on a new device leaves the old device's history behind.
• Routing data is separate from content. We necessarily know that an account sent something, when, and to whom, because that is what routing a message means.

4. Group messages, files, and avatars

Group messages, stored files, and avatars are held on our servers so they can be delivered and re-downloaded across your devices. They remain until you delete them, or until the retention limits in §7 apply. Nicknames, group names, folder names, file names, and the private remarks you set on a contact are stored under the same protections as the content itself.

If you would rather something not be kept on our servers at all, use a one-to-one chat — see §3.

5. Push notifications

To alert you while the app is closed we send a notification through Apple Push Notification service or Firebase Cloud Messaging. The notification carries generic wording only — it never contains message text, a sender's name, a file name, or anything decryptable. Apple and Google therefore learn that your device was pinged, not what was said. Turn notifications off in your phone's settings and we stop sending them.

6. Who else gets your data

Nobody. We do not sell personal information, we do not share it for advertising, and we do not disclose it to third parties for their own purposes. The only external parties involved at all are:

• Apple / Google, who deliver the contentless push notification described in §5.
• Our hosting provider in United States (San Francisco), who supplies the servers. They supply infrastructure only, and have no right of access to your account.

If we are ever compelled by valid legal process, we can produce only what we actually hold: account records and the metadata in §2. We cannot produce one-to-one message content, because we do not have it.

7. How long we keep things

• One-to-one messages: deleted from the server as soon as delivery is confirmed. Kept on your own device until you delete them or a timer expires.
• Self-destructing messages: deleted at the timer you set, and in every case no later than 90 days — that ceiling is enforced by the server and cannot be raised.
• Groups and files: kept until you or the owner deletes them.
• Dormant accounts: if you do not sign in for 90 days, the account is destroyed automatically. We warn you 14 days and 3 days beforehand.
• Administrative audit log: a tamper-evident record of administrator actions is retained. It records who approved or suspended an account — never message or file content.
• Abuse reports: when you report someone, what you write goes to our moderators — that is the point, and for a one-to-one chat your description is the only evidence that can exist, since we do not hold the message. Reports you file are deleted with your account. Reports about you are kept as a record of what we were told and what we did, in the same way the audit log is.

8. Deleting your account

Settings → Delete account, in the app, at any time, without contacting anyone. It takes two confirmations because it cannot be undone.

Deletion is immediate and irreversible: your stored content is rendered permanently unrecoverable at once — including in any backup we hold. The empty rows and files are then reclaimed in the background. Your username is retired permanently and cannot be re-registered by anyone, including you.

9. Your rights

Under the Personal Information Protection Law of the People's Republic of China you may ask us to: tell you what we hold about you; give you a copy or transfer it; correct it; delete it; withdraw a consent you previously gave; or explain how we handle it. You may also complain to a regulator.

Write to contact@chatwithkith.app. We reply within 15 working days. Two limits, stated plainly: we may need you to sign in to prove the account is yours, and we cannot hand over one-to-one message content that we do not possess.

10. Where your data is processed

The Service runs on servers in United States (San Francisco). If you use Kith from within mainland China, your information is transferred outside it. By creating an account you give the separate consent that such a transfer requires. We transfer only what §2 lists, only to operate the Service, and to no third party for its own purposes.

11. Age

Kith is a workplace tool. An account works only once an administrator approves it, and approval is given only to GaoYun staff, so the Service is not directed to children and we do not knowingly hold information about them. If you believe a child has an account, write to contact@chatwithkith.app and we will remove it.

12. Security

Industry-standard protections in transit and at rest; Argon2id password hashing; biometric or PIN lock on the app itself; and an administration console built on a separate binary with a separate least-privilege database account scoped to account metadata alone.

No system is perfect, and we will not claim ours is. If you find a vulnerability, tell us at contact@chatwithkith.app.

13. Changes

If we change this policy we will update the date at the top and, for anything material, tell you in the app before it takes effect.

14. Contact

Xu Jin · contact@chatwithkith.app (privacy) · contact@chatwithkith.app (abuse and objectionable content)