Kyn Privacy Policy

Version 2026-09-27-v1.0. Effective date: September 27, 2026. Last updated: October 7, 2026.

Looking for the website and waitlist privacy notice? It is at kynrewards.com/privacy/website.

This Privacy Policy explains how Kyn Technology Inc., a Delaware corporation ("Kyn", "we", "us"), collects, uses, shares and protects personal information when you use the Kyn mobile app for iOS and Android and the services that run it (together, the "Service"). It also explains the choices and rights you have. Our website and waitlist have their own privacy notice, linked from kynrewards.com/privacy.

Kyn is for adults in the United States. If you do not agree with this policy, please do not use the Service.

1. The short version

• Kyn lets you support a creator's goal through rewards on eligible purchases. Supporters never pay a creator out of their own pocket, and we never move money out of your bank account.
• Your bank login is entered only with Plaid, and Kyn never receives it. Your card is entered only in Evervault's secure card form: Kyn never sees your full card number in readable form, never asks for the security code, and does not store the card number or expiration date.
• Instead of connecting a bank, you can send photos of your receipts. Kyn staff look at each photo to check the purchase, and we delete the photo 30 days after we decide. We remove location data from the photo on your device, before it is sent.
• We use purchase details to decide which purchases count. We remove merchant names and purchase descriptions from our records shortly after a purchase is processed; we keep the amount, the date and a broad category (for example "groceries"), and, for a purchase that earned a reward, which participating shop it was.
• We do not sell your personal information, we do not share it for cross-context behavioral advertising, and the app contains no advertising or cross-app tracking tools.
• Push notifications and emails are short and generic. They may name the creator you support. A push notification about your own purchase can also name the shop where you made it. It never contains an amount, and you can turn shop names off in Settings > Notifications. Notifications can appear on your lock screen, so a shop name may be visible to anyone who can see your phone. Notifications and emails never contain purchase amounts or bank or card details.
• Some badges are public: a creator's badge can show on their page, and a "Founding supporter" badge can show next to your name on that creator's goal board. Badges are recognition only. A row that shows "A supporter" never shows a badge to other people.
• You can ask to access, correct, export or delete your information, and you can delete your account in the app (Settings > Delete account) or from kynrewards.com/delete-account.

2. Information we collect

Information you give us

• Account information: your email address or mobile phone number, and a password if you choose to set one. If you sign in with Apple or Google, we receive the email address that the provider shares with us (Apple may give us a private relay address), an account identifier and, if the provider shares it, your name, which we only use to suggest your display name.
• Your agreements: the versions of the Terms of Service and this Privacy Policy that you accepted, the time you accepted them, and your confirmation that you are 18 or older. We do not ask for your date of birth.
• Supporter profile: the display name you choose and whether your name or "A supporter" is shown on a creator's goal board.
• Creator profile and content: your display name, handle, short bio or tagline, portrait photo, intro video (including its sound), your goals (title, description and target) and your choices about discovery (searchable or link-only) and public progress.
• Reports and blocks: if you report a creator, the reason you choose and the optional note you write; if you block a creator, which creator you blocked.
• Support messages: what you send us when you contact support, and our replies.
• Creator payouts: your payout history and amounts, any reward or withdrawal request you make in the app, and the email address on your account, which we use to arrange your payouts (see Section 5).
• Receipts (supporters who choose to send them): the photo of the receipt; the date and time the photo was taken, read on your device from the photo itself when it has one; the participating shop whose page you sent it from; the time you sent it and your phone's time zone offset when you sent it; and a fingerprint (a hash) of the photo, which lets us spot the same photo sent twice. Our reviewer then records the shop, the purchase amount and the date and time of the purchase as read from the receipt, and our decision (approved, or not accepted with a reason from a fixed list). A receipt can show other details, such as your name or the last digits of a card. We do not need them, and our reviewers do not record them.
• Camera, microphone and photos: if you allow access, we use it only for the task you start. Creators use it to capture or pick a portrait and intro video. Supporters use it to photograph a receipt, or they pick an existing photo with the system photo picker, which does not give Kyn access to the rest of your photo library. We do not use face or voice recognition.

Information from your bank, through Plaid (supporters)

When you connect a bank account, Plaid Inc. gives us:

• Account information: the institution, the account's name, type and subtype, and the last few digits of the account number (the "mask"). Automatic rewards support eligible US credit card accounts and identifiable debit-card purchases from eligible US checking accounts. Canadian bank connections and card registration are supported, but those connections currently earn through eligible receipt submissions only.
• Transaction information for the accounts you connect: amount, currency, dates, merchant name and purchase description, a merchant identifier and category assigned by Plaid, the merchant category code reported by your bank when available, and the payment channel (for example online or in store).

Plaid's data can include other details, such as account balances or a merchant's location; we do not store or use them. We ask Plaid for the minimum transaction history it allows. We never receive your bank username or password, and we do not collect your full account or routing numbers. Kyn cannot move money in or out of your accounts. The access key that Plaid gives us is kept in an encrypted secret store and is never sent to the app. Plaid's own handling of your information is described in the Plaid End User Privacy Policy, which you see when you connect.

Information about your card, through Evervault (supporters)

You enter your card number and expiration date in a secure card form hosted by Evervault, our card security provider. Kyn never asks for your card's security code. Evervault encrypts the card number within the form, so Kyn never sees it in readable form. For a new registration, our server sends only the encrypted card number to Evervault's Fingerprint service to obtain the card's issuer digits, last four digits and a fingerprint scoped to our Evervault app. Kyn does not log or store the full or encrypted card number, its expiration date, the cardholder name or the security code. The encrypted number and expiration remain transient during registration.

Kyn keeps the fingerprint and its provider namespace, the first 6 to 8 digits (the "BIN", which identifies the issuer), the last 4 digits, and our own ownership, account association and status records. These records allow us to recognize a registered card without calling Evervault again for routine status checks. Only the last 4 digits and status are shown in the app. New registrations do not create an Evervault Cards API card object or enroll the card in Card Account Updater. Historical card objects, if any remain from an earlier registration method, follow the provider deletion process described in Section 7. Registration does not verify that the issuer considers the card active or independently verify the cardholder's identity.

Information created when you use the Service

• Contributions, points, goal progress, experience points (XP) and levels.
• Badges: which badges you have earned, when, and (for a Founding supporter badge) for which creator. See Section 4.
• Your notification choices, including whether shop names may appear in notifications about your own purchases.
• Which creator you support and when you started or stopped supporting them.
• A broad category for each purchase (for example "groceries"), kept with the purchase's amount and date after the merchant name is removed, and a count of your eligible purchases by category, which we use to understand how the rewards program is used.
• Records needed to run the rewards program and our accounting: which purchase produced which reward, and when it was confirmed.

Information from your device

• Push notification token and device platform, if you allow notifications.
• Error and crash reports. Before a report leaves your device or our servers, we remove fields that could identify you, such as names, email addresses, phone numbers, card or merchant details and amounts. Reports may include the name of the screen where the error happened.
• Network information. Our hosting and sign-in providers process your IP address to deliver and secure the Service. We also use it, in a keyed and one-way hashed form, to limit abuse such as repeated card registration or report attempts.
• Security checks. Sign-up, sign-in and account recovery are protected by Cloudflare Turnstile, which checks that a person, not an automated program, is using the app. Cloudflare explains its processing of these security signals in its Turnstile Privacy Addendum.

We do not collect your precise location, your contacts or your device's advertising identifier, and we do not track you across other companies' apps or websites.

3. How we use your information

• To create and secure your account, verify your email or phone number and keep you signed in.
• To run the rewards program: decide which purchases qualify at participating shops, calculate and confirm rewards, credit points to the goal of the creator you support, and show your contributions, XP and level.
• To review the receipts you send: check the photo, confirm the shop, the amount and the time of purchase, spot duplicates and fraud, and, when we approve a receipt, credit the reward to the creator you support.
• To let creators set goals and publish their profile and content.
• To award and show badges.
• To calculate, review and pay creator payouts, including fraud checks.
• To prevent fraud and abuse, for example checking that a card matches a connected account, preventing the same card from being registered by two supporters, and detecting unusual purchase and return patterns.
• To keep the community safe: filter prohibited words, review reports, act on violations of our Terms of Service and honor blocks.
• To send you service messages: push notifications you allowed, sign-in codes, and replies about reports or support requests.
• To answer support requests and requests about your privacy rights.
• To keep accurate financial records, reconcile rewards and meet legal, tax and accounting obligations.
• To find and fix problems and keep the Service reliable and secure.

We do not use your information for advertising, and we do not sell it or use it to build profiles about you for anyone else.

4. What other people can see

• Supporters' names on goal boards: a creator's goal board shows recent contributions with the supporter's display name and the points each contribution added. The board is visible only to that creator and to the creator's current supporters, never to the public. You can show "A supporter" instead of your name in Settings. Because points reflect the value of a contribution and the board shows when it was confirmed, someone who sees the board may be able to estimate the size and timing of your eligible purchases. The same list appears as "Recent activity" on a supporter's home screen. Only you see the name of the participating shop on your own rows. Other people never see a shop, an amount or a receipt on any row.
• Creators see how their goal is progressing and, on the board, the names or "A supporter" labels described above. Creators never see your purchases, merchants, amounts, receipts, bank or card.
• Badges on creator pages: a creator earns badges by reaching milestones, such as sharing their page, welcoming supporters, or reaching a share of their goal. The creator's highest visible badge can appear on their page, to anyone who can open that page. Some badges (the ones for progress on a goal) appear only to the creator's current supporters, unless the creator has made their goal progress public. A badge can therefore show that a creator has reached a milestone, such as a number of supporters or a share of their goal.
• Founding supporter badge: the first 20 supporters a creator ever has receive a Founding supporter badge for that creator, and keep it even if they later stop supporting that creator. It appears next to your name on that creator's goal board, to that creator and their current supporters, only when your name is shown. It never appears on a row that shows "A supporter", and it never appears on a row the creator has hidden. You can always see your own badge. It is also shown on your own profile in the app.
• Badges are recognition only. They have no cash value and do not change points, XP or rewards. We can hide a badge if we find abuse.
• Receipts are seen only by the Kyn staff who review them (see Section 5). They are not shown to creators, other supporters or shops.
• Creator profiles: a creator who chooses to be searchable can be found by anyone browsing the Kyn app, including before they sign in, with their display name, handle, portrait, bio and public goal information. A link-only creator can be found only through their private link. Creator intro videos are shown to people browsing Kyn and to supporters in the app.
• Reports are confidential. We never tell a creator who reported them. We never tell a creator that a supporter blocked them.

5. How we share information

We share personal information only as described here.

Service providers and other companies we work with

Most of these companies process information only on our behalf, under contracts that limit their use of it. Plaid, Apple, Google and Dots also handle information that you give them directly, under their own terms and privacy policies (for Plaid, the Plaid End User Privacy Policy you see when you connect your bank), which we point to where you use them.

• Supabase: our database, sign-in system and file storage, including the private storage where receipt photos, portraits and intro videos are kept.
• Vercel: hosting for our servers and our internal admin tools. Our servers check each receipt photo after it is sent.
• Plaid: bank connections and transaction data, as described in Section 2.
• Evervault: secure card collection, encryption and fingerprint metadata processing. New registrations use the encrypted card number transiently and do not create a stored Cards API card object; Kyn retains only the limited card records described above.
• Twilio: sends sign-in codes by text message; it receives your phone number.
• Cloudflare (Turnstile): bot protection during sign-up, sign-in and recovery.
• Apple and Google: Sign in with Apple and Google sign-in if you use them, and delivery of push notifications through their notification services (Apple Push Notification service and Firebase Cloud Messaging).
• Expo: delivers push notifications (it receives your push token and the notification text, which can include the name of a shop as described in Section 4) and delivers app updates.
• Resend: sends our emails, including sign-in and account emails and replies about reports.
• Sentry: error and crash monitoring, with identifying fields removed as described above.
• Google Workspace: our company email, including the support mailbox.
• Dots: our payout partner for creators. When a creator is due a payout, we give Dots the creator's account email address and the payout amount so that Dots can invite the creator to set up payouts. The creator then gives any identity, tax or payment details directly to Dots, under Dots' own terms and privacy policy. Kyn does not receive or store those details.

Who reviews your receipts

Receipts are reviewed by Kyn staff who have an admin role. Each decision needs a recent second-step sign-in, and every time a staff member opens a receipt photo it is recorded. Reviewers see the photo and an 8-character reference for the supporter, not your name or email address. Receipts are not shared with participating shops, creators or other supporters.

Who does not receive your information

• Participating shops do not receive your personal information from Kyn, including your receipts. During the current program, rewards are funded by Kyn.
• No card-linked offers network or other rewards network receives your information today. If we add one, we will update this policy before any information is shared with it.

Other sharing

• Legal and safety: when we believe in good faith that disclosure is required by law, subpoena or court order, or is needed to protect the rights, property or safety of our users, the public or Kyn, including to prevent fraud.
• Business transfers: if Kyn is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• With your direction: when you ask us to share information with someone else.

No sale, no sharing for advertising

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. The app does not contain advertising software development kits or cross-app tracking tools. Because we do not sell or share personal information, there is nothing to opt out of.

Categories of personal information (state privacy laws)

State privacy laws, such as the California Consumer Privacy Act, group personal information into categories. We collect the categories below, from the sources shown, and disclose them for business purposes only to the recipients shown. We keep each category as described in Section 7.

6. Sensitive personal information

Some information we process is considered sensitive under certain state laws, such as information about your financial accounts and cards. We use it only to provide the Service you request, to keep it secure and to prevent fraud, and for the other purposes the law permits. Because we use sensitive personal information only for these permitted purposes, we do not offer a separate right to limit its use.

7. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, and then delete it or de-identify it. We do not keep information for a fixed number of years; we use the criteria below.

• Account and profile information (including sign-in identifiers and creator content): while your account is open. When you delete your account, see Section 9. Content we remove for breaking our rules may be kept as long as needed to handle the report, prevent repeat violations and meet legal obligations.
• Agreement records and your age confirmation: while your account is open, and afterwards as long as needed to show what you agreed to and when.
• Merchant names, purchase descriptions and payment channel: removed from our transaction records within a short period after a purchase has been processed, normally about 72 hours. The raw transaction data we receive from Plaid is removed on the same basis or sooner. After that we keep, for each purchase, its amount, dates, identifiers and broad category; for a purchase that earned a reward, which participating shop it was; and the category count described in Section 2.
• Receipt photos: deleted 30 days after we decide on the receipt (approved or not accepted). A photo you start to send but never submit is deleted after 24 hours. If you delete your account, your receipt photos are deleted as part of the deletion.
• Receipt records: the record of a receipt (the shop, the amount and time of purchase our reviewer read from it, our decision, when it was sent, and the photo's fingerprint, but not the photo) is kept with the reward it produced, as an accounting entry. When you delete your account, the record is kept only under a de-identified account reference: your name, contact details and the photo are removed, so it no longer identifies you.
• Transaction and reward records (amount, dates, identifiers, category and which creator a reward went to): kept while needed to handle returns and corrections, reconcile rewards, prevent fraud, resolve disputes and meet accounting and legal obligations.
• Badges: while your account is open. They are deleted when you delete your account.
• Points and XP records: our records of points and XP are permanent accounting entries. When an account is deleted, the link between those entries and the person is erased, so the remaining entries no longer identify anyone.
• Creator payout records (amounts, dates, payout references and the email used): as long as needed for accounting, tax and legal obligations.
• Card information: when you remove a card or delete your account, we stop using it for rewards immediately. For cards registered through Fingerprint, we remove the local binding and release local ownership through our deletion process; no remote Cards API object was created to delete. For historical Cards API objects, we request deletion from Evervault as soon as our deletion process allows. We may retain limited metadata and registration records with past rewards only while needed for returns, disputes and legal obligations.
• Bank connection: when you disconnect your bank or delete your account, we stop using the connection immediately and request its removal from Plaid as soon as our deletion process allows. Account information we already received is kept or deleted under the rules above.
• Reports, blocks and support messages: while needed to keep the community safe, handle the request and meet legal obligations.
• Push tokens: until you turn off notifications, sign out of the device or delete your account.
• Notification records (which service messages we sent you and whether they were delivered, and addresses that asked not to receive our emails): kept while needed to operate, troubleshoot and prove delivery of our service messages and to respect those requests. Our push provider keeps its own delivery receipts for about one day.
• Security and abuse-prevention data (IP-derived keys, sign-in and security logs, error reports): only as long as needed to secure the Service and investigate problems, then deleted on our or our providers' normal schedules.
• Backups: deleted information may remain in our providers' backups until those backups expire on their normal schedule.

8. Security

We protect personal information with technical and organizational measures, including encryption in transit, keeping card details with our card security provider rather than on our servers, keeping bank access keys in an encrypted secret store, keeping receipt photos in private storage that only our servers and authorized staff can open, strict access rules that let each user see only their own records, append-only financial records, verification of messages from our providers, and keeping personal information out of our logs. No system is perfectly secure. If a security incident affects your personal information, we will notify you as required by law.

9. Your rights and choices

Kyn gives the following rights to all users in the United States, whatever state you live in:

• Access: ask what personal information we hold about you and get a copy. This includes the receipts you sent.
• Portability: get your information in a machine-readable format.
• Correction: ask us to correct inaccurate information.
• Deletion: ask us to delete your personal information.
• Opt out of sale, sharing, targeted advertising and profiling: we do none of these.
• Non-discrimination: we will not treat you differently for exercising your rights.

How to make a request: email support@kynrewards.com from the email address on your account, or write to us at the postal address below. We verify requests through your signed-in account, or by a code sent to the email address on your account, or with other information that lets us confirm the request comes from you. You may use an authorized agent; we may ask the agent for proof of your permission and ask you to confirm your identity directly. We respond within 45 days. If we need more time, up to another 45 days where the law allows, we will tell you why. If we decline a request, we will explain why, and you may appeal by replying to our decision; we will answer your appeal within the time the law requires. If we deny your appeal, you may contact the attorney general of your state.

In this policy, "Settings" means the screens you reach from the You tab in the app.

Deleting your account:

• In the app: open Settings (the You tab), then under Manage choose Delete account, follow the steps and type DELETE to confirm. You may be asked to sign in again first, for your security.
• Without the app: go to kynrewards.com/delete-account, or email support@kynrewards.com from the email address on your account. If your account uses a phone number instead of an email address, include that number and we will verify the request with you.

When your account is deleted, we stop processing your purchases, delete your receipt photos and your badges, request the removal of your bank connection from Plaid, remove local card bindings and request deletion of any historical Cards API objects from Evervault as soon as our deletion process allows, sign you out on every device and delete or de-identify your profile. A creator's public profile, clip, portrait and goals are removed from the Service. We keep only the limited records described in Section 7 that we still need for returns, fraud prevention, disputes, accounting and legal obligations, and we delete them when they are no longer needed. A creator who has a payout in progress or points on a goal is taken through our account closure process first, so that pending payouts and records are handled correctly.

Other choices:

• Notifications: turn each kind of push notification on or off in the app under Settings > Notifications, or in your device settings.
• Shop names in notifications: turn off "Show shop names in notifications" in Settings > Notifications. Notifications about your purchases then no longer name the shop.
• Goal boards: show "A supporter" instead of your name in Settings.
• Discovery: creators choose whether they are searchable or link-only.
• Blocking: block a creator from their page, and manage blocked creators in Settings.
• Bank and card: remove a card or disconnect your bank from Cards & bank in Settings. We stop using it immediately and request its deletion from the provider as described in Section 7.
• Device permissions: you can turn off camera, microphone, photos and notification access in your device settings at any time.

Do Not Track and Global Privacy Control

The app does not track you across other companies' apps or websites, and we do not sell or share personal information, so we treat every user as opted out. Our website's own practices are described in its notice.

10. Children

Kyn is only for people who are 18 or older. Everyone confirms they are 18 or older when creating an account. We do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has created an account, we will close it and delete their information. If you believe a minor is using Kyn, contact us at support@kynrewards.com.

11. Where information is processed

Kyn is offered only in the United States. We and our service providers may process and store information in the United States and in other countries where those providers operate, with protections required by our contracts with them.

12. Changes to this policy

We may update this policy. If we make a material change, we will tell you in the app before the change takes effect. The version and "Last updated" date at the top show the current version.

13. Contact us

Email: support@kynrewards.com

Mail: Kyn Technology Inc., 2803 Philadelphia Pike, Suite B #1844, Claymont, DE 19703, United States