How we handle your family's data

The person you're looking after

A space is about someone. They are not a user of Kithside, and we think that asks something of us rather than less.

The daily hello is theirs to accept. Normally the family sends them a link, they write to us first, and only then do we ask whether they'd like it. If the family can't get a link to them, Kithside sends that one question and nothing else until they answer. What they write back appears in the space, because it was said to the family, not about them.

One word ends it. STOP stops the messages immediately, at any point in the conversation. After that the family cannot switch it back on — only the person can, by writing to us again themselves.

They are not our marketing. Every example on this site is invented and says so — the preview on the front page included — and a test in our build fails if one appears that isn't labelled. Beyond what a test can check, this is a commitment rather than a mechanism: no real family's words or details go into our screenshots or advertising.

What the family records is the family's. A space admin can export all of it or delete it for everyone, at any time, without asking us.

One family's space can't see another's

Every database query in Kithside runs through a layer that is permanently scoped to your family's space. Application code cannot ask for another family's records — the request is refused before it reaches the database, and an automated cross-family test runs on every single change we ship. We treat this as the one failure that can never be allowed to happen, and we built it as structure, not policy.

The AI cannot make things up about your family

Every statement in a weekly brief carries an internal citation to the record it came from, and output that cites nothing — or cites something that doesn't exist — is rejected and replaced by a plain, deterministic summary. A quiet week produces an honestly quiet brief, not padding. Our test suite includes a corpus of things the AI must never say — dosage suggestions, health advice, "you should" language — and the build fails if any of it gets through.

De-identified before it leaves, stored in Canada

Records and photos are stored in Canada (AWS Canada Central). When the AI features run, names and identifying details are swapped for neutral placeholders first; the model sees de-identified text, and the substitution map never leaves our servers and is never stored. Our AI provider operates under a no-training commercial agreement.

Storage is encrypted at rest, connections are encrypted in transit, and the most personal free-text fields carry field-level encryption on top — a stolen database copy shows scrambled text for the profile and health-section notes, and the keys live in a separate hardware-backed key service that our database host never touches.

Invite links show a bounded preview

When you share an invite link, the person opening it sees enough to understand what they're joining: recent updates and what needs doing. They never see photos or the health section before joining, links expire on their own, and you can revoke one at any moment — including after the space is deleted, when every link for it stops working immediately.

Leaving is easy, on purpose

A space admin can export everything as one readable file and can delete the space for everyone — self-serve, from the first day of launch. The export deliberately leaves out two things: other members' email addresses (theirs, not the space's) and live invite links (they're keys, and keys don't belong in files). We test for both absences on every change. One thing it does carry, and says so inside the file: links to the space's photos that work for an hour after you download, so you can save them — forwarding the file within that hour forwards that access.

What a human confirms, a human confirms

Anything the AI drafts — sorted records from pasted text, the answers in a guided setup — is presented for a person to review and confirm before it becomes a record. Nothing writes itself into your family's space.