Privacy

1. Who this is about

Kinwell Coach is run by Kinwell.Coach, Shafakat Reshamvala & Alexandra Reshamvala, from British Columbia, Canada. This policy covers the Kinwell Coach web app and nothing else.

It is written for a private beta. There is no support desk behind it — you are talking to the two people who built it. If you want anything in here explained or undone, ask, and a person will answer.

2. What we collect

Your account: the email address and name you signed up with, and a hashed password. We never store your password itself.

What you write: the messages you send the coach, the replies it gives, and any feedback you leave on a reply or through the feedback form.

What you choose to add: an optional child profile (a first name and an age band), the milestones and goals you track, your own after-session reflections, and any charts, stories, or plans you generate.

Housekeeping records: sign-in sessions, rate-limiting counters, and a log entry when the safety check fires on a message. These exist to keep the app working and to keep it safe, and none of them are used to build a profile of you.

There is no analytics package, no advertising network, no session recorder, and no third-party tracker anywhere in this app. We are not measuring you.

3. What we ask you not to give us

A child profile is entirely optional, and the whole app works without one. When you do create one, we ask for a first name and an age band, because that is what the coaching needs — not a full identity.

Please don't type anyone's full legal name, home address, school, medical records, diagnosis codes, or child-protection case file details. Not because we would misuse them, but because the less of that exists in the first place, the less there is to protect.

This is a beta being used by adults. It is not intended for children to use directly, and we do not knowingly collect information from a child.

4. How the AI works, and who sees what you type

This is the part most worth reading, so it is written plainly. Kinwell Coach does not run its own AI model. When you send a message, we send it to a model run by another company, it sends back a reply, and we show it to you.

The model is Claude Sonnet 4.6, made by Anthropic. We reach it through OpenRouter, a service that routes requests to model providers. So a message you type travels from your browser, to our servers, to OpenRouter, to Anthropic — and the reply travels back the same way.

What we send is your message, the age band of the child you are asking about, and background coaching material we have written ourselves. During a coaching conversation we do not send your child's name — the app deliberately doesn't even read it from the database on that path. If you generate a therapeutic story or a bedtime story, the child's first name is sent, because the story is written for them by name. Nothing else from your account goes with it: not your email, not your other conversations, not your milestones or reflections.

On retention and training, here is what the two companies' terms say at the time of writing. OpenRouter states that it does not use inputs or outputs for model training and does not persist them beyond what routing the request requires. Anthropic states that it does not use API data to train its models. Neither of those is our promise to make on their behalf — they are their published terms, they can change them, and we have linked them below so you can read them yourself rather than taking our summary of them.

What we can tell you is what we have chosen. We pay for this access rather than using a free tier, because free tiers are the ones most often paid for with data. We have not opted into any arrangement that would let a provider train on what you send. If that ever changes, this section changes first, and we will tell you before it does rather than after.

One honest limit: we are a two-person beta, not an enterprise customer with a negotiated contract and an audit right. We can tell you what we send, what we have configured, and what their terms say. We cannot independently verify what happens inside another company's infrastructure, and you should treat any product that claims otherwise with suspicion.

5. Where your data is stored

Your account and everything in it is stored in a PostgreSQL database hosted by Supabase. The app itself runs on Vercel. Both are US companies, which means your data is stored and processed outside Canada and is subject to the laws of the country it sits in, including lawful access requests there.

We are telling you this rather than burying it because it is the kind of thing you would reasonably want to know before writing about your child, and because saying it plainly is a requirement under Canadian privacy law, not a courtesy.

6. Why we hold it, and who reads it

We hold what you write so the product works — so your conversations are there tomorrow, so a chart you made stays made, so the coach has the thread of what you already said.

We also read it. During a beta, the two of us may read conversations to see where the coaching is wrong, where a response was unhelpful, and whether the safety checks are firing when they should. This is how the product gets better and how it gets safer, and there is no way to do it without human eyes on real conversations.

We do not sell your data. We do not share it with anyone beyond the service providers named in this policy, and they only ever see it in order to do the job they are there to do. If we are ever legally compelled to hand something over, we will tell you unless we are prohibited from doing so.

7. The one time we might act on what you write

If something you write suggests a child is in immediate danger, we may take the steps we believe are necessary, which can include contacting emergency services or child protection authorities. In British Columbia, the duty to report a child who may need protection falls on every person, not only on professionals.

Nobody is monitoring your conversations in real time. This is not a crisis service, and it should never be relied on as one. If you or your child are in immediate danger, contact your local emergency number.

8. How long we keep it

We keep your account and its contents until you ask us to delete them, or until the beta ends and we wind it down. We are not running a fixed retention schedule yet, and we would rather say so than invent one we do not follow.

Deleting your account removes your conversations, messages, reflections, goals, milestones, artifacts, and child profiles. Anonymous feedback you submitted may remain, because it carries nothing that identifies you.

9. What you can ask us for

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything in it. We will do it, and we are not going to make you fill in a form to get there — email us and it is done.

Under Canadian privacy law you also have the right to complain to the Office of the Privacy Commissioner of Canada, or to the Information and Privacy Commissioner for British Columbia, if you think we have handled your information badly. We would rather you told us first, but that route is yours whether we like it or not.

10. When this changes

This policy is dated at the top. If we change what we collect, who we send it to, or how long we keep it, we will change this document and, for anything that materially affects you, tell you directly rather than waiting for you to notice.

We will not quietly broaden what we do with your data and rely on a date change to cover it.