Privacy Policy

Kinnio is a tool for organising casual plans. An organiser creates a Rally and shares a link; the people they invite reply. You can reply without an account. We are the data controller for the information described here, and you can reach us at hello@kinnio.com.au.

Organisers. Your email address and password (stored hashed by our authentication provider), your display name, and the Rallies you create — title, activity, date, time, location, attendee limit and any message, notes, items or shared costs you add. If you save Crews, we store the names and email addresses you put in them. If you use location search, we store the place you picked.

Guests. The name and email address you give when you reply, your answer, and anything else you choose to add — availability votes, dietary requirements, accessibility needs, items you offer to bring, and shared-cost amounts or payment status.

Technical. A cookie so your browser is recognised on Rallies you have already replied to, short-lived one-time codes used to verify your email, rate-limit counters that stop abuse, and error logs that record what went wrong and where. See the Cookie Notice.

We do not collect payment card details, we do not run advertising or analytics trackers, and we do not buy information about you from anyone.

Only to run the Rally you are part of: showing the organiser who is coming, emailing you when the plan changes, verifying it's really you before showing personal details, protecting the service from abuse, and remembering you so you never have to type your name twice. We do not sell your information and we do not use it for advertising.

Your information is held in a managed Postgres database and encrypted in transit (HTTPS) and at rest by our hosting provider. Access is restricted by database-level security rules so a Rally link only ever exposes what that page is meant to show — guest email addresses, dietary requirements and accessibility notes are never returned to a public page. Our own administrative access is limited to the small number of people who need it to operate and support the service.

Your name and answer are visible to the organiser and co-organisers and, if the organiser has made the guest list public, to other people on that Rally. Your email address, dietary requirements and accessibility needs are shown to the organiser and to you — never to other guests. Before Kinnio shows you your own details on a new device, we email you a one-time code.

Service providers we currently use: Supabase (database, authentication and file storage, hosted in Australia/Asia-Pacific), Cloudflare (application hosting and delivery), Resend (delivery of Rally and account emails), and Geoapify (address search and geocoding — we send the text you type into the location field, never your name or email). They process this information on our instructions only. Some of these providers may process data outside Australia.

Guests receive emails about the Rally they replied to. Every one has an unsubscribe link and unsubscribing stops emails for that Rally immediately. Organisers receive account emails such as sign-in confirmation and password resets — these are required to operate the account and cannot be switched off while the account exists. We do not send marketing emails.

Kinnio may use artificial intelligence features to help organisers prepare Rally drafts or improve the experience. AI suggestions are always reviewed and confirmed by the organiser before anything is shared or created — nothing is sent to your guests automatically. We don't use your information to train third-party AI models.

We keep information only while it's needed to run Kinnio or to meet a legal obligation. Rally data stays while the Rally is active — it goes when the organiser deletes the Rally or their account, and a guest reply goes as soon as that guest removes it.

Inactive information may be deleted or anonymised over time. Short-lived technical data — browser recognition cookies, one-time verification codes, rate-limit counters and error logs — is discarded once it has served its purpose.

You can ask us to delete your information at any time. Deleted data may persist in encrypted backups for a short period before rolling off.

Guests: open the Rally link and use Remove my reply at the bottom of the page. That deletes your name, email, notes, claims and cost shares for that Rally.

Organisers: delete a Rally from your Rally list, or request full account deletion on the account deletion page.

You can also ask us for a copy of what we hold, or ask us to correct it, at hello@kinnio.com.au. We respond within 30 days. If you're unhappy with how we handled a privacy request in Australia, you can complain to the Office of the Australian Information Commissioner.

Organisers decide what to ask their guests for and see the answers, including email addresses, dietary requirements and accessibility needs. If you organise a Rally, you are responsible for handling those details respectfully, using them only to run that plan, not sharing them further, and only inviting people who expect to hear from you. Don't collect sensitive information you don't actually need.

Attendees are responsible for what they choose to put into a reply. Only share dietary or accessibility details you're comfortable with the organiser seeing, and don't enter someone else's personal information on their behalf.

Kinnio is not intended for people under 16 and we don't knowingly collect their information. If a child has replied to a Rally, email us and we'll remove it.

If a data breach occurs that is likely to cause you serious harm, we will notify affected users and the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

If we change this policy we will update this page. Continuing to use Kinnio after a change means you accept the updated policy.