Privacy policy

Effective date: November 13, 2026

1. Who we are

Northkin is an app for iPhone and Android, available on the App Store and Google Play, created by Brand Experience Ya España S.L. (Koolbrand brand, tax ID B36979110), based at Av. García Barbón 30, 6º Of. 1, 36201 Vigo, Spain. We are the controller of your data.

For any privacy question, write to hello@northkin.app.

2. What Northkin is

Northkin is a family organizer: the day, the calendar, the shopping list, routines, dinners and recipes, birthdays and other lists, shared between the phones of one family. It is paid with a monthly or yearly subscription (the yearly plan includes 3 free days for people who haven’t subscribed before), charged by Apple (on iPhone) or Google Play (on Android).

3. Our idea in one sentence

We ask for the minimum. You can use Northkin without an account. If you choose to create one, you sign in with Apple, Google or your email (with a 6-digit code): we never ask for a password or a phone number. There is no advertising inside the app, no usage analytics, and we don’t sell data. The one exception is measuring which of our own ads brought you to Northkin, and only within the limits in section 8: in Europe, only if you say yes.

4. What data we process

What you enter in the app:

• The name of each family member and, if you want, their birthday (used to work out their age).
• A color and a face chosen from a catalog of illustrations (they are not photos).
• Appointments and events.
• Shopping lists and other lists.
• Routines.
• Dinners and recipes.
• Birthdays (name, date, the year if you want, and gift ideas).

Technical account data:

• When you share with your family, an anonymous account tied to your device is created. It gives us a user identifier.
• Accounts (optional): if you choose to sign in with Apple, Google or your email, we store what we need to recognize you: that user identifier; your email address, if you sign in with email or Google; and your Google profile name, if you sign in with Google. With Apple we receive neither your name nor your email. Our subscription provider (RevenueCat) also uses that identifier to know, on any phone, that you have a subscription. We don’t use this data for advertising or share it with anyone for that purpose.

Subscription data:

• Apple (on iPhone) or Google Play (on Android) charges the subscription. Through RevenueCat, we receive an anonymous identifier and the purchase status (whether you are subscribed or not) and the purchase history.

Crash reports:

• If the app crashes, we send a report with the error, the phone model and the system version (iOS or Android). It is set up without names, emails, IP address or screenshots.

Ad measurement (in Europe only with your consent; see section 8):

• An identifier created by AppsFlyer for your install, technical data about your phone (model, system version, language, app version), your IP address (used to work out your approximate region, not your precise location), when the app was installed and opened, and the events of your subscription (free trial, subscription, renewal, cancellation, expiry, plan change or payment problem), with their amount and currency. The advertising identifier of your phone: on iPhone, only if you allow tracking when Apple asks; on Android, unless you have turned it off or reset it in your phone’s settings.
• On iPhone, since version 1.6, also Meta’s measurement tool (the Meta SDK), under the same rules: an identifier for your install, technical data about your phone, your IP address, when the app was installed and opened, and the free trials and purchases the App Store processes, with their amount and currency.

What we do NOT process: we don’t collect health data or diagnoses, photos, or your precise location. Nothing you write in Northkin (names, appointments, lists, recipes, birthdays) is ever used to measure ads.

5. Where your data is stored

• Always on your phone.
• If you share with your family, it is also stored on a Supabase server in the European Union (Frankfurt, eu-central-1), so that the phones of that family can sync.
• Each family can only read its own data (row-level security rules).
• Backups: since October 22, 2026, the Supabase database is copied every night, encrypted, to a Koolbrand-owned server in Spain. We keep the last 30 daily copies and one monthly copy for 12 months. The backup does not include Supabase Storage.
• To add someone to the family, a 6-character, single-use code is used; it expires after 14 days.

6. What we use the data for and the legal basis

We don’t use your data to show you ads, to profile you or to make automated decisions about you.

7. Phone permissions (all optional)

• Calendar: the permission is used only to read, on your phone, and show your appointments inside the app. The appointments in your calendar are not uploaded to the server or shared with your family; the app only stores which calendars you choose to read, and that stays on your phone. On Android, the equivalent system calendar permission is requested.
• Contacts: the permission is used only to read, on your phone, the name and birthday of your contacts. Nothing else is read (no phone numbers, emails or photos). Northkin only stores what you decide to import: for example, if you choose a birthday found in your contacts, that birthday (name and date) becomes a family birthday and, if you share, it syncs with your family. What you don’t import never leaves your phone. On Android, the equivalent system contacts permission is requested.
• Notifications: reminders scheduled on your own phone.

You can change these permissions at any time in iPhone or Android Settings.

8. Measuring our ads

We advertise Northkin on Meta (Facebook and Instagram). To know which ads work, and stop paying for the ones that don’t, we measure which ad brought each install, free trial and subscription. This is how it works:

• In Europe (if your phone’s region or time zone is set to any European country): only if you tap “Accept” on the “Your privacy” notice the app shows the first time you open it. If you tap “Reject”, or never answer, nothing is measured. You can change it at any time in the app, in App settings › Privacy › “Measurement cookies”.
• Outside Europe (iPhone and Android): it is on without asking.
• The advertising identifier: on iPhone it is used only if you allow it when Apple asks for permission to track (App Tracking Transparency); if you say no, we still measure, without that identifier. You can change it at any time in Settings › Privacy & Security › Tracking. On Android it is used unless you turn it off or delete it in the phone’s Settings › Privacy › Ads.
• Who receives it: AppsFlyer, a measurement company that works on our behalf, receives the data listed in section 4. RevenueCat tells AppsFlyer about the events of your subscription (section 4). On Android, if you came from a Meta ad, AppsFlyer tells Meta only about the install, the free trial and the subscription, so Meta can count the result of that ad. On iPhone, since version 1.6, the app includes Meta’s own measurement tool (the Meta SDK), which tells Meta directly about the install, the opens, the free trial and the purchases, with their amount, so Meta can count the results of our ads and improve where they are shown. Where US state privacy laws apply, Meta receives it under “limited data use”.
• What never leaves for this: nothing you write in Northkin. No names, appointments, lists, recipes or birthdays.
• How to stop it: in Europe, turn off “Measurement cookies” in App settings › Privacy. Outside Europe, or for any question, write to hello@northkin.app and we will ask AppsFlyer to delete the data about your install.

9. Importing a recipe from a website

When you import a recipe, your phone opens that page directly and reads the recipe. Koolbrand does not receive that web address.

10. Children and families

Children do not have their own account. They are profiles inside the family, managed by an adult: the person who installs the app or the adults they invite. The app is not directed at children to use on their own.

11. Who we share data with (providers)

We work with these providers, who act as processors.

We don’t sell your data. Within the limits in section 8, we share the minimum with AppsFlyer and Meta to measure our own ads.

12. International transfers

Family data is stored in the EU (Frankfurt), but Supabase is a US company. Some providers (for example RevenueCat, Apple, Google, Expo, AppsFlyer and Meta) may process data outside the European Economic Area. Expo is certified under the EU-US Data Privacy Framework.

13. How long we keep data

• On your phone: until you delete it or uninstall the app.
• On the server: while you are part of a family or have an account. If you delete your account, or your data from the server, it is deleted; if you were the last member, the whole family is deleted.
• Invitation codes: they expire after 14 days.
• Encrypted backups of the Supabase database: the last 30 daily copies and one monthly copy for 12 months are kept (since October 22, 2026; they do not include Supabase Storage).
• Ad measurement data: AppsFlyer and Meta keep it under their own terms. If you ask us, we ask AppsFlyer to delete the data about your install.

14. Your rights and how to delete your data

From inside the app:

• “Delete my account” (App settings › Account, if you signed in with Apple, Google or your email): deletes your account and your data from our server, removes you from the shared home (it stays for the other members; if you were the last one, it’s deleted entirely) and deletes your record at our subscription provider. If you signed in with Apple, we also revoke Northkin’s access to your Apple ID. You can also ask for it without the app: northkin.app/delete-account.
• “Delete my data from the server” (without an account): removes you from the family and deletes your anonymous account. If you were the last member, it deletes the whole home from the server.
• “Erase all data”: erases the content stored on your phone (your profile and categories are kept). To remove everything from your phone, uninstall the app.

When you delete from the app, your data leaves the server immediately, but it remains in the encrypted backups until they expire (12 months at most).

The subscription is managed or canceled from your Apple or Google Play account settings; deleting your account or your data does not cancel it.

Rights: you can ask us for access, rectification, erasure, restriction, objection and portability by writing to hello@northkin.app. If you are in the EU/EEA, you can complain to the Spanish Data Protection Agency (aepd.es) or your local authority.

To stop ad measurement, see section 8.

15. Apple (App Store) and Google Play privacy disclosure

Consistent with what is declared on the App Store:

• Name, email address, other user content, user ID, purchase history: for app functionality, linked to the person.
• Crash data: for app functionality, not linked to the person.
• Used to track you (within the limits in section 8): device ID, purchase history, product interaction (app installs and opens) and coarse location, for measuring our own ads.

On Android, the same information is declared in the Google Play “Data safety” form, including that device identifiers, app activity, purchase history and approximate location are shared with AppsFlyer and Meta to measure our ads, within the limits in section 8. Payments on Android are handled by Google Play.

16. Security

We apply reasonable measures: row-level security rules (each family only reads its own data), accounts without passwords, single-use invitation codes with expiry, and servers in the EU. All connections are encrypted (HTTPS). No system is infallible.

17. Changes to this policy

If we change this policy in a significant way, we will tell you inside the app before the change takes effect.

18. Contact

Brand Experience Ya España S.L. (Koolbrand) — Av. García Barbón 30, 6º Of. 1, 36201 Vigo, Spain — hello@northkin.app

Leer en español →