1. Controller
A-Kyma / Kyora (“we”) — privacy contact: privacy@a-kyma.com. Account deletion.
2. Data we process
- Account: email, display name, authentication (hashed password or Google/Apple OAuth).
- Family: profiles, roles, invitations, calendar, shopping, meals, budget depending on your plan.
- Documents and files (Documents, home, vehicle), calendar attachments, chat / album media.
- Shared location (opt-in, with expiry) — coordinates encrypted at rest. During an active share, the app may collect location in the background (“Always” permission) to republish it on the interval you choose. On Android, a “reliable” mode may show a persistent system notification (foreground service); a “quiet” mode turns that service off (less reliable). No collection outside an active share.
- Shared contacts (phone, email, notes encrypted at rest), notification preferences (including chat On / Digest / Off), push IDs (OneSignal).
- Limited technical session / usage analytics data.
3. Purposes and legal bases
Providing the service (contract), account security (legitimate interest / legal obligation), notifications (consent or legitimate interest as applicable), location (consent).
4. Security and encryption
Traffic uses HTTPS. Files are stored in a private Object Storage space (Hetzner, region nbg1) accessible only through the app after authentication.
The following are protected with end-to-end encryption (keys on family devices and a recovery code):
- Chat messages (text) and encrypted chat media / albums;
- Sensitive documents: titles, notes and files;
- Budget entries: amount, title and notes (keyword or exact-amount search via blind index; date-range filter stays plaintext);
- Calendar events: title and description; calendar attachments.
Without any device and without the recovery code, that content may be unrecoverable — by design.
Shared-contact phone numbers, emails and notes, member phone numbers, vehicle VINs, and location latitudes / longitudes are encrypted at rest with an application key.
For chat push notifications in “On” mode, the server may send ciphertext (plus non-sensitive metadata such as room name and first name) via OneSignal. Plaintext message text is never sent to OneSignal nor stored in clear on our servers for E2E chat: preview decryption happens only on your device (local family key). In “Digest” mode, only a vague alert without message content is sent.
Consumer-facing detail: product / store docs (ENCRYPTION). The short family invite code alone cannot read E2E content.
5. Processors
- Hetzner (hosting / Object Storage, EU).
- OneSignal (push notifications — placeholder title/body and technical data; not the plaintext of E2E chat messages).
- Google / Apple (OAuth sign-in, if used).
6. Retention
For the life of the account; location per chosen expiry; after account deletion, erasure or anonymisation within a reasonable time.
7. Your rights
Access, rectification, erasure, restriction, portability, objection — via the app (export / delete) or privacy contact. You may lodge a complaint with your supervisory authority.