Privacy policy

Who this is about

KinGlyph is run by CoLab Automation LLC, 2108 N St Ste N, Sacramento, CA 95816, United States. For anything in this policy — questions, a copy of your information, or deletion — write to support@kinglyph.com.

Two kinds of people use KinGlyph, and they are treated differently:

• The caregiver has an account: an email address, a way to sign in — a password, or Google — and a household of Glyphs.
• The person who scans a sticker — usually a parent or older relative — has no account, no password, and nothing to sign up for. They can send a question through a sticker, and what they send is visible only to the household that owns that sticker.

What is stored

• Account details: your email address, a password that is stored only as a hash, and — if you turn it on — a second factor and ten recovery codes, also stored only as hashes.
• If you sign in with Google: there is no password to store. Google tells us the email address on the account, confirms it belongs to you, and includes the basic profile it attaches to that account, such as your name. We ask Google for nothing else — no contacts, no calendar, no files, no Google data of any other kind — and we cannot see your Google password. You can use an email address and password instead at any time.
• Your household: the name you give it, the names of the people in it (nicknames are recommended), and the names you give your Glyphs.
• Questions: the words typed on a sticker, and the photos or video sent with them. These are deleted on a schedule — see below.
• Answers: the videos and pictures you upload, anything you draw on a picture, and the transcript and steps shown beneath.
• Scans: when a Glyph was scanned, whether it was reached from a sticker or from the home base page, and the country the request came from. IP addresses are not stored, and neither is anything narrower than the country.
• Whether an answer worked: under an answer are three buttons — it worked, I need a bit more, this did not help. Which one was tapped is recorded against that Glyph, with the time. It is a button and not a message: no words, no photographs, and nothing that says who tapped it.
• Notifications: if you turn them on, the address your browser gives us for sending them, and a short description of the device, like “iPhone”.

There is no advertising, no tracking across other websites, and no analytics service. Signing in sets a cookie so the app knows it is you. The app also remembers a few preferences in the browser itself — which sections you left open, a note you were part way through — which stay on that device and are never sent to us. The pages a sticker leads to set no cookies and store nothing themselves — with one exception, below, when the answer is a YouTube video.

What it is used for

• Running the service: showing an answer when a sticker is scanned, and getting a question to you.
• Telling you about a new question, by notification or email, if you ask for that.
• Writing down what is said in a video, and suggesting a name and steps from those words.
• Keeping the service secure — for example, limiting how often a sticker can be used to send questions.

Nothing is sold, and nothing is shared for advertising. Your content is not used to train anyone’s artificial-intelligence models.

Companies that help run it

KinGlyph is built on services that store or process information on our behalf, under contracts that limit them to that purpose:

• Supabase — the database and sign-in, hosted in the United States.
• Vercel — runs the website, in the United States.
• Cloudflare — stores and delivers videos and photos, and writes down what is said in a video. Files are delivered from servers worldwide.
• Resend — sends email, such as a new-question notice or a security alert.
• Anthropic — suggests a title and steps from a video’s transcript. Only the transcript text is sent, never photos or video.
• Stripe — takes payment for a paid plan, and works out sales tax. Stripe holds the card and the billing address; we keep only which plan a home is on and whether it is paid up. Nothing from inside a home is ever sent to it.

Google is not on that list, because it does not run anything for us. If you choose “Continue with Google”, you are signing in at Google, and Google decides for itself what it records about that. What comes back to us is described above. Signing in with Google is optional; an email address and password works the same way.

YouTube is not on that list either. A family may choose to answer a sticker with a YouTube video instead of recording one. Then the sticker’s page shows the video’s picture, which the browser fetches from YouTube, and nothing more until Play is tapped. After that, YouTube’s own player loads, from its privacy-enhanced address (youtube-nocookie.com); YouTube, which is Google, may then record that the video was watched, store information in the browser, and show an ad before it. That is governed by Google’s privacy policy, not this one. We send YouTube nothing about you, your home or your questions — only the address of the video, to check it still plays.

Information is also disclosed if the law requires it, or to protect someone’s safety. If the business is ever sold, this policy travels with it.

How long things are kept

• Photos and video sent with a question are deleted as soon as the question is answered or dismissed. A household may choose to keep them after answering instead — and either way, nothing is kept longer than 90 days. That limit cannot be switched off.
• Files from a question that was never sent are deleted within a day.
• The words typed with a question stay with the household’s history until the account is deleted.
• Answers — your videos and pictures — stay until you replace or delete them, or the account is deleted.
• A video you replaced is kept for 90 days, so that a re-recording which turned out worse can be undone, and is then deleted. Pictures you replace are deleted at once.
• Account and scan records, and which of the three buttons was tapped under an answer, stay while the account exists.

Who can see what

Only your household. Every screen in the app is limited to the account signed in, and a sticker’s own page never shows anything that was sent to it — someone who finds or photographs a sticker sees the answer, or a note saying a question was sent, and nothing else.

Videos and photos are served through links that expire after a short time, so a link copied from the page stops working. Our staff can reach stored information only when it is needed to run or fix the service, or when you ask for help.

Keep Glyphs inside your own home. They are meant only for a private home that you, or the person you set them up for, owns or rents. Anybody who scans one can see its answer and send a question with it, so a sticker in a public place — or one that belongs to somebody else — shows your answers to strangers and lets them send you messages. The terms of use say this in full.

Your choices

• See or correct your information: most of it is in the app. For the rest, write to support@kinglyph.com.
• Delete it: you can delete Glyphs, answers and questions yourself, and the whole account from Settings. Everything is deleted 14 days after you ask — the gap is there so a mistake can be undone by signing back in. Or write to support@kinglyph.com, and it will be done within 30 days.
• Stop notifications: turn them off in Settings, or unsubscribe by turning off email there.
• Ask for a copy: write to support@kinglyph.com and we will send what we hold.

If you are the person scanning a sticker rather than the account holder, you can ask the same things of us, or ask the family member who set up the stickers — they can delete what you sent from their side at any time.

If you are in California

California law gives you the right to know what personal information is collected, to ask for a copy, to ask for it to be corrected or deleted, and not to be treated differently for asking. The categories collected are listed above; they come from you and from your use of the service, and they are used for the purposes listed above.

KinGlyph does not sell personal information, and does not share it for cross-context behavioural advertising. There is nothing to opt out of. To exercise any right, write to support@kinglyph.com; you may use an authorised agent.

If you are outside the United States

KinGlyph is run from the United States, and information is stored and processed there. Using the service means information about you is transferred to the United States, which may have different data-protection rules than your own country. Where the law requires it, transfers are covered by appropriate safeguards, such as the European Commission’s standard contractual clauses.

If the UK GDPR or EU GDPR applies to you, CoLab Automation LLC is the controller of the information described here. It is processed to provide the service you asked for (performance of a contract), to keep it secure and working (legitimate interests), and — for notifications — with your consent, which you can withdraw in Settings. You have the right to access, correct, delete, restrict or object to processing, to receive a portable copy, and to complain to your data-protection authority. Write to support@kinglyph.com to exercise any of these.

Children

KinGlyph is for adults. Accounts are not for anyone under 18, and the service is not directed at children. If a child’s information reaches us, write to support@kinglyph.com and it will be deleted.

Keeping it safe

Everything travels over an encrypted connection. Passwords and recovery codes are stored only as hashes. A second factor is offered on every account, and we recommend turning it on, because this account holds photographs of the inside of somebody’s home. No service can promise perfect security, but the 90-day limit above exists partly so that a problem can never reach years of photographs.

Changes

If this policy changes in a way that matters, account holders are told by email before it takes effect. The date at the top always says when it last changed. The terms of use cover the rest of the arrangement.