Privacy Policy

Last updated: November 4, 2026

Kinroster helps a family share the care of someone they love. This policy explains what we collect, why, and the choices you have. Kinroster is made by PT Kreasi Maju Aksara ("we", "us").

What we collect

• Account: your name and email address, and an account ID from Sign in with Apple if you use it. If you choose "Hide My Email", we only see Apple's relay address.
• Your family roster: the name of the person you care for, your relationship, family members and their roles, shifts, and invites.
• Handoffs: the notes, check-ins, and photos you share after a shift. The app removes location and other metadata from photos on your phone before upload.
• Medication schedule (Plus): medication names, doses, times, and who marked a dose as given. This is health information.
• Expenses (Plus): amounts, descriptions, who paid, and receipt photos.
• Vault documents (Plus): encrypted on your device before upload. We store only the encrypted file and cannot read it.
• Device and purchase data: a push notification token and your time zone so reminders arrive at the right time, and whether your family has an active Plus subscription.

We do not use third-party analytics or advertising SDKs, we do not track you across other apps or websites, and we never sell or share your information for advertising.

How we use it

Only to run Kinroster: show your family's shared roster, handoffs, medications, and expenses to the members of your family; send shift and medication reminders; send sign-in codes and, if you leave it on, a weekly summary email (you can turn it off in Settings or with the link in the email); and provide Plus. Helpers do not see expenses or the vault. Notifications and summary emails never include notes, photos, or medication doses.

Where it is stored

Requests pass through Cloudflare's network. Your data is stored in a database operated by PT Kreasi Maju Aksara, and photos, receipts, and encrypted vault files are stored in Cloudflare R2. Connections are encrypted in transit. Your data may be processed in countries other than your own.

Service providers

We share data only with the providers that run parts of the service for us, and only what each one needs:

• Cloudflare — hosting, network, and file storage.
• Apple — Sign in with Apple, push notifications (APNs), and App Store purchases.
• Google — Google Play purchases on Android.
• RevenueCat — subscription status. It sees an anonymous family ID and your purchase history, not your name or care data.
• Cloudflare Email Service — delivery of sign-in codes and summary emails.

We may disclose information if required by law, or to protect someone's safety.

How long we keep it, and deleting it

We keep your data while your account is active. In the app, go to Settings and tap Delete my account to delete your account, sign-in sessions, and devices right away. Handoffs you wrote stay with your family, shown as "Former member". If you were the last member, the whole family is deleted. A family admin can tap Delete family data to delete everything for that family, including its files. You can also email support@kreasimaju.id. Deleted data may remain in backups for a limited time until they are overwritten.

Your rights

You can see and correct most of your information in the app. To request a copy, a correction, or deletion, email support@kreasimaju.id. We will respond within 30 days and will not treat you differently for asking.

Canada: under PIPEDA you may access the personal information we hold about you and ask us to correct it. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada.

European Economic Area, UK, and Switzerland

If you are in the EEA, the UK, or Switzerland, PT Kreasi Maju Aksara is the controller of your personal data, and these extra terms apply.

• Why we may use your data (legal bases): to provide Kinroster under our agreement with you (your account, roster, handoffs, expenses, reminders, and Plus); on our legitimate interest in keeping the service secure and preventing abuse; and to meet legal obligations.
• Health data: medication schedules and dose records, and anything about health you write in handoffs or vault documents, are special category data. We process them only with your explicit consent, which you give by choosing to add them to your family. You can withdraw consent at any time by deleting that information or your account; this does not affect what was done before.
• Your rights: you may ask to access, correct, delete, or receive a portable copy of your data, to restrict or object to how we use it, and to withdraw consent. Email support@kreasimaju.id; we will answer within one month.
• International transfers: we are based in Indonesia and our providers may process data in other countries, including the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum).
• Complaints: you may complain to the data protection authority where you live or work. We would appreciate the chance to help first.

We do not use your data for automated decisions that have legal or similarly significant effects on you.

Consumer health data (Washington and other US states)

This section applies to "consumer health data" under Washington's My Health My Data Act and similar laws in Nevada and other states. The health data we collect is the medication schedule and dose records you enter, and anything about health you write in handoffs or vault documents. We collect it only from you and your family members, and use it only to provide the features you use. We do not sell it, and we share it only with the members of your family and the service providers listed above. You may confirm, access, or delete your consumer health data, and withdraw consent, by emailing support@kreasimaju.id or by deleting your account in the app. If we deny your request, you may appeal by replying to our answer; if the appeal is denied you may contact your state Attorney General.

Children

Kinroster is not directed to children under 13 (under 16 in the EEA, the UK, and Switzerland), and we do not knowingly collect their personal information. Information about a person being cared for is entered by their family. If you believe a child has created an account, email support@kreasimaju.id and we will delete it.

Changes

If we make important changes, we will tell you in the app or by email before they take effect.

Contact

PT Kreasi Maju Aksara · support@kreasimaju.id