Privacy Policy

kyn brain is operated by Stacktiger. For any privacy question or request, contact privacy@withkyn.com.

• Account data: your name, email address, and profile image from the Google account you sign in with.
• Content data: the video and podcast links you add, transcripts we generate, and the notes, highlights, collections, worksheets, and shared items (“drops”) you create. For videos we process, we may also store names, roles, short bios, occupations, and public profile or site links for people identified in the content (for example hosts and guests) so we can show them in your workspace.
• Social data: the people you add to your circle and the items you choose to share with them or publicly. If you invite someone to a seat on a Circle plan, we store the email address you enter so we can send the invite and hold the seat; we delete it when the invite is revoked or the member is removed, and we use it for nothing else. We also generate a two-word public display name for your account (for example "Quiet Harbor") and store it so people who are not in your circle can see you on shared notes and on the leaderboard without seeing your Google name, email address, or profile photo.
• Ranking data: points earned from activity you take in the Service (highlights and notes, shared drops, and streak days), rolled up so we can show circle and global leaderboards. Rankings use your real name and photo only for you and for people in your mutual circle; everyone else sees the public display name and initials.
• Optional YouTube connection data: your YouTube channel ID and handle, OAuth permissions and tokens, IDs and links for comments you ask us to post, and records of subscription or undo actions you request.
• Usage and technical data: log and diagnostic data such as device and browser type, approximate location from your IP address, and how you interact with the Service, used to keep it working and secure. Product analytics use your internal Account ID and allowlisted action metadata, but not note contents, transcript text, submitted links, email addresses, or request bodies.
• Payment and billing data: if and when we introduce paid plans, payments are handled by Stripe. We collect your billing contact details, a payment method token held by Stripe on our behalf (for example a reference plus the card's last four digits and status), and your transaction history (such as plan, amount, currency, date, and payment status). We use this to take payment, prevent fraud, and meet our tax and accounting obligations. We do not receive or store your full card number; Stripe does.

Under UK/EU GDPR our legal bases are:

• Contract: to create your Account and provide the Service you asked for (processing links, generating transcripts and notes, storing your Content, and carrying out YouTube comment and subscription actions you explicitly request).
• Legitimate interests: to secure, maintain, debug, and improve the Service, to prevent abuse, and to send Account holders occasional emails about the Service itself (for example a tip after your first saved takeaway, or notice of pricing changes that affect you). Every such email includes a way to opt out, and we honour opt-outs for anything beyond essential account and billing notices. Balanced against your rights.
• Legal obligation: to comply with law (for example tax and accounting once we take payment).
• Consent: where we ask for it (for example any optional communications). You can withdraw consent at any time.

We do not sell your personal data, and we do not use your Content to train third-party AI models for their own general-purpose use.

We share personal data only with service providers (“sub-processors”) that help us run the Service, under contracts that require them to protect it. Our current sub-processors are:

We may also disclose data if required by law, or to protect our rights, users, or the public. If we are involved in a merger or acquisition, data may transfer as part of that transaction, subject to this policy.

Some of our providers are based outside the UK/EEA (for example in the US). Where we transfer personal data internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

We keep your personal data for as long as your Account is active. If you delete Content it is removed from the live Service. If you delete your Account (Settings, then Delete your account), your Account and its Content, connections, and settings are deleted from the live Service immediately, except where we must keep specific records to meet a legal obligation or resolve disputes; for example, billing and transaction records held with our payment provider are retained for tax and accounting purposes. If you unsubscribe from our emails, or an email to you bounces or is reported as spam, we keep that email address on a suppression list (just the address and the reason) so we do not email it again; that list is kept even after Account deletion, because honouring your opt-out requires remembering it. Backups are retained for a limited time before being overwritten. If you disconnect YouTube, we remove the stored OAuth tokens. Connection and action records remain subject to the Account and Content retention periods above.

Subject to law, you can ask us to: access a copy of your data; correct it; delete it; restrict or object to processing; and receive it in a portable format.

You can delete your Account and all its data yourself at any time from Settings (Delete your account). Deletion is immediate and permanent.

To receive an export of your data in a portable format, or to exercise any other right, email privacy@withkyn.com from the address on your Account. We respond within one calendar month.

Every cookie we set is first-party. We use cookies that are strictly necessary to run the Service, primarily to keep you signed in, and four optional ones. We do not use advertising cookies, third-party tracking pixels, or cross-site tracking, so we do not show a consent banner. Instead, our cookie notice lists all of them in full and carries a switch that turns every optional one off, at any time, in one click.

The optional cookies are: one that remembers which channel first brought you to us, for up to 30 days (a single word such as "share" or "search", never a URL, campaign text, or identifier); one that remembers you arrived on a shared takeaway or circle invite, for up to 30 days; one that remembers the specific share or invite link you arrived on, for up to 30 days, so that the member who introduced you can receive a referral credit if you later move to a paid plan (they see only anonymous counts, never your name or email address); and one holding a random value, for up to 90 days, so you see consistent wording while we are testing two versions of a public page.

Our PostHog product analytics run without browser persistence: analytics data is not written to cookies, local storage, or session storage. We record page views and interface interactions (clicks and form activity), with safeguards: the text and attributes of the elements you interact with are masked before anything is sent, page addresses are stripped of share tokens, content identifiers, and all query parameters except campaign tags, and referring pages are reduced to their site of origin. Session replay is disabled. We use this limited analytics and diagnostic data under our legitimate interests in understanding, maintaining, and improving the Service. Turning optional cookies off in the cookie notice also switches this off for that browser, and you may object at any time by contacting us using the details below.

The Service is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We use technical and organisational measures to protect your data, including encryption in transit, access controls, and database-backed sessions. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a personal-data breach where the law requires.

We may update this policy as the Service evolves. When we make a material change we will update the version and last-updated date below and, where appropriate, notify you. Continuing to use the Service after an update means you accept the revised policy.

Contact us at privacy@withkyn.com. If you are in the UK and are unhappy with how we handle your data, you can also complain to the UK Information Commissioner's Office (ICO).

• v1.15.0 · 28 August 2026 Disclosed the public display name generated for ranking and stranger-facing social surfaces, and that circle and global leaderboards show activity points and rank without email addresses or profile photos to people outside your circle.
• v1.14.0 · 29 July 2026 Published a full cookie notice at /cookies listing every cookie and on-device store, and added a switch that turns all four optional cookies (and product analytics) off for a browser. Section 8 now summarises rather than enumerates, and states that we show no consent banner because we set no advertising or cross-site cookies.
• v1.13.0 · 28 July 2026 Disclosed the first-party experiment bucketing cookie on the public share and invite pages (a random value only, 90 days, so copy tests stay consistent per visitor), and corrected the PostHog purpose: analytics and error diagnostics, not feature flags (assignment happens in our own database).
• v1.12.0 · 28 July 2026 Disclosed that inviting someone to a Circle plan seat stores the invitee's email address (to send the invite and hold the seat) until the invite is revoked or the member is removed.
• v1.11.0 · 28 July 2026 Disclosed that we may store names, roles, short bios, occupations, and public profile or site links for people identified in processed video content (for example hosts and guests) to show them in the workspace People tab.
• v1.10.0 · 27 July 2026 Disclosed the first-party referral attribution cookie (the specific share or invite link that brought a signed-out visitor in, 30 days) and the referral programme's recording of who introduced a new account so service-credit rewards can be issued. Referrers see anonymous counts only.
• v1.9.0 · 27 July 2026 Disclosed the email suppression list: addresses that unsubscribe, bounce, or are reported as spam are kept (address and reason only) after account deletion so the opt-out is honoured.
• v1.8.0 · 26 July 2026 Disclosed lifecycle and product-update emails (with opt-out) under legitimate interests, and broadened the Resend sub-processor purpose to cover them.
• v1.7.0 · 26 July 2026 Disclosed the first-party acquisition-attribution cookie (single channel word, 30 days) and enabled automatic page view and masked interaction capture in product analytics, with element text and attributes masked and page addresses stripped of tokens, content identifiers, and non-campaign query parameters. Analytics remain free of browser persistence and session replay.
• v1.6.0 · 26 July 2026 Removed Sentry from the sub-processor list. It was listed in error and has never processed user data; error diagnostics run through PostHog as already described.
• v1.5.0 · 26 July 2026 Documented self-serve account deletion (Settings, immediate and permanent, with any active subscription cancelled first) and the data-export request path via privacy@withkyn.com with a one-calendar-month response commitment.
• v1.4.0 · 25 July 2026 Added Resend as the transactional email delivery sub-processor (account, invite, and billing notices).
• v1.3.0 · 23 July 2026 Expanded payment and billing disclosure ahead of paid plans: billing contact details, a Stripe-held payment method token, and transaction history; clarified Stripe's role as the payment sub-processor. We do not store full card numbers.
• v1.2.0 · 17 July 2026 Added PostHog EU for cookieless product analytics, feature flags, and privacy-limited error diagnostics.
• v1.1.0 · 16 July 2026 Added optional YouTube connection data and user-directed comment and subscription actions.
• v1.0.1 · 14 July 2026 Clarified the product name (kyn brain) and primary domain (brain.withkyn.com) within the kyn family of products.
• v1.0.0 · 14 July 2026 Initial Privacy Policy published for early access.