Security

How we keep families' details safe

A family diary holds children's names, schools and sometimes health details. We treat that seriously.

In the app

• Face ID lock. Optional. Kinboard asks for Face ID or your passcode each time it opens.
• Hidden in the app switcher. A plain cover shows instead of your diary.
• Private notifications. Optional. The Lock Screen just says you have a reminder.
• Files encrypted by iOS. Kinboard's files on your iPhone use Apple's data protection.
• Only on my iPhone. Private entries are never uploaded.

Signing in and sharing

• No passwords. You sign in with a one-time code sent to your email, so there's no password to be guessed or leaked.
• Single-use invite codes. 8 characters, each works once, and repeated wrong guesses lock that person out for an hour.
• Sign-in tokens are kept in the iPhone Keychain.

On our servers

• Stored in London, encrypted at rest, and only ever sent over HTTPS.
• Row level security. The database itself checks that a person belongs to a family before showing them anything.
• Checked changes. The database records who changed what, and a record can never be moved into another family.
• No third-party code for adverts, analytics or AI, so nobody else's code sees your data.

Found a problem?

If you think you've found a security issue in Kinboard or this website, please email support@pixelowl.dev with "Security" in the subject. Tell us what you found and how to see it, and give us a reasonable time to fix it before telling anyone else. We'll reply within five working days and keep you updated.

Please don't access other people's data, run automated scans against our servers, or try to disrupt the service. If you follow these rules in good faith, we won't take action against you, and we'll thank you on this page if you'd like.

Our security.txt has the same details for automated tools.