Private document storage
Files live in a private folder. There is never a public link, and every download checks membership and access.
Security
Security, plainly.
How we protect household data, where the limits are, and how to tell us about a problem.
What we do
How household data is protected.
Roles and permissions
Six roles with per-module access, and owner overrides for any one person.
Visibility on every item
Household, Adults only or Private. Sensitive document categories start as Adults only.
Minimal location data
Opt-in, latest point only, expiring after hours, and no history to leak.
Passwords
Passwords are stored as one-way hashes, never as plain text. Use a long one you do not use anywhere else.
Limits on abuse
Sign-up and the forms on this site are rate limited to slow down spam and guessing.
The honest limit
Kinnomy is not end-to-end encrypted. Household data is stored in our database and documents in a private folder on our servers. We protect them with access checks, not with encryption only you hold the key to.
Reporting a vulnerability
If you think you have found a security problem in Kinnomy, please tell us privately first. Write to lewis_dlp@hotmail.com with “Security report” in the subject.
Please include
- What you found, and where (the page or feature).
- Steps to reproduce it.
- What an attacker could do with it.
- How to reach you for follow-up questions.
Please do not
- Access, change or delete data that is not yours. Use your own test household.
- Run tests that slow down or break the service for others, such as denial of service or heavy automated scanning.
- Use social engineering or phishing against our team or our members.
- Share the problem publicly before we have had a fair chance to fix it.
What we will do
- Reply to confirm we received your report.
- Keep you updated while we investigate and fix it.
- Credit you when the fix ships, if you would like.
If you act in good faith and follow these guidelines, we will not pursue legal action against you for your research. We do not run a paid bug bounty at this time.
Private by design. Honest about the limits.
Start with 30 days of Household+ free, no card needed, and read exactly what we do and do not do with your data.