Privacy statement

1. Who is responsible

Christoph Bühler
c/o Glas- und Farbdesign AG
Weidenhofstrasse 9c
9323 Steinach
Switzerland

Christoph Bühler, Switzerland, operates KinCrypt and is responsible for the website and support processing described here. The company address above is the operator’s correspondence address. For privacy questions or requests, email kincrypt-support@cbue.ch.

This statement distinguishes information processed locally by the app, information exchanged with Proton, and information processed when you visit this website or contact support. Proton is responsible for its own account and service processing under its privacy policy.

2. Data in the app

KinCrypt reads, stores, displays, and edits the contacts you use with it. Depending on what your contacts contain, this can include names, email addresses, phone numbers, addresses, photos, notes, and group memberships. It also keeps local settings and information needed to synchronize.

A local database on your device holds contact data. The app communicates directly with Proton to sign in and synchronize contacts in both directions. Proton receives the requests and data needed to provide those services, including the network information involved in a connection.

There is no KinCrypt server between the app and Proton. The operator does not receive your contacts or app-usage analytics through the app. The app and this website do not communicate with each other.

The app may download its Manrope typeface from Google’s font server when it is not already available locally. This sends connection information, including your IP address and the requested font file, to Google. It does not send your contacts, password, or Proton session tokens. The downloaded font is cached locally. See Google’s privacy policy for its processing of these requests.

3. Passwords and session tokens

Access and refresh tokens are stored in your device’s secure storage. These session credentials let KinCrypt reconnect to Proton without asking you to enter your password each time.

Your password is never saved persistently by KinCrypt. It is used temporarily in memory for authentication and unlocking the cryptographic keys needed to access your Proton contacts. Pending authentication credentials are cleared when that flow completes or is discarded.

KinCrypt uses Proton’s authentication library and Secure Remote Password (SRP), the protocol also used by Proton, to prove knowledge of the password without sending the password itself as a login credential. SRP describes the authentication exchange; secure token storage and not saving the password are separate choices in KinCrypt’s implementation. Read Proton’s explanation of SRP.

The app also keeps cryptographic key material in secure storage to resume access to contacts. Secure credential storage does not mean that the local contact database or diagnostic logs have separate app-level encryption. Your device security and backup settings also matter.

4. Local diagnostic logs

KinCrypt stores diagnostic logs locally to help explain synchronization, authentication, and other errors. Logs can contain timestamps, technical events, identifiers, and error details. Depending on the event, they may include personal information.

Logs are not automatically uploaded. If you choose to share logs with support, review them first and remove information that is not needed. Never send your password or complete session tokens.

5. This website

This website is hosted on Vercel’s Hobby plan. Your browser sends technical requests to Vercel to load the pages. Vercel may process your IP address, request details, and operational or security records to deliver and protect its infrastructure.

The site includes no analytics scripts, advertising trackers, embedded third-party media, or contact forms. Its fonts, icon, and stylesheet are served with the pages. The site code does not set cookies or use browser storage. Hosting infrastructure may separately process requests for delivery and security.

The website does not receive contacts or authentication tokens from the app. Following an external link takes you to a separately operated service whose privacy information applies there.

The operator has enabled no analytics or additional logging integrations and keeps no separate website access logs. This does not disable Vercel’s own infrastructure processing, which is described in Vercel’s privacy notice.

6. Messages you send to support

If you email kincrypt-support@cbue.ch, the operator receives your email address, any name you provide, your message, and attachments you choose to send. The support mailbox is hosted by Proton Mail. Proton and your sending email provider process messages for delivery and storage. See Proton Mail’s privacy policy.

This information is used to respond, investigate the reported issue, and keep necessary correspondence. Sending a support request is voluntary. Only include contact records or logs when they are relevant and you are entitled to share them. The operator cannot inspect data held only on your device or access your Proton account simply because you request support.

7. Purposes and applicable legal bases

Local contact processing and direct Proton exchanges provide the contact-management and synchronization functions you request. Website request processing delivers and secures the site. App font requests obtain the typeface used to display its interface. Support processing responds to your questions and resolves issues.

Where the GDPR applies to processing for which the operator is responsible, the relevant bases are:

• Performance of a contract or steps you request before one (Article 6(1)(b)), where processing is necessary to provide requested services or related support.
• Legitimate interests (Article 6(1)(f)), for reliable website delivery, app font delivery, security, ordinary correspondence, and establishing or defending legal claims, balanced against your rights.
• Legal obligations (Article 6(1)(c)), where records must be retained or a lawful request must be answered.

Swiss data-protection requirements apply where relevant. The operator does not use this information for advertising profiles or decisions based solely on automated processing that have legal or similarly significant effects.

8. Recipients and international transfers

Proton receives the app’s direct account and synchronization requests. Google receives any app font-download requests described above. Vercel and its relevant infrastructure providers process website requests. Email service providers process support correspondence. Information may also be disclosed where legally required or necessary to establish or defend legal claims.

Proton is based in Switzerland and states that Proton Mail data is stored in Switzerland, Germany, or Norway. This includes the support mailbox. Vercel and Google use international infrastructure, including in the United States; request information may be processed outside Switzerland and the EU/EEA. Your own email provider’s processing locations depend on that provider.

Vercel and Google state that they participate in the EU–US and Swiss–US Data Privacy Frameworks for covered transfers and use standard contractual clauses or other applicable safeguards where required. Details are available in Vercel’s transfer information and Google’s data transfer frameworks. Contact the operator for information about transfers relating to your use of KinCrypt.

9. Retention and deletion

On your device and at Proton

Local contacts, settings, and logs remain in the app’s storage until removed through available app or device controls. Backup copies may remain under your device or backup provider’s settings. Do not assume that uninstalling removes every secure-store item or backup.

Successful logout removes stored authentication secrets and attempts to revoke the current Proton session. It does erase the local contact database, but does not delete your Proton account. If remote revocation fails, you can manage sessions through Proton.

Deleting a contact in KinCrypt can synchronize that deletion to Proton. Removing local app data is different from deleting data at Proton. Proton’s retention and recovery rules govern copies held by its service.

Website and support information

The operator keeps no separate website request records. Vercel determines retention of its infrastructure records according to its service, security, and legal needs, as described in its privacy notice. No promise of zero logging or immediate deletion is made for Vercel’s infrastructure.

Support correspondence is retained as long as needed to handle the request and any necessary follow-up, comply with legal duties, or establish or defend claims, then deleted or anonymised when those reasons no longer apply. Retention depends on the nature of the request and any applicable legal period.

10. Your rights and choices

Depending on the law that applies, you may request access to your personal information, correction, deletion, restriction of processing, or a portable copy. You may object to processing based on legitimate interests. These rights can be subject to legal conditions and exceptions.

Send requests concerning the operator’s processing to kincrypt-support@cbue.ch. Only information reasonably necessary to verify and handle your request will be requested. Requests will be addressed within applicable legal deadlines.

For data held only on your device, use the app or device controls; the operator has no remote copy to retrieve or erase. For your Proton account and Proton’s processing, contact Proton directly.

You may raise a concern with the Swiss Federal Data Protection and Information Commissioner. Where the GDPR applies, you may lodge a complaint with a competent supervisory authority, including in the country of your habitual residence, place of work, or the alleged infringement. The European Data Protection Board lists EU/EEA authorities.

11. Updates to this statement

This statement has an effective date of 1 September 2026 and was last updated on 20 September 2026. Material changes to processing will be reflected here and communicated as required by applicable law.