Privacy statement

1. Who is responsible

Christoph Bühler, Switzerland, operates KinCrypt and is responsible for the website and support processing described here. For privacy questions or requests, email kincrypt-support@cbue.ch.

This statement distinguishes information processed locally by the app, information exchanged with Proton, and information processed when you visit this website or contact support. Proton is responsible for its own account and service processing under its privacy policy.

2. Data in the app

KinCrypt reads, stores, displays, and edits the contacts you use with it. Depending on what your contacts contain, this can include names, email addresses, phone numbers, addresses, photos, notes, and group memberships. It also keeps local settings and information needed to synchronize.

A local database on your device holds contact data. The app communicates directly with Proton to sign in and synchronize contacts in both directions. Proton receives the requests and data needed to provide those services, including the network information involved in a connection.

There is no KinCrypt server between the app and Proton. The operator does not receive your contacts or app-usage analytics through the app. The app and this website do not communicate with each other.

The current app can also download its Manrope typeface from Google’s font server when it is not already available locally. That request exposes connection information such as your IP address to the font provider; it does not send your address book. This differs from the intended Proton-only network behavior and must be resolved or retained in the final disclosure before release.

3. Passwords and session tokens

Access and refresh tokens are stored in your device’s secure storage. These session credentials let KinCrypt reconnect to Proton without asking you to enter your password each time.

Your password is never saved persistently by KinCrypt. It is used temporarily in memory for authentication and unlocking the cryptographic keys needed to access your Proton contacts. Pending authentication credentials are cleared when that flow completes or is discarded.

KinCrypt uses Proton’s authentication library and Secure Remote Password (SRP), the protocol also used by Proton, to prove knowledge of the password without sending the password itself as a login credential. SRP describes the authentication exchange; secure token storage and not saving the password are separate choices in KinCrypt’s implementation. Read Proton’s explanation of SRP.

The app also keeps cryptographic key material in secure storage to resume access to contacts. Secure credential storage does not mean that the local contact database or diagnostic logs have separate app-level encryption. Your device security and backup settings also matter.

4. Local diagnostic logs

KinCrypt stores diagnostic logs locally to help explain synchronization, authentication, and other errors. Logs can contain timestamps, technical events, identifiers, and error details. Depending on the event, they may include personal information.

Logs are not automatically uploaded. If you choose to share logs with support, review them first and remove information that is not needed. Never send your password or complete session tokens.

5. This website

The website is prepared for hosting by Vercel. When served through Vercel, your browser sends technical request information needed to deliver and protect the site. This may include your IP address, requested URL, browser information, referring page, and request time. Vercel may process hosting and security logs.

The site includes no analytics scripts, advertising trackers, embedded third-party media, or contact forms. Its fonts, icon, and stylesheet are served with the pages. The site code does not set cookies or use browser storage. Hosting infrastructure may separately process requests for delivery and security.

The website does not receive contacts or authentication tokens from the app. Following an external link takes you to a separately operated service whose privacy information applies there.

Vercel’s privacy notice explains its own processing. The applicable hosting agreement, availability of a data processing addendum, and deployment-specific retention and transfer details remain to be confirmed for the selected hosting plan before publication.

6. Messages you send to support

If you email kincrypt-support@cbue.ch, the operator receives your email address, any name you provide, your message, and attachments you choose to send. Email providers process the message to deliver and store it.

This information is used to respond, investigate the reported issue, and keep necessary correspondence. Sending a support request is voluntary. Only include contact records or logs when they are relevant and you are entitled to share them. The operator cannot inspect data held only on your device or access your Proton account simply because you request support.

7. Purposes and applicable legal bases

Local contact processing and direct Proton exchanges provide the contact-management and synchronization functions you request. Website request processing delivers and secures the site. Support processing responds to your questions and resolves issues.

Where the GDPR applies to processing for which the operator is responsible, the relevant bases are:

• Performance of a contract or steps you request before one (Article 6(1)(b)), where processing is necessary to provide requested services or related support.
• Legitimate interests (Article 6(1)(f)), for reliable website delivery, security, ordinary correspondence, and establishing or defending legal claims, balanced against your rights.
• Legal obligations (Article 6(1)(c)), where records must be retained or a lawful request must be answered.

Swiss data-protection requirements apply where relevant. The operator does not use this information for advertising profiles or decisions based solely on automated processing that have legal or similarly significant effects.

8. Recipients and international transfers

Proton receives the app’s direct account and synchronization requests. Google receives any app font-download requests described above. Vercel and its relevant infrastructure providers process website requests. Email service providers process support correspondence. Information may also be disclosed where legally required or necessary to establish or defend legal claims.

Proton is based in Switzerland. Vercel is a US-based provider with international infrastructure, so website information may be processed in the United States and other countries used to deliver its services. App font requests also involve Google’s international infrastructure. Support-email processing locations depend on the email providers involved.

Transfers for which the operator is responsible must meet applicable Swiss and EU/EEA requirements, such as an applicable adequacy decision or appropriate contractual safeguards. The actual recipient countries, hosting and email arrangements, and applicable safeguards must be verified and specified before this draft is published as final. Contact the operator for information about the arrangements applicable to your data.

9. Retention and deletion

On your device and at Proton

Local contacts, settings, and logs remain in the app’s storage until removed through available app or device controls. Backup copies may remain under your device or backup provider’s settings. Do not assume that uninstalling removes every secure-store item or backup.

Successful logout removes stored authentication secrets and attempts to revoke the current Proton session. It does not erase the local contact database or delete your Proton account. If remote revocation fails, you can manage sessions through Proton.

Deleting a contact in KinCrypt can synchronize that deletion to Proton. Removing local app data is different from deleting data at Proton. Proton’s retention and recovery rules govern copies held by its service.

Website and support information

Website request records should be retained only as needed for delivery, security, troubleshooting, and applicable legal requirements; the actual Vercel configuration and retention terms must be confirmed before publication.

Support correspondence is retained as long as needed to handle the request and any necessary follow-up, comply with legal duties, or establish or defend claims, then deleted or anonymised when those reasons no longer apply. Retention depends on the nature of the request and any applicable legal period.

10. Your rights and choices

Depending on the law that applies, you may request access to your personal information, correction, deletion, restriction of processing, or a portable copy. You may object to processing based on legitimate interests. These rights can be subject to legal conditions and exceptions.

Send requests concerning the operator’s processing to kincrypt-support@cbue.ch. Only information reasonably necessary to verify and handle your request will be requested. Requests will be addressed within applicable legal deadlines.

For data held only on your device, use the app or device controls; the operator has no remote copy to retrieve or erase. For your Proton account and Proton’s processing, contact Proton directly.

You may raise a concern with the Swiss Federal Data Protection and Information Commissioner. Where the GDPR applies, you may lodge a complaint with a competent supervisory authority, including in the country of your habitual residence, place of work, or the alleged infringement. The European Data Protection Board lists EU/EEA authorities.

11. Updates to this statement

This draft describes the app and intended website arrangements as of 18 September 2026. Before publication, the remaining hosting and operator details will need to be completed. Material changes to processing will be reflected in this statement and communicated as required by applicable law.