Your Book Is Yours
You are about to put your family's addresses, birthdays, and relationships into someone else's software. That deserves a straight answer about what happens to it, in fewer words than a privacy policy.
The short version
- We do not sell your information, and we never have.
- We do not advertise against it or hand it to an ad network.
- You can export everything to CSV at any time, on either plan, free.
- You can delete your account yourself, and there is a 14-day window to change your mind.
What we store, and why
The address book itself: households, names, addresses, phone numbers, birthdays and anniversaries, relationships, tags, notes, events, and RSVPs. That is the product, so we store it in order to show it back to you.
Alongside it: your own account details, your password as a salted hash and never in plain text, and if you subscribe, a Stripe customer reference and your renewal dates. We never store your full card number.
Old addresses stay on file by design. When someone moves, we mark the previous address as no longer current rather than deleting it, so your record of where people have been stays intact.
Two kinds of people are in your book
This distinction matters more than most privacy pages admit.
You, the account holder. This is your personal information, and you deal with us directly about it.
Your contacts, who are usually not KiriBook users. For their information, you decide what is stored and we handle it on your behalf. If one of your contacts asks us to correct or delete something, we will generally point them to you, because you are the one who controls it. In exchange, you are responsible for having a legitimate reason to keep their details, particularly anything sensitive you might write in a note.
What you control
- Export. CSV, any time, on both plans, free. If you leave, you leave with your data.
- Approve or reject every submitted change. Nothing anyone sends through an update link reaches your book until you say yes.
- Delete. Remove individual records yourself, or delete the whole account. Deletion holds for 14 days in case you change your mind, then we remove your data from live systems, and from backups within 90 days as they are overwritten.
- Access levels. Decide who gets Viewer, Editor, or Admin.
- Integrations. Pause or disconnect Google or Microsoft contact sync whenever you like, which clears the stored tokens.
Signing in
Two-factor sign-in is available three ways: a passkey using Face ID, Touch ID, Windows Hello, or a security key; an authenticator app; or emailed codes.
Passkeys are the strongest option, and worth understanding: the private key is created on your own device and never leaves it. We only ever hold the public half. There is nothing on our servers capable of signing in as you.
Everything is encrypted in transit, the database and backups are encrypted at rest, every account's data is isolated from every other account, and sensitive actions are logged.
The photo import, specifically
When you photograph a returned envelope, that image goes to Anthropic's Claude models to read the address text off it, and nothing else. We do not store the image. It is held in memory only long enough to pull the address out and show it to you for review, then discarded. Under Anthropic's commercial terms, what we send is not used to train their models.
If you would rather not use it, do not use it. Typing addresses by hand works fine.
Email we send on your behalf
When you send an update request or an event invitation, we send that email through Resend, which tells us whether it arrived, bounced, or was marked as spam, so we can tell when something is broken.
We do not track whether anyone opened it, and we do not use click-tracking links that identify individual recipients.
Who else touches it
We use a short list of vendors to run the service, each under contract and on our instructions: Hetzner for hosting, Stripe for payments, Resend for email, Anthropic for reading address photos, Smarty for address validation, Google and Microsoft for contact sync if you connect them, Google Fonts, and PostHog and Ghost for analytics.
Our production data is hosted in the European Union, in Germany. KiriBook is operated from the United States and is intended for U.S. residents.
The full list, with what each one does, is in the privacy policy.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or take a portable copy of your personal information, and to opt out of any sale or sharing of it. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of, but the rights are yours regardless.
Email support@kiribook.app and we will respond within 45 days.
The complete version
This page is the plain-English summary. The privacy policy is the binding document, and the terms of service covers the rest.