Kyndrava Privacy Policy
We distinguish free editions that work only on the device from editions that communicate with servers for anonymous authentication, purchase verification and family management. Each description applies when the relevant feature is provided and used; it does not promise every feature on every device.
1. Common principles
Ordinary user registration is designed not to require a name or email address. This does not mean that no anonymous-account identifiers, device references, purchase or contract data, or technical connection data are processed or transmitted. We do not use these data to build customer lists for advertising or sales.
2. On-device settings and usage limits
The app handles language settings, locally generated references, selected targets, usage limits, enforcement status and information used to check settings and record integrity on the device. Methods of obtaining usage and targets differ by OS. Usage limits do not involve reading messages, passwords, contacts, or image and video content. Applying Free or withdrawing permission stops restrictions but does not necessarily erase saved records immediately.
3. Anonymous accounts and purchase verification
Editions with accounts use Firebase Authentication anonymous IDs and authentication information and communicate with Google's authentication service. Editions with purchases obtain product and price information from Apple App Store or Google Play and send transaction information, products, purchaser binding and contract status over HTTPS to AURA's verification service when purchasing or restoring. The stores and Google's authentication service process technical connection data under their respective policies. Edition-specific startup product requests and automatic billing-SDK communication are detailed below.
4. Family management, invitations and notifications
Server-connected Family features process anonymous accounts, groups, roles, device and installation references, limit settings and revisions, enforcement, permission and protection status, and check times. Relevant status and alerts are shared with administrators in the participating family. This does not transmit the content viewed in social or game apps, messages, images or videos for family management. Sharing an invitation also passes it to the app you select. Notification delivery and timing depend on OS permissions, connectivity and background operation.
5. Retention, deletion and external services
On-device records, active server data, backups and external providers are handled separately. Uninstalling the app does not automatically delete server records or cancel store subscriptions. Recovery and deletion methods vary by edition; use the available screen or the contact at the end of this page. We do not state that all deletion is complete before erasure across all applicable locations has been verified.
Authentication provider retention
Firebase Authentication: up to 180 days after account deletion is initiated, including backups (Google). This provider period is separate from AURA's 30-day ordinary-backup period.
6. Differences between Apple and Android
Apple: after permission, Screen Time handles opaque tokens for selected apps, categories and websites on the device. Website restrictions and analysis of image or video content are different features. The current iPhone Family test edition does not provide selection and simple analysis of still images.
Server communication in the Apple Family test edition
The Apple Family edition is currently offered for testing through TestFlight and differs from the publicly available free local edition. In addition to anonymous authentication, Apple-signed transaction information is sent to the Sandbox verification service. Product and transaction references, contract expiry and status, and references binding the anonymous account to its purchase are processed and stored for verification and family management. The server verifies purchases rather than relying solely on a device success display. The free local edition's statements about no accounts, billing or server synchronization do not apply to this Family edition.
Android: supported editions process selected-app usage and restrictions on the device using Usage Access and Accessibility permissions. Editions with still-image checking perform a simple local analysis of one image selected by the user. This does not determine authenticity or deepfakes and is not real-time video-call analysis. Automatic Google Play billing-SDK communication and features such as encrypted hold are detailed in the applicable-edition section below.
To check an image from a video meeting, first prepare it yourself, for example by taking a screenshot during the meeting. Open the checking screen and select that image to start analysis. Pressing the app button alone does not capture the meeting screen or automatically analyze the meeting.
Details by feature and edition
Supported Android editions: usage, purchases, image checking and other details
These details apply only to editions that provide the feature named in each heading. They do not mean the same feature is available on Apple.
Android consumer edition: on-device usage records
This section applies to the usage-limiting features of the Android consumer edition. Permissions, still images, authentication, purchase verification, Family and deletion are described in the next section. Free local-only and Play Safe editions have a different scope.
To total selected social and game apps from local midnight, Android provides Kyndrava with foreground app identifiers, start/end or switch times, and aggregate foreground-use duration for all apps reported by Android. While limits are active, Kyndrava may query this periodically even when the Kyndrava app is closed. Kyndrava filters the data on device and uses it only to decide limits. To keep limits consistent after restarts, Kyndrava saves selected app identifiers, per-app daily usage totals, timing information for observed usage intervals, and day/restart verification information in an integrity-protected ledger on this device. The saved daily-usage records, including usage records of apps selected earlier, are replaced when a later day's usage is successfully checked and saved. Applying Free, removing limits or withdrawing permission stops enforcement but does not delete the existing records; they can remain while monitoring is inactive. This usage information is not sent off device. Kyndrava does not read screen text, input, notifications, messages, or passwords. You can stop access in Android Settings > Special app access > Usage access.
To display this list, Kyndrava reads the names and package identifiers of launchable apps on this device. Selection determines which apps are limited. Selected identifiers are saved locally; identifiers selected earlier may remain in the daily-usage ledger after deselection. Entries you have never selected are not saved. This app-list information is not sent off device. The same app cannot belong to both Social and Games. Kyndrava and protected system components are excluded.
Android consumer edition: accounts, purchases and Family
This section applies to Android consumer editions with anonymous accounts, Google Play subscriptions, and Solo, Solo+1 or Family features. Later statements about local-only or Android Play Safe editions having no accounts, billing, off-device transmission or app blocking do not apply to all features of this edition. Availability depends on the plan, OS permissions and device support.
Social and game limits are optional. Selected social apps and games share one daily total, with an allowance of 0, 1, 2, 3, 4 or 5 hours, or Free. After disclosure, consent and OS permission, Usage Access supplies foreground app identifiers, event times and usage duration, which are filtered on the device. The accessibility service uses foreground-change identifiers to return from a selected restricted app when its limit is reached or another disclosed protective condition applies. It does not read screen text, input, notifications, messages or passwords. Observed usage and accessibility events are not sent off the device. Selected targets and the policy ledger are stored locally. Access can be stopped in Android Settings.
The suspicious-image feature analyzes one still image chosen by the user on the device. It does not upload images to Kyndrava servers, save them permanently or use an external AI SDK. Its heuristic results are indications, not a definitive authenticity or deepfake judgment. Real-time meeting-screen analysis is not included.
To check an image from a video meeting, first prepare it yourself, for example by taking a screenshot during the meeting. Open the checking screen and select that image to start analysis. Pressing the app button alone does not capture the meeting screen or automatically analyze the meeting.
Purchase or entitlement setup can create an anonymous Firebase Authentication identity. Not entering a name or email does not mean that no identifiers are transmitted. The implementation sends Google Play purchase tokens, product information, purchaser binding and entitlement status over HTTPS to the verification service. The server retains encrypted purchase tokens and entitlement history for continuing checks. Family features process group, device and installation references, settings and revisions, and permission/application results. These settings differ from observed social-app and game usage history.
To evaluate daily limits after a restart, selected package identifiers, accumulated usage, observed intervals and date/reboot verification information are stored locally. Records are replaced after a later day's usage is successfully obtained and saved. Free, removing restrictions or revoking permission stops restrictions but does not immediately erase existing records. The app-selection list and observed usage history are not sent to the server.
Family processes roles, device and installation references, settings, revisions, application confirmations, app version, permission/background status and protection-signal times on the server. Administrators of the participating family receive protection status and alerts. A missing signal does not prove an uninstall. Administrator devices periodically retrieve alerts and show local notifications. Permission, connectivity and OS background execution affect delivery; immediate delivery is not guaranteed. Sharing an invitation also sends its contents to the selected sharing app.
Purchasers can issue a confidential recovery code to restore registration after reinstalling or replacing a device. Recovery processes code-verification information, the destination's public key and installation reference, and authentication/transfer records. Completion revokes the original purchaser-device registration. Co-administrators, family members and purchase history are retained; subscription validity is not extended. Copying and pasting occur when you press the corresponding button. Keep the code safely outside this device and do not email it to support.
Android consumer edition: automatic billing SDK communication
The Android consumer edition using Google Play Billing (v162) requests product and price information at startup. Before you choose to purchase or create an anonymous account, the SDK processes and sends to Google diagnostic information such as connection/API results and timing, app/SDK/Android versions, technical device information such as model, manufacturer and memory, and a randomly generated billing-client session identifier. This supports billing operation and troubleshooting. There is no in-app setting to turn off this SDK diagnostic communication.
This diagnostic communication does not include actual SNS/game usage history or accessibility events from Kyndrava. Google's processing is governed by Google's Privacy Policy and is outside AURA's 30-day ordinary-backup retention period.
Review access uses a dedicated account’s email address and password for authentication with Firebase Authentication. To manage access and device limits, we process the authenticated account identifier, serial verification information, plan, device and installation references and public keys, settings and application results. Review access is managed separately from ordinary Google Play purchases.
Use Account recovery and deletion in the app to request deletion and check its status. The request stops access for everyone in the contract and starts deletion of the anonymous authentication account and active registration, family and purchase-token data. Active-data deletion is distinguished from verification of retained-copy and backup erasure; completion is not reported before that verification. End-to-end deletion including backups has not yet been verified in the current internal test. Uninstalling or deleting the account does not automatically cancel a Google Play subscription.
Uninstalling the app does not delete all server-side contract and purchase records. Access revocation, purchase-token removal and backup deletion are separate processes. Audit and anti-reuse records and backups may remain until their retention period or deletion processing ends. Completion times depend on the storage location’s retention period and processing status. Contact the address at the end of this page to request deletion or check its status.
Android consumer version: 30-day retention for regular backups
Regular backups created from 11 October 2026 are retained for 30 days from their creation time. The daily process removes snapshots older than that period. Existing audit and recovery copies whose scope and attribution have not yet been confirmed remain preserved and are handled separately from this regular-backup retention period. Deletion of active data is distinct from verification of erasure of these copies. We do not report all deletion as complete until erasure of every item in scope has been verified.
Android: encrypted hold of selected file copies
A copy is read only when the user selects a file through the file picker. Its contents are not displayed or executed, and the original file is not deleted. This feature does not automatically detect viruses or quarantine other apps or system files.
The copy is encrypted with AES-256-GCM and held in the app-private no-backup directory. Authenticated encryption is verified after writing. Limits are 8 MiB per item and 32 items, including incomplete writes.
The content key is protected using MAUI SecureStorage on Android. Opening checks that the device has a secure screen lock configured and is unlocked. This is not per-operation face authentication or a guarantee of the human operator’s identity.
If held data exists but its key cannot be obtained, processing stops without silently creating a replacement key or automatically deleting the data. Invalid keys or failed storage verification do not release held data.
This hold feature has no upload path to send selected contents, held data or their digest to AURA. Fetching a file selected from a cloud provider depends on that provider’s behavior. Purchases, family management, notifications and other app communications must be reviewed and described separately.
This feature has no decrypt-output, release, sharing or individual-delete screen for held copies. Uninstalling the app or clearing app data through the OS loses held data. The original file remains unchanged. Recovery after device replacement or backup restore is not promised.
Details for free on-device-only editions
Free local-only editions
The following describes free editions that process app data on the device. It is not limited to one operating system or build number. Differences by feature or plan are identified by scope; enterprise and contract services are described separately below.
Security-record integrity checks
At startup, the apps check the on-device security ledger and verify existing records using timestamps, local references, the preceding record’s hash and authentication information. Authentication keys and verification anchors are kept in protected OS storage. Records that cannot be verified are marked unverified and are not sent to AURA for verification. These checks concern Kyndrava’s own on-device records.
On-device information and purposes
The apps store the display language, a randomly generated local reference, daily social-media and game settings, selections, save times, and local integrity records on the device to save, reload, and verify settings. The random reference is not a hardware identifier. Details such as selected targets and enforcement status depend on the operating system and available features.
Developer collection and sharing
These on-device apps do not send this app data to AURA servers. AURA does not collect, sell, or disclose it to third parties. These releases have no account registration, sign-in, advertising, behavioral analytics, tracking, billing, subscriptions, Family Cloud, or cross-device synchronization. They do not provide secret monitoring of other people.
Apple devices
The iOS/iPadOS app uses Apple Screen Time features with the user's permission. Opaque tokens representing selected apps, categories and websites, selection counts, limits and enforcement status are handled on the device. The app does not obtain message contents, photos, contacts, location, passwords or browser history. Apple's policies may apply to processing performed by its operating system. Permission can be revoked in OS settings.
Android devices
An additional feature of Android Play Safe stores daily usage goals on the device. It saves social-media and game goals and a planning preference to avoid websites. It does not read actual usage, block apps through the OS, filter websites or monitor others. Android backup is disabled. This Android release is intended for users aged 18 or older.
Web pages and support
The privacy policy can be viewed in the app or on the website. Terms and other web links may open in an external browser. The app does not add local references or settings to URLs or receive browser input, cookies or browsing content. The website processes access logs needed to deliver and secure its pages. If you contact us by email, we process your email address, message and optional attachments to respond, maintain security and meet legal duties, and retain them only as long as needed.
Retention, deletion and security
On-device information is retained while needed to provide the features. You can delete it by uninstalling the app or using the OS's app-data deletion options. Apple device restrictions can be stopped using the app's removal function or by revoking authorization in OS settings. Storage and deletion in protected OS storage follow OS behavior. Contact us below to request access to or deletion of support information. Information no longer needed is deleted, except where retention is legally required. Device security also depends on screen locks and OS updates; absolute security is not guaranteed.
Policy changes
Before enabling features that expand data collection, transmission, sharing or purposes, we will update this policy, the relevant store privacy disclosures, and any required in-app information and consent.
Company policy and enterprise contract services
AURA policy on avoiding customer-data accumulation and temporary correspondence
AURA does not base its business on collecting and accumulating information about individual or corporate customers. Our policy is not to create customer-identifying lists, company-specific customer profiles or sales ledgers. When proposal-related contact details and messages are processed temporarily, their use is limited to consideration and necessary replies; they are not repurposed into permanent customer profiles.
Once the purpose has ended, our policy is to delete the information appropriately, including storage locations and copies under our control. We will explain verified retention periods, deletion procedures and external-service retention or recovery periods for inboxes, sent mail, forwarding destinations, device copies and backups. This is not a claim that immediate, complete erasure across every location has been implemented and verified. We cannot guarantee deletion of copies held by correspondents.
Records subject to legal retention are distinguished from ordinary inquiry information and handled within the necessary scope and period. The product and contract-service descriptions below, including technical state, transaction references and operational logs, are distinguished from creating customer lists or sales profiles. This policy does not relabel all such information as anonymous; the existing explanations about information that can be linked or recombined continue to apply.
Information processed for website delivery and security, payments, external video services or advertising is explained separately from AURA's policy of not building customer databases. The policy does not mean that third parties never process cookies, IP addresses or other information.
Existing policy for enterprise and contract services
The following information concerns services with contract, issuance and management features. It does not mean that the on-device apps above collect these contract details or administrative logs.
1. Basic Policy
Our basic policy is data minimisation and privacy by design / by default.
In the standard workflow, we do not collect unnecessary information that identifies a natural person.
2. Standard Product Dataset
The information we ordinarily retain mainly includes serial ID, serial hex, issued market code, issued country, billing market, tenant ID, contract term, device identifier, contract records, and administrator action logs.
As long as the information can be recombined behind the scenes, we treat it as pseudonymized information rather than anonymous information.
3. Information Not Collected on Standard Pages
- Name on the standard purchase page
- Date of birth on the standard purchase page
- Address on the standard purchase page
- Telephone number on the standard purchase page
- Personal email address on the standard purchase page
4. Separation of Payments, Billing, and Legal Compliance
- Information required for payment may generally be collected and processed by a collection agency or payment service provider through a separate workflow.
- We receive only the minimum payment result, transaction reference information, and issuance information needed to perform the contract.
- If additional information is required for billing, taxation, or legal obligations, it is managed separately from the standard product dataset.
5. Special Provisions for B2B
- Corporate data itself is generally not data about a natural person.
- However, data concerning a one-person company or a company email address containing an individual's name may constitute personal data.
- We therefore recommend using a role-based address as the standard contract address.
6. Logs and Regional Information
- Observed country or region codes are retained, but raw IP addresses are kept only in short-term logs and precise latitude and longitude are not retained long term.
- Logs are used only to the extent necessary for contract performance, security measures, fraud prevention, audits, and administrator privilege management.
Customer-Managed Operations
Kyndrava is based on a Customer-Managed model in which the customer administrator manages users, devices, invitations, QR codes, and backups. As a rule, we do not obtain the customer organization's end-user roster, device list, individual usage logs, personal data, or backup data.
Customer-Managed Policy Operations Checklist Invitation Template
Operator and contact
AURA Intellectual Property Management LLCAURA知的財産管理合同会社
30-6-403 Kamiyamatecho, Suita, Osaka 565-0841, Japan
representative@aura-ip-jp.com