Privacy Policy

Kindred Matchmaking Society — Privacy Policy

Last updated: 12 November 2026

This notice says, in plain language, what Kindred collects about you, how it is used, who can see it, where it is kept, and how to reach us. Three things below are unusual and you cannot change them later, so they are stated up front:

1. Joining Kindred requires one permanent agreement. You agree that Kindred keeps a record of how your introductions turned out, indefinitely, for research into what makes introductions work. You cannot withdraw it, and deleting your account does not withdraw it (see "The one agreement you cannot withdraw").
2. Two things are optional and you can switch them on or off at any time (see "The two settings you control").
3. Your information is not stored in Canada (see "Where your information is stored").

Who we are

Kindred Matchmaking Society is a federal not-for-profit corporation (corporation number 1810733-5), incorporated on 22 July 2026 under the Canada Not-for-profit Corporations Act, with its registered office in Ontario. It operates in Toronto and the Greater Toronto Area. Access to member information is limited to the people who operate Kindred, and only as their roles require. Where this notice says something happens automatically, no person sees it.

The federal privacy law that governs this notice is Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Kindred does not operate in Quebec.

Contact: email hello@kindredmatch.io. That is the general channel. If you email an identity document rather than uploading it in the app, send it to a separate address, id@kindredmatch.io (see "Identity checks"). Kindred does not take enquiries by post or telephone. Both mailboxes are hosted by an outside email provider, so email you send is stored on that provider's servers, outside Canada, under its terms; if you would rather not send something sensitive that way, say so and Kindred will tell you what else it can do.

Who can use Kindred

Kindred is used in a web browser. It is for adults aged eighteen and over. The age check runs on Kindred's servers, so it cannot be bypassed by a modified page. If you give a date of birth that puts you under eighteen, the server refuses the registration and stores nothing at all — no account, no profile, no record of the attempt.

What Kindred collects, and why

When you sign up and use the service, Kindred collects:

• Your email address — to identify your account and sign you in. It comes from the sign-in provider as a verified address, so nobody can register under someone else's.
• A display name you choose — this is what other members see. Once you have both shared photographs in an introduction, that member also sees your first name; your surname is never shown. Kindred does not show your full or legal name to anyone.
• Date of birth — to confirm you are eighteen or over and to derive your age.
• Sexual orientation and gender identity, including any free text you write — to match you. You may choose "prefer not to say." Free text about your orientation is shown to you alone; free text about your gender is shown on your profile.
• Where you live — the city you choose from the places Kindred serves, and optionally the first part of your postcode. Kindred does not ask for or store a street address.
• Your dealbreakers across twelve dimensions — hard filters you set that decide who you are never introduced to.
• Four written profile responses, the life-behaviour questions, and a twelve-item attachment questionnaire — to match you. Some answers (including alcohol and spending) are used only inside matching and never shown on your profile or to another member; your attachment answers and their scores are never shown to anyone.
• At least one photograph — profile photographs are exchanged only after both people in an introduction release theirs (see "Who can see what").
• A photograph of a government photo ID, when you send one — to confirm who you are, that you are an adult, and that you live in the area Kindred serves. It is deleted once it has been checked (see "Identity checks").
• Your messages (text) and your prompted-exchange answers — to run the conversation. Messaging is text only.
• Your follow-up answers about how introductions went, and any blocks and reports you make.
• How you heard about Kindred, if you choose to say: it helps Kindred learn which ways of telling people about it are working. It is optional, chosen from a list, never shown to another member, and erased when your account is erased.
• Whether you joined through a link a member shared, if you did: it helps Kindred learn whether members sharing it brings people to it. Kindred records only that you arrived through a member's link, never which member's. It is never shown to another member and is erased when your account is erased.

Kindred also works out some things from what you provide — your age, a writing profile from your prompt responses, attachment scores, and a profile-completeness score. These derived values are used only for matching and are never shown to you or to anyone else. You can stop the writing profile being built (see "The two settings you control").

Kindred does not collect payment card details (see "Payment"), any password (you sign in with an emailed code or a passkey), or any location tracking or advertising identifiers, and it does not record any government ID number (see "Identity checks"). Kindred records when a message was read for its own timing measurements and never shows read receipts to the other person.

Who can see what

Other members see the display name you choose, your age, your gender (and any description of it you write), whether your identity has been verified, and the profile content you have written — and only within an introduction Kindred has made. Once you have both shared photographs in an introduction, that member also sees your first name. They do not see your email, your surname, your full or legal name, your exact location, your dealbreakers, your questionnaire answers, or anything Kindred derives about you.

Photographs are released blind. Within an introduction, each of you decides independently to release your profile photographs; Kindred never tells you whether the other person has released theirs, and photographs become visible only once you both have.

Kindred's operators can see your email and your profile as part of operating the service, can see a conversation when investigating a report, and — for the person who checks identities — can see an identity-document photograph you send, until it is deleted; access is limited to what a role requires. Legal names are handled separately and more strictly (see "Identity checks").

The one agreement you cannot withdraw

Joining Kindred requires you to agree that Kindred keeps a record of how your introductions turned out — indefinitely — for research into what makes introductions work. You are shown this before you fill in anything and must acknowledge it before the registration form opens. You cannot switch it off later, and deleting your account does not withdraw it. The record is the progression of your introductions (whether contact was exchanged, whether there was a first or second date, and where things stood at thirty days, ninety days, six months and twelve months), which Kindred asks you about at each checkpoint. When you delete your account it is kept in a form stripped of your name, email and other direct identifiers. Kindred's position is that once those are erased the stripped record no longer identifies you; that is Kindred's position and it is not a certainty, and the richer the record the less certain it is.

You can decline any individual follow-up question. If you leave one outstanding past its grace period, Kindred stops sending you new introductions until you answer; your existing conversations are untouched and you are never locked out.

The two settings you control

Both are on your account screen and take effect the moment you change them:

• Building a matching profile from what you share. With it on, Kindred derives a matching profile from your writing and answers. With it off, it does not; your dealbreakers and basic profile still apply and you still receive introductions, based on less.
• Analysing conversations held through Kindred. This is not built yet — nothing analyses your messages today. The setting exists so the choice is yours before the feature is. When built, it will run only where both people in a conversation have left it on. If Kindred ever sends conversation content to an outside AI provider, this notice and the setting will say so, and name the provider, before that starts.

Every change is recorded with the time — the setting and the time, not the content of anything.

Identity checks

Before Kindred introduces you to anyone, an authorized Kindred reviewer checks your identity. Kindred asks for a photograph of one government-issued photo ID that shows your name, date of birth and photograph: a driver's licence, a passport or a provincial photo card. Kindred does not accept a health card. You may black out any document or identity numbers first; Kindred needs only your name, date of birth, photograph and, where the document shows one, your address.

You can upload the photograph in the Kindred app, on the screen that asks for your ID, or email it to id@kindredmatch.io. An uploaded photograph is stored privately in Kindred's file storage. It is never shown to other members or linked from your profile, and you cannot view it again after sending it. The reviewer sees it only on Kindred's operator page, which needs a separate sign-in, and checks it against your account to confirm your identity, that you are an adult, and — where the document shows an address — that you live in the area Kindred serves. The address is used for that check only and is not copied anywhere, and no identity number is recorded in Kindred's database.

The photograph is deleted as soon as the reviewer records the outcome, whatever it is. A photograph that has not been checked within thirty days is deleted, and you are asked to send a new one. If you ask to delete your account, any photograph still held is deleted at once. If a deletion ever fails, the photograph stays in private storage until it is removed, which happens in any case about thirty days after it was sent and before your account is erased. An emailed photograph and its email are deleted on the same rules.

What Kindred records is the outcome of the check, when it was made, and — where it passed — your legal name, which is held apart from everything else: stored in a separate database the website and matching systems cannot reach, looked at only in connection with an open report about you, and every access and write logged (the log records identifiers, never the name itself). As membership grows a specialist verification provider may take over this step; this notice will be updated before that starts.

Where your information is stored

Your information is stored outside Canada; Kindred cannot offer Canadian storage — its infrastructure provider offers no Canadian region at any price. Your profile, answers, messages and outcome record sit in that provider's eastern North America region, a multi-country region with no guarantee of which country your information is in; your photographs, and an identity-document photograph you upload, sit in the same provider's object storage; your sign-in details sit with a sign-in provider hosted in the United States. While your information is in another country it is subject to that country's laws, and that country's courts and authorities may be able to obtain it without your knowledge and without Kindred being able to prevent it (for example, under the United States CLOUD Act). Canadian privacy law continues to apply to Kindred throughout.

Kindred uses outside services to run. What they keep, and for how long:

• Everything in "What Kindred collects", including an identity-document photograph you upload: kept as set out in "Deleting your account, and what is kept"; the photograph only until it is deleted (see "Identity checks").
• Your sign-in record: your email, the first and last name you type when you create your account (if you give them), your credential, a session and an internal identifier. Kept until your account is erased. Kindred sends the sign-in service no other profile detail.
• Your payment details, if you pay the membership fee: kept by the payment service under its own privacy policy. Kindred never receives them.
• Email you send to Kindred: kept in Kindred's mailboxes until Kindred deletes it; an identity-document photograph only until it is deleted (see "Identity checks").
• Records of the emails Kindred sends you (a welcome email when you create your account; notices about your introductions; reminders to finish your profile, verify your identity, or answer a question waiting in an introduction; the email confirming your identity is verified; and the deletion confirmation): your email address, the subject line, whether the email was delivered, and when it was opened and which links in it were clicked, with the time and the IP address each came from. Kept for one month, then deleted. To send an email, the email service receives its content, which can include your first name in the greeting; in a reminder to finish your profile, which parts of it are still missing and how many of your written answers you have saved; and in the deletion confirmation, the date your account is due to be erased. It never includes your written answers, your messages or anything about a member you were introduced to, and the email service keeps none of it.

Kindred does not sell, rent or share your information for advertising, and has no advertisers.

Cookies and your device

The Kindred app sets no cookies — not for analytics, advertising or sign-in. Your sign-in session lives in your browser tab's session storage and is gone when you close the tab (opening Kindred in a new tab asks you to sign in again). If you arrive through a link a member shared, the app also notes that in the same tab's session storage until your account is created, or until you close the tab. The app runs no tracking pixels or advertising tags, and serves its own fonts. Kindred measures visits and how quickly its pages load, on the app and on its public website, kindredmatch.io, where this policy is published, using its own tools and tools provided by its service providers. On the app, this measurement sets no cookie and stores nothing in your browser. On the website, some of these tools set their own cookie. None of them is used to identify you, to follow you across other sites, or to advertise to you. The website's privacy notice explains this. Your browser and Kindred's network provider necessarily process your requests, and the network provider keeps short-lived operational logs, including IP addresses, as any web host does.

How introductions are made

Introductions are made by an automated process; no person picks who you meet. A scheduled process takes the pool of members near you with complete profiles, removes everyone excluded by either side's dealbreakers, ranks the rest, applies a fairness rule so the same few members do not receive every introduction, and writes the introductions. Other automatic decisions that can affect you: the age check; not being placed in the pool until your profile is complete (Kindred tells you what is missing whenever you ask); the follow-up gate above; and an immediate, temporary restriction after a safety report alleging real-world harm, before a person has looked, after which a person reviews it. Every moderation decision — warnings, restrictions, bans, and reversing an abusive block or report — is made by a person at Kindred, not by software. If an automated decision has gone against you and you think it is wrong, email hello@kindredmatch.io and a person will look at it.

Payment

The membership fee is a one-time payment, not a subscription — nothing recurring to cancel. Payment is taken by a payment service on a page it hosts; your card details go from your browser to that service and never reach Kindred, whose systems cannot accept card data in any field. What Kindred keeps is what you were quoted, what you were charged, when it settled, and an opaque reference.

Deleting your account, and what is kept

You can delete your account at any time from your account screen; no reason is asked. Deleting starts a fourteen-day wait during which nothing is erased — you are removed from matching straight away, so no new introductions are made for you. You choose whether the introductions you already have end straight away or stay open until your account is erased. You can cancel any time from your account screen, but introductions you chose to end stay ended. Kindred shows you the exact erasure date on every visit. On that date an automated overnight process — no person reviews or carries it out — permanently erases the information that directly identifies you: your name and legal name (if held), email, exact date of birth, photographs, and your record with the sign-in provider. This cannot be undone. An identity-document photograph is not kept for the wait: any that Kindred still holds is deleted at once when you ask to delete your account (see "Identity checks").

Kept afterward, in a form stripped of your direct identifiers: your profile and matching information and the values derived from them (indefinitely, for research and improving matching); the text of messages you sent, in the conversations you were part of (indefinitely, so the other person's side still makes sense); the stripped outcome record (indefinitely, per the agreement above); a safety report you were named in (indefinitely, in a form that can still identify you, only for safety); the record of your consent choices and their times; financial records of your fee (six years, for tax); breach records affecting you (twenty-four months); and the legal-name access logs. One exception: if your account was banned when you deleted it, Kindred also keeps your email, and your legal name and date of birth where verified, so the account cannot be remade. Encrypted application backups are kept 30 days and used only to recover from a database failure, so information may persist in a backup until it ages out.

Security

You sign in with an emailed code or a passkey — Kindred stores no password or password hash. Legal names are isolated at the infrastructure level. Photographs are never given out by a direct link: every image request is checked at that moment, and nothing is cached. Another member can see your photographs only once you have both chosen to share photos in an introduction. That sharing is permanent: ending the introduction or blocking the other member does not take it back. Deleting a photograph removes it for everyone from the very next request; deleting your account removes your photographs on the erasure date (see "Deleting your account"). When Kindred refuses a request about someone else's data, it refuses identically whether the thing does not exist, is not yours, or belongs to someone who blocked you. Kindred does not currently hold a formal security certification or independent audit; if that changes, this notice will say so. Signing out ends your session immediately, though an access token already in your browser can keep working for up to fifteen minutes.

If there is a privacy breach

If Kindred loses your information or someone reaches it who should not, Kindred assesses whether the breach creates a real risk of significant harm to you, the standard PIPEDA sets, treating the information it holds as sensitive. If that standard is met, Kindred will report the breach to the Privacy Commissioner of Canada and notify you as soon as feasible, describing what happened and what you can do. Kindred keeps a record of every breach for twenty-four months, as PIPEDA's regulations require.

Your rights

Under PIPEDA you can, by emailing hello@kindredmatch.io:

• Access — ask what personal information Kindred holds about you, how it is used and to whom it has been disclosed, and get a copy; Kindred responds within thirty days, free. Kindred cannot give you information that would reveal another person's personal information.
• Correct — have wrong or incomplete information amended; most of your profile you can correct yourself.
• Withdraw consent — switch off either optional setting at any time. You cannot withdraw the research agreement above; that is stated before you join and again on your account screen.
• Delete — as described above.
• Complain — to Kindred first if you like, and independently to the Office of the Privacy Commissioner of Canada (30 Victoria Street, Gatineau, Quebec K1A 1H3; toll-free 1-800-282-1376, or 819-994-5444, TTY 819-994-6591, Monday to Friday 9 am to 4 pm Eastern; report a concern at https://www.priv.gc.ca/en/report-a-concern/ (opens in a new tab)). Kindred will not treat you differently for complaining.

Changes to this notice

If Kindred changes this notice, the "Last updated" date changes. If a change affects what Kindred does with information it already holds about you, Kindred will tell you before it takes effect and will not apply it retroactively without asking. The permanent commitments — the research agreement and the erasure on deletion — will not be quietly loosened.

Getting in touch

hello@kindredmatch.io. The person accountable for this notice and for Kindred's handling of your information is Kindred's Executive Director, who reads that mailbox.