Privacy policy.

Kindred (“we”, “us”) operates the marketplace at shopkindred.org. This policy explains what data we collect, why, where we store it, and how you can get it back or have it deleted.

What we collect

• Account data: your name, email, and password hash.
• Preferences: the style tags and sizes you chose during onboarding.
• Activity: your bag, orders, follows, saved pieces, gift cards, reviews, and messages you send to brands.
• Brand data (sellers only): the fields you entered in the seller wizard, plus any products, posts, drops, promos, and lookbooks you create.
• Social integrations (opt-in, sellers only): if you connect Instagram or TikTok, we store the OAuth access token, refresh token, expiry, your platform username, and the public posts we import from your account. Details below.
• Technical: anonymised page-view counts via Vercel Analytics. No cross-site tracking, no advertising IDs.

How we use Instagram and TikTok data

When you connect an Instagram or TikTok account in Dashboard → Connections, we request only the minimum scopes needed to display your public posts on your Kindred brand page:

• Instagram (Meta Graph API): instagram_business_basic. We read your username and your public media (id, caption, media URL, thumbnail, permalink, timestamp, media type).
• TikTok (Display API): user.info.basic and video.list. We read your username and your public videos (id, cover image, description, share URL, embed link, create time, duration).

We do not read direct messages, follower lists, ad accounts, private posts, insights, or anything not listed above. We do not post on your behalf. We do not sell this data to anyone.

Imported posts appear on your public Kindred brand page with a badge that links back to the original post on Instagram or TikTok. A background job runs once per hour to pull any new posts you've made since the last sync.

Storage. Access tokens live server-side in a Supabase Postgres table with row-level security enabled — only your account can read them, and they are never exposed to the browser. Post metadata lives in the posts table alongside your Kindred-native posts.

Retention and deletion. Disconnecting your Instagram or TikTok from Dashboard → Connections immediately revokes the token on our side, deletes the token row, and removes every post that was imported from that platform within 24 hours. You can also revoke access at any time from Instagram (Settings → Apps and Websites) or TikTok (Settings → Manage app permissions); when we detect a revoked token during the next sync we treat it the same as a disconnect.

Where we store it

Supabase (Postgres, hosted in the AWS us-east-1 region). Row-level security is on for every table. Passwords are hashed by Supabase Auth (bcrypt). Access tokens for connected social accounts sit in a table only the owning brand can read.

Who we share it with

• The brand that ships your order sees your shipping address and the items you bought — nothing else.
• Payment card details go straight to Stripe and never touch our servers.
• We do not sell your data. We do not share it with data brokers or advertisers.
• We disclose data only when legally compelled (subpoena, court order) and, when the law permits, will tell you first.

Cookies

Only the essentials: your login session, your bag, your UI preferences. No third-party trackers.

Your rights

• Access: email us and we'll send you a JSON export of everything we hold on you within 30 days.
• Deletion: delete your account from Account → Settings, or email us. We'll remove your data within 30 days except where we're required to keep records (tax law: order records for 7 years, redacted of personal identifiers where possible).
• Correction: update any field on your account or brand profile directly in the app.
• Withdraw consent for the social integrations at any time by disconnecting in Dashboard → Connections.

Children

Kindred is not intended for anyone under 13. We don't knowingly collect data from children under 13.

Changes

We'll update this policy when we materially change what we collect or how we use it. The “updated” date at the top of this page is authoritative; we'll also email registered users about material changes.

Contact

Privacy questions or data requests: hello@shopkindred.org.