Someone is making
a private voice gift about you.

An organizer is creating a private Kinvoria voice gift about you, or has identified you as a recipient, project subject, or intended listener. We may therefore receive personal information about you from that organizer and from invited contributors rather than directly from you.

The organizer must give this notice to every project subject before creating the project. If you are below the applicable age of consent or otherwise cannot provide valid authorization, the organizer must give this notice to your parent or legal guardian, who must actively assist and provide the permission or other lawful authorization required for your participation and information.

This notice describes how personal information about recipients and project subjects is handled through the Kinvoria service. Privacy questions and requests may be sent to the contact published below. Google and Paddle act under their own privacy notices for sign-in and payment services.

The organizer may provide your name or group name, display age for a birthday gift, occasion, event date, question, locale, timezone, and project instructions. We do not require or store your full date of birth. Contributors may continue as guests or optionally sign in with Google, and may provide their own display name, relationship, voice, stories or memories about the project subjects and, after Google sign-in, an optional profile image. For guest duplicate prevention, a browser opening an invitation while signed out generates a first-party random token. The service stores only a project-scoped SHA-256 digest derived from that token and the project ID if the contributor continues as a guest; it ignores the token for a signed-in submission. This is not a MAC address, hardware identifier, or browser fingerprint. A final private MP3 may contain the recordings and chapter information.

We also process limited technical records associated with private links, uploads, playback, security, deletion, and support. Do not include medical, financial, government-identifier, precise-location, or other unnecessary sensitive information. When information about a child is provided, their parent or legal guardian must supply the authorization required for the submission and actively assist where necessary.

We use the information to collect authorized contributions, assemble and deliver the requested private voice gift, provide private playback and download, process removal requests, secure the service, prevent abuse, troubleshoot failures, and answer support requests.

Depending on the person and applicable law, processing is necessary to perform or prepare the organizer's service contract, to act on a contributor's request, to comply with legal obligations, or for our legitimate interests in delivering a limited private gift securely. Where consent is required for a particular use, it is requested separately. We do not sell the information, use it for targeted advertising, train AI models with private voices or stories, identify speakers biometrically, or make solely automated decisions with legal or similarly significant effects.

The organizer can manage contributions and can see a contributor's display name and, when the contributor chose Google sign-in, optional Google profile image, but not the contributor's email or Google account identifier. The organizer cannot see the guest token or its server-side digest. A person holding a valid private contribution link can view the limited project details made available through that link and gives one explicit set of confirmations when finally submitting. Intended listeners with the private listening link can access the final gift after any required privacy and policy confirmation. A parent or legal guardian must assist when the listener cannot validly complete that confirmation themselves. Anyone who receives a private link may be able to use it, so links must be kept confidential.

Service providers may process limited information for their assigned work: cloud infrastructure and private storage providers for core service operation and audio storage in Singapore; Google for organizer sign-in and optional contributor sign-in; Paddle for checkout; and a transactional email provider for essential service messages. Provider-managed processing may occur in the locations described in each provider's privacy documentation, including outside your country. Where transfer rules apply, we use an available legal mechanism and provide further safeguard information on request.

Original uploads are queued for deletion 30 days after the first final render. The processed radio is hosted for 90 days and then queued for deletion. An unpaid unfinished project is redacted and its audio queued for deletion 30 days after the collection deadline. Project deletion revokes links immediately, redacts principal personal fields, and triggers durable media deletion; a later pass removes remaining project content after physical cleanup is confirmed.

Some transaction, consent, security, dispute, and deletion records may be retained for a separate period required for accounting, consumer protection, fraud prevention, legal claims, or a legal hold. The full retention table is in the general Privacy Notice.

Depending on your location, you may ask to access, receive, correct, delete, restrict, or object to processing of your information, withdraw consent for future processing, use an authorized agent, or appeal a decision. You may also complain to your local privacy regulator. We will not discriminate against you for making a privacy request.

Use the private removal link if you contributed a recording, ask the organizer to delete the project, or contact us and describe your relationship to the project. We may verify your identity or possession of the relevant private link. A downloaded copy held by another person cannot be remotely recalled.