Legal
Privacy Policy
Last updated: 17 September 2026
The short version
We wrote this policy to be read, not skimmed past. Here is what it says:
What we collect: your university email, your profile, what you post, who you follow, which events you RSVP to, and the technical basics needed to keep your account secure.
Why: to run KYNCT, to keep it safe, and to meet our legal obligations. That is the whole list.
What we never do:
- We do not sell your data, to anyone, ever.
- We do not show you ads or share your data with advertisers.
- We do not handle payments, so we hold no card or banking details.
- We do not track you around the internet.
And one thing we want you to know before anyone else tells you: where you go says a lot about you. Your RSVP history could hint at your religion, your politics, your sexuality, or your health, even though we never ask about any of those. We treat that history as the most sensitive data in the app. Section 5 explains how.
1. Who we are
KYNCT is operated by KYNCT S.à r.l.-S, a simplified limited liability company in formation under the laws of the Grand Duchy of Luxembourg, with its registered office in Luxembourg.
We are the controller of the personal data described in this policy. That is the legal word for the party responsible for how your data is used.
How to reach us:
- Data protection and legal: legal@kynct.com
- General and support: support@kynct.com
A person reads these addresses. We accept communication in English.
We have not appointed a Data Protection Officer. We are not required to at our size and scale of processing, and we will revisit this as KYNCT grows. Data protection questions go to legal@kynct.com and reach the people who actually make the decisions.
Our supervisory authority is the CNPD (Commission nationale pour la protection des données), Luxembourg’s data protection authority. You can complain to them about us at any time; section 11 explains how.
2. What this policy covers
This policy covers the KYNCT mobile application, app.kynct.com, and kynct.com, together “the Services”. It should be read alongside our Terms of Service and Community Guidelines.
It covers you if you use KYNCT, and it also covers you if you have never used KYNCT but appear in a photo or video someone posted, or someone reported content to us about you. Sections 13 and 14 are written for people in that position.
3. What we collect
We collect what we need to run the service, and we have tried to keep the list short. No hidden categories, no data brokers, no buying information about you from anyone else.
Your account
| Data | Where it comes from |
|---|---|
| University email address | You, at sign-up. It doubles as proof that you are a student |
| Password and login credentials | You. Stored by our authentication provider, never visible to us in plain form |
| Username, display name, profile photo | You |
| Student verification status and when it was verified | Generated when your email is verified |
| A record that you accepted the Terms | Generated at sign-up |
| Society badge or invite-code redemption | Generated if a student society vouched for your account |
What you post and do
| Data | Notes |
|---|---|
| KYNCTs: text, photos, one 15-second video, GIFs | One media item per KYNCT |
| Comments, replies, likes | |
| Events you create | Including location, time, and any price you list |
| Memories | |
| RSVPs and event attendance | Treated as sensitive; see section 5 |
| Who you follow and who follows you | See section 5 |
| Who you block | Never visible to the person blocked |
Safety and moderation
| Data | Notes |
|---|---|
| Reports: who reported, what, and when | The person reported is never told who reported them |
| Moderation decision records | What happened, what we did, and why |
Technical
| Data | Notes |
|---|---|
| Device and IP address per session | So you can see and sign out of other devices, and so we can spot break-in attempts |
| Email delivery logs | Which emails we sent you, whether they arrived, and addresses that bounced or asked us to stop |
| GIF search terms | If you search for a GIF, the search term is sent to the GIF provider to fetch results; see section 8 |
What we do not collect
- No payment or banking data. KYNCT handles no payments. We are the noticeboard, not the box office.
- No government ID from ordinary users. Identity verification for public event organisers is a separate, scoped process, and we will tell you exactly what it involves before you go through it.
- No advertising identifiers, and no tracking of you outside KYNCT.
4. Why we use your data, and our legal basis for it
The GDPR requires us to have a specific legal reason for every use of your data. Here they all are.
| What we do | Data involved | Legal basis |
|---|---|---|
| Create and run your account, deliver the app, show your posts and events to others | Account data, content, social graph | Contract (Art. 6(1)(b)): this is the service you signed up for |
| Verify that you are a student and 18 or over | University email, verification status | Contract: student-only access is a core term of the service |
| Send transactional email: verification, security notices, essential service messages | Email address, delivery logs | Contract, and legitimate interest in knowing our emails actually arrive |
| Keep KYNCT safe: handle reports, moderate content, act on scams and abuse | Reports, moderation records, content | Legitimate interest (Art. 6(1)(f)) in a safe platform, and legal obligation (Art. 6(1)(c)) under the EU Digital Services Act |
| Secure accounts: session records, sign-out-other-devices, spotting suspicious logins | Device and IP per session | Legitimate interest in security, yours and ours |
| Comply with the law: respond to valid orders from authorities, report serious crimes involving threats to life or safety | Whatever the specific obligation requires | Legal obligation |
| Fetch GIF results when you search | Your search term | Contract: it is how the feature works. The term goes to the provider; see section 8 |
Where we rely on legitimate interest, we have weighed our interest against your rights, and you can object at any time (section 11). We do not use your data for advertising, profiling for marketing, or anything on this list’s behalf that is not on this list.
5. Where you go is sensitive, and we treat it that way
This is the section we most want you to read.
KYNCT never asks about your religion, politics, health, or sexuality. But an events app does not need to ask. If you RSVP to a prayer group, a political rally, a Pride night, or a support meeting, your attendance history says it for you. The same goes for who you follow. European courts have confirmed that data which indirectly reveals these things is protected as strictly as if it had been asked directly, and we agree.
So here is our position:
- Your RSVP history is the most sensitive data in this app, and we treat it with the care other apps give health data.
- We use your RSVPs for one thing: running the service, so organisers can see who is coming and you can see what you said yes to. We do not analyse your attendance to profile you, categorise you, or infer anything about you.
- We never share attendance history with advertisers, because we have no advertisers.
- Where an event's nature could reveal something protected about you, our processing rests on the fact that you chose to make that RSVP within the service (Art. 6(1)(b) and, where Article 9 applies, Art. 9(2)(e), data you manifestly chose to share with the event's audience), and it goes no further than delivering the feature.
One honest caveat: an RSVP is visible to the event and its audience by design. If you RSVP to a public event, people at that event can see you are coming. Think of an RSVP as telling the room, because that is what it is. If an event is sensitive for you, you can attend without RSVPing.
The same principle in one line, because it is also who we are: we do not handle payments, and we treat where you go as private.
6. Private messages
KYNCT does not currently offer private or group messaging. When messaging returns, we will update this policy to describe it before the feature ships.
7. Who sees your data
Other users. KYNCT is a social app, so much of what you provide is visible by design: your profile, your posts, your comments, your events, and your RSVPs to events others can see. Your blocks are visible to no one.
People without accounts. Public event pages on app.kynct.com may be visible without an account. Your private content is not.
Our team. A small number of people at KYNCT can access data where their job requires it: handling your support request, reviewing a report, fixing a fault. Access is limited to what the task needs.
Authorities. We disclose data where a competent authority validly orders it, and we report suspected criminal offences involving a threat to someone’s life or safety to the Luxembourg judicial police, as our Terms state.
No one else. We do not sell data. We do not share data with advertisers, data brokers, or analytics resellers. Recipients beyond the above are the processors in section 8, who work for us under contract and may not use your data for their own purposes.
8. The companies that help us run KYNCT
Like almost every app, KYNCT runs on infrastructure operated by specialist providers, called processors. They process your data only on our instructions, under data processing agreements, and cannot use it for themselves.
| Provider | What they do for us | Where the data lives |
|---|---|---|
| Supabase | Our database, authentication, file storage, and server functions. Most data described in this policy lives here | EU (Frankfurt, Germany), for production and staging |
| Vercel | Hosts kynct.com and app.kynct.com | US company; serves content globally. Transfers covered by EU Standard Contractual Clauses |
| Resend | Sends our transactional email (from notify.kynct.com), and holds the delivery logs described in section 3 | US company, certified under the EU-US Data Privacy Framework; account data and logs are held in the US |
| Lovable | The development platform parts of KYNCT are currently built on. We are migrating away from it | See checklist: exact data access under confirmation |
| Google Workspace | Our company email. If you write to support@ or legal@, your message lives there | Google Ireland for EU users; global infrastructure |
| Apple | Distributes the iOS app, including TestFlight during testing. Apple's own processing (your Apple account, App Store activity) is under Apple's privacy policy, not ours | Per Apple's terms |
| GIF provider (GIPHY or Tenor) | Powers GIF search. When you search for a GIF, your search term leaves KYNCT's infrastructure and goes to this provider. We send the term, not your name or account details, but the provider receives the request from your session | US providers. We are finalising which one; this policy will be updated to name it |
We keep this list current. If we add a provider that handles your data, we update this policy rather than editing quietly.
9. When data leaves the EU
We keep your data in the EU where we can: the database holding your account, content, and social graph is in Frankfurt.
Some providers above are US companies, so some data is transferred to the United States: email delivery data (Resend), website hosting operations (Vercel), and GIF search terms (GIPHY or Tenor). For these transfers we rely on the safeguards the GDPR provides: the EU-US Data Privacy Framework where the provider is certified, and the European Commission’s Standard Contractual Clauses otherwise. You can ask us at legal@kynct.com for more detail on any specific transfer.
10. How long we keep things
The short principle: we keep data while you have an account, plus the minimum needed afterwards for safety, security, and legal obligations. We do not warehouse data on the chance it becomes useful.
| Data | How long |
|---|---|
| Account and profile | While your account exists, then deleted (see section 12) |
| Content you posted | While it is up. Deleting a post removes it; deleting your account removes your content |
| RSVPs and follows | While your account exists |
| Reports and moderation records | As long as we need them to act consistently and handle repeat behaviour, and no longer, unless a legal matter requires it |
| Device and IP session logs | As long as needed for account security, and no longer |
| Email delivery logs | As long as needed to diagnose delivery problems and honour unsubscribe requests, and no longer |
| Suppression list (addresses that asked us to stop) | Kept, because remembering who said stop is how we honour it |
| Records we must keep by law (e.g. relating to authority orders or crime reports) | As long as the specific law requires |
Where a period above is a range or a criterion rather than a date, that is because the GDPR allows retention criteria where fixed periods do not fit, and we have given you the criterion.
11. Your rights
The GDPR gives you real, enforceable rights over your data. All of them are free, and all of them start with an email to legal@kynct.com. We respond within one month; if a request is complex we can extend by two more, and we will tell you if so.
- Access. Ask what data we hold about you and get a copy of it.
- Rectification. Have inaccurate data corrected.
- Erasure. Ask us to delete your data. Section 12 covers deleting your whole account.
- Restriction. Ask us to freeze processing of your data while a dispute or check is resolved.
- Portability. Request a copy of the data you gave us by emailing legal@kynct.com, and we will provide it in a commonly used, machine-readable format within the period the law sets.
- Objection. Object to any processing we base on legitimate interest. We then stop unless we can show compelling grounds that override your objection.
- Withdrawing consent. Where processing is based on consent, you can withdraw it at any time, without affecting what was lawfully done before.
We will need to confirm you are who you say you are before acting on a request; usually a message from your account email is enough.
Complaining to the CNPD. If you think we have handled your data unlawfully, you can complain to Luxembourg’s data protection authority:
Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg
cnpd.public.lu
If you live in another EU country, you can also complain to your own country’s authority (in the Netherlands, the Autoriteit Persoonsgegevens), which will coordinate with the CNPD. Complaining costs nothing and you do not need a lawyer. And you can always go to court, whatever we or any authority decide.
12. Deleting your account
You can delete your account at any time, in the app or by emailing support@kynct.com.
When you delete your account, we delete your account and your content: your profile comes down, your access ends, and your posts, events, and photos are removed from the app. If you want to confirm that specific data has been erased, or ask us to erase something particular, email legal@kynct.com and we will handle it directly.
Some things survive deletion by design:
- Moderation records and report history, for the periods in section 10
- Data we are legally required to keep
- The suppression record that stops us emailing you again
13. If you are in a photo and you did not post it
KYNCT is full of photos and videos of real events, which means it is full of people who did not press the upload button. If that is you, whether or not you have a KYNCT account:
- Our Community Guidelines already require posters to take content down when the person in it asks. That rule has legal weight, not just social weight.
- You can ask the poster directly, or report the content in the app, or email support@kynct.com with a link or description of the content. You do not need an account to ask.
- We will remove content of you where you object, unless there is a compelling reason to keep it, and for an ordinary photo of a person at an event there rarely is.
For posters, the other side of the same coin: when you upload media of other people, you are responsible for it being fair to them. Do not post someone who asked you not to, and take it down when asked.
We obtained this data (your image, in someone else’s post) from the person who posted it, not from you. This section is our notice to you about that, and legal@kynct.com is where to exercise any of the rights in section 11 over it.
14. If a KYNCT user dies
If a user has died, their family can contact legal@kynct.com and we will either memorialise the account or remove it, as the family prefers. We are still finalising the legal details of this policy, including what proof we ask for, and we will handle each request with care in the meantime.
The GDPR itself does not cover deceased persons’ data, and Luxembourg law has not added specific national rules for it, so this is a promise we make by choice rather than a right the law grants. We think it is the right thing to do.
15. No profiling, no automated decisions
We make no automated decisions with legal or similarly significant effects about you. No algorithm suspends your account, ranks your worth, or decides what you are allowed to see.
Concretely:
- The feed is not algorithmically personalised, and there is no infinite scroll.
- Moderation decisions that restrict content or accounts are made by a person. Automated checks exist only for technical things like file types and sizes.
- We build no advertising or marketing profiles, because there is no advertising.
If this ever changes, this section will change first, and we will tell you.
16. What you have to provide, and what happens if you do not
Providing your data is not a statutory requirement; no law obliges you to join KYNCT. Some of it is a contractual requirement: without a university email address we cannot verify you are a student, and without the basics of an account we cannot provide the service at all. Those are the only pieces you must provide. Everything else, every post, RSVP, and photo, is yours to give or not.
17. Keeping your data safe
We protect your data with the standard measures you would hope for: encrypted connections throughout, passwords handled by a dedicated authentication system and never stored in plain form, database access rules enforced at the database itself, session controls that let you sign out other devices, and access inside the team limited to what a task needs.
We are 18+ only. We do not knowingly hold data of anyone under 18, and we remove under-18 accounts when we find them.
If a breach ever puts your rights at risk, we will notify the CNPD within 72 hours as the law requires, and we will tell you directly where the risk to you is high. We would rather tell you something uncomfortable than have you find out another way.
18. Changes to this policy
We may update this policy as KYNCT changes. Where a change is significant, we will tell users before it takes effect, and we will say what changed rather than editing quietly. Continuing to use KYNCT after a change takes effect means the updated policy applies.
19. Questions
Data protection: legal@kynct.com. Anything else: support@kynct.com. A person reads both.
KYNCT S.à r.l.-S (in formation), Luxembourg