Privacy Policy

Last updated: July 4, 2026 · Version 1.2

Short version: Kinda does not collect your name, email, or any identifying personal information. Text you translate is processed via Anthropic's Claude API and is not stored by us. A random anonymous ID is used only to enforce the daily free limit. You can delete all data by uninstalling the extension.

1. Who is responsible for your data (Data Controller)

The data controller for this extension is:

Maxime Vigneron
Spain
Email: support@trykinda.com

For all data protection matters, including exercising your rights, contact the above email address with the subject line "GDPR Request".

2. What data we process, why, and on what legal basis

The table below sets out every category of data we process, the purpose, and the legal basis under GDPR Article 6.

Data	Purpose	Legal Basis (Art. 6 GDPR)	Stored where	Retention
Translation profile (language pair, relationship context, formality, gender settings)	Personalise translation output to your preferences	Art. 6(1)(b): performance of a contract (providing the service you requested)	Your browser only (`chrome.storage.local`)	Until you uninstall or clear manually
Translation history (last 50 translations)	Show your history tab inside the extension	Art. 6(1)(b): performance of contract	Your browser only (`chrome.storage.local`)	Until you uninstall or clear manually
Daily usage count (number of translations today)	Enforce the 20 free translations per day limit	Art. 6(1)(f): legitimate interest (preventing abuse of the free tier)	Your browser + our Cloudflare Worker (server-side counter)	Browser: until uninstall. Server (Cloudflare KV): automatic expiry after 48 hours
Anonymous install ID (a randomly generated UUID, e.g. `f7a3c...`)	Link the server-side usage counter to your installation without identifying you	Art. 6(1)(f): legitimate interest (rate limiting requires a persistent key; no alternative exists that does not involve more personal data)	Your browser + Cloudflare KV	Browser: until uninstall. Server: expires with usage counter (48 h) or, if Pro, until subscription ends
Pseudonymized network address counter (a salted one-way hash of your IP address that changes every day; your actual IP address is never stored)	Prevent abuse of the free tier by scripts that generate new install IDs to bypass the daily limit	Art. 6(1)(f): legitimate interest (abuse prevention; the hash cannot be reversed to your IP and cannot be linked across days)	Our Cloudflare Worker (server-side counter in Cloudflare KV)	Automatic expiry after 48 hours
Text you submit for translation	Generate the translation via Anthropic's Claude API	Art. 6(1)(b): performance of contract	Transmitted to Cloudflare Worker → Anthropic API. Not stored by us after the API response is returned.	Not retained by us. Anthropic's retention is governed by their privacy policy.
Subscription record (anonymous install ID + Stripe subscription status; Pro users only)	Verify that a Pro subscriber can use unlimited translations	Art. 6(1)(b): performance of contract (Pro subscription)	Cloudflare KV	Deleted automatically when subscription ends or is cancelled

3. What we do NOT collect

Your name, email address, or any account information
Your browsing history or the URLs of pages you visit
Any content from web pages (Kinda only processes text you explicitly type or paste into the extension's input field)
Cookies or cross-site tracking identifiers
Device fingerprints, IP addresses stored by us (your IP may be logged by Cloudflare per their infrastructure practices; see Section 4)

4. Third-party processors and international data transfers

We use the following sub-processors. All of them are based in the United States. Because the EU–US Data Privacy Framework does not cover all providers, and to comply with GDPR Chapter V (international transfers) and LOPD-GDD, data transferred to these providers is protected by Standard Contractual Clauses (SCCs) adopted by the European Commission under Decision 2021/914/EU.

Cloudflare, Inc. (USA)

Role: Infrastructure, serverless compute (Workers), key-value store (KV).
Data transferred: Translation requests (text + anonymous install ID), usage counts.
Transfer safeguard: Cloudflare participates in the EU–US Data Privacy Framework and additionally offers SCCs.
Privacy policy: cloudflare.com/privacypolicy

Anthropic, PBC (USA)

Role: AI model provider (Claude API). Processes the text you submit for translation.
Data transferred: The text you submit for translation, plus minimal request metadata.
Transfer safeguard: SCCs (Anthropic's Data Processing Addendum available on request from Anthropic).
Retention: Anthropic does not use API inputs to train models by default and processes data only to return the translation. See anthropic.com/privacy and their API usage policies.

Stripe, Inc. (USA), Pro subscribers only

Role: Payment processing. We never see or store your card details.
Data transferred: Payment details entered directly on Stripe's hosted checkout. We receive only a subscription status flag tied to your anonymous install ID.
Transfer safeguard: Stripe participates in the EU–US Data Privacy Framework and offers SCCs.
Privacy policy: stripe.com/privacy

5. Data retention summary

Browser data (profile, history, usage count, install ID): retained until you uninstall the extension or clear it via Chrome's extension settings.
Cloudflare KV usage counter: expires automatically after 48 hours from creation.
Cloudflare KV subscription record (Pro only): deleted when your subscription ends.
Translation text: not stored by us at all. Anthropic processes it to return a response and does not retain it for training by default.

6. Your rights under GDPR and LOPD-GDD

As a data subject under the GDPR (Regulation (EU) 2016/679) and Spain's Organic Law 3/2018 (LOPD-GDD), you have the following rights:

Right of access (Art. 15 GDPR): request confirmation of whether we process data about you and, if so, a copy of that data.
Right to rectification (Art. 16 GDPR): request correction of inaccurate data. (Note: most data is stored locally in your browser and can be edited directly.)
Right to erasure / "right to be forgotten" (Art. 17 GDPR): request deletion of your data. For local data, uninstalling the extension achieves this immediately. For server-side data (anonymous install ID + usage counter), contact us and we will delete it.
Right to restriction of processing (Art. 18 GDPR): request that we restrict processing of your data in certain circumstances (e.g. while a dispute is pending).
Right to data portability (Art. 20 GDPR): receive a copy of the data you have provided to us in a structured, machine-readable format.
Right to object (Art. 21 GDPR): object to processing based on legitimate interests (Art. 6(1)(f)), including profiling. We use legitimate interests only for the anonymous rate-limiting counters (the install ID counter and the daily pseudonymized network address counter); you can object by contacting us and we will assess whether compelling grounds override your objection.
Right not to be subject to solely automated decision-making (Art. 22 GDPR): we do not make any automated decisions that produce legal or similarly significant effects about you.
Right to withdraw consent: we do not rely on consent as the legal basis for any processing, so this right is not applicable.

To exercise any of these rights, email support@trykinda.com with subject "GDPR Request". We will respond within one month (extendable by a further two months for complex requests). We will not charge a fee unless requests are manifestly unfounded or excessive.

7. Right to lodge a complaint with a supervisory authority

If you believe your data rights have been violated, you have the right to lodge a complaint with the competent supervisory authority. As the data controller is established in Spain, the lead supervisory authority is:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
Website: www.aepd.es
Phone: +34 901 100 099

You also have the right to lodge a complaint with the supervisory authority of your country of residence or workplace.

8. Security

We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, or disclosure. Specifically:

All data in transit is encrypted via TLS (HTTPS).
Cloudflare Workers run in an isolated execution environment.
We do not store translation text. It passes through our infrastructure only to reach the Anthropic API.
Stripe handles all payment data; we never receive or store card numbers.
API keys and secrets are stored as environment secrets (not in code) via Cloudflare Wrangler.

9. Children

Kinda is intended for users aged 16 and older, the age of digital consent under LOPD-GDD Art. 7 in Spain and a threshold above the U.S. Children's Online Privacy Protection Act (COPPA) cutoff of 13. We do not knowingly process data from children under 16.

Before completing setup, users are asked to confirm they are 16 or older. This is a self-reported confirmation, not a verified age-verification system. Kinda has no technical means to confirm a user's true age, and no parental-consent mechanism exists for users who do not meet this threshold. A user who declines this confirmation cannot complete setup and cannot use the extension.

If you are a parent or guardian and believe a child under 16 is using Kinda, contact us at the email below. We will delete any server-side data associated with that installation (the anonymous install ID and usage counter) on request; data stored locally in the browser is deleted by uninstalling the extension.

10. You are interacting with an AI system

Kinda's translations are generated by Claude, an AI model developed by Anthropic, not by a human translator. This is disclosed to every user during setup, before the extension is used for the first time.

11. Changes to this policy

If we make material changes to how we handle personal data, we will update the "Last updated" date at the top of this page and, where the change is significant, notify users via the extension. We encourage you to review this policy periodically.

12. Contact

Maxime Vigneron (Data Controller)
Email: support@trykinda.com
Subject line for data requests: "GDPR Request"