1 About this policy
This policy explains how the KitDone app for Android and for iPhone handles your data. Where the two differ, it says so. KitDone has no account system: you do not sign up with a name or an email address. For privacy questions, contact [email protected].
2 What stays on your phone
Your gear list, jobs (names, dates and notes), kits, bags, quantities, preparation and Return Check status, and your settings are stored in a database on your phone. The app does not send this content, or the contents of your .kitdone backups, to our server. Locking your phone and keeping its system updated helps protect your data.
3 What our server receives, and why
Some features need a short online check with our verification service: starting the free trial, counting a new trial job, restoring access, and verifying a purchase. For these we process:
- Android only: your Android identifier, when the trial is registered or restored. The server does not store the identifier itself, only a keyed digest (HMAC) of it. KitDone does not read any device identifier on iPhone.
- Random identifiers created by the app: an installation ID, a trial record ID, and a job ID for each job (random; it contains no job name, date or gear), plus the public half of a key. The private half stays protected on your device: in Android Keystore on Android, and in Apple’s App Attest system on iPhone.
- The time each trial job was counted.
- Android: a Play Integrity token. The app sends it so our server can ask Google to confirm that the app is genuine, installed from Google Play, and running on a sound device.
- iPhone: an Apple App Attest proof (an attestation the first time, then a signed assertion with each request), so our server can confirm that the app is genuine and running on a real Apple device; a DeviceCheck token, which our server passes to Apple to read, and when a trial is granted to set, one flag that Apple keeps for your device so that reinstalling does not restart the free trial; and a one-way digest of a random recovery code, which the app creates for you and keeps only in your iPhone’s Keychain. Our server stores neither the DeviceCheck token nor any device identifier from an iPhone; the flag is held by Apple.
- Android purchases: your Google Play purchase token. We send it to Google Play to check it, and keep a one-way digest of it (not the token itself), the verification result and its time, and the installation ID. Google handles your payment details; we do not receive them.
- iPhone purchases: the purchase is made and processed by Apple through the App Store. The app checks it on your device with Apple’s StoreKit and does not send your purchase details to our server.
- Your IP address, which reaches our hosting provider when you connect. The service keeps a short-lived salted digest of it only to limit repeated requests.
- If you ask support for help after a refused trial registration: see section 4.
We use this data only for specific purposes: to enforce the five-job free trial across reinstalls, to verify and restore your purchase on Android, to protect the service from abuse, and to answer support requests. We do not use it for advertising or analytics, and we do not sell it. The app contains no ads, no analytics tools, no tracking, no crash-reporting service, no access to your location or contacts, and no remote push service (reminders are local). Data is sent over HTTPS.
4 If your trial cannot be started on a phone that was used before
If this phone is found to be linked to an earlier trial record (for example after you removed KitDone and installed it again), the app does not start a new trial and the server keeps a "support request": a random request code shown to you in the app, the installation ID, the reason, the ID of the earlier record if one was found, the request’s status and dates, and, on Android, a keyed digest of your Android identifier (not the identifier itself). We use it for one purpose: so support can check with you. On Android, support can, if appropriate, link your new installation to your earlier record, so your remaining trial jobs are kept rather than reset. On iPhone, the app first restores your earlier record by itself, using the recovery code kept in your iPhone’s Keychain, which stays on the iPhone when you reinstall the app. If that code is not available (for example on a new iPhone), support can link your new installation to your earlier record when you can show the support code of your earlier installation and we can verify that it is yours. In every case your consumed trial jobs stay counted: a reinstall does not reset them. The code alone grants no access and changes no record, and the app never chooses the record. Asking again reuses the same open request for this phone. Your purchase does not depend on a trial record.
5 Who else handles data
Cloudflare hosts our verification service and its database. On Android, Google Play and Google Play Integrity handle purchases and device checks; on iPhone, Apple’s App Store, StoreKit, App Attest and DeviceCheck do, each under Google’s or Apple’s own terms. They may process data outside your country and keep their own operational logs, which we cannot delete.
6 Backups and removing the app
On Android, automatic backup and device-transfer rules exclude your content database and the app's private access data; only the counter of used trial jobs can travel with them, and that counter alone does not prove your entitlement. To move your content, export a .kitdone backup and restore it yourself. It contains no purchase ownership, review code or permit. After you reinstall, Google Play restores your purchase: the app asks Google Play and our server to verify it again. Removing the app or clearing its data deletes what is stored on the phone under your system's rules; it does not delete files you exported, backup copies you made elsewhere, or records on our server.
On iPhone, your content database is stored in the app’s own storage. KitDone does not upload your jobs, gear, bags, kits or backups to its servers. Under your own Apple backup settings (iCloud Backup, or a backup to a computer), iOS may include the app’s local data in your iPhone’s backup and restore it with the device; the file that identifies this installation to our verification service, and the app’s temporary safety copies made before an update, are excluded from those backups. A restored copy never grants free jobs or a purchase by itself: our server counts the free jobs and the App Store confirms the purchase. You can also export a .kitdone backup and restore it yourself; it contains no purchase ownership. After you reinstall, the App Store returns your purchase through your Apple Account when the app checks it. Deleting the app removes its data from the iPhone; it does not delete your iCloud or computer backups, files you exported, or records on our server.
7 How long we keep server records, and how to ask us to delete them
- Temporary: verification and deletion-authorization challenges expire quickly. A daily cleanup deletes them after they have been expired for a day (normally within about 48 hours of expiry); expired rate-limit counters are removed by the same daily cleanup.
- Trial records, usage timestamps, device digests, installation keys, support requests and purchase-verification digests have no fixed automatic deletion period in the current service. They stay until a verified deletion request is completed or a separately assessed retention decision is applied. Removing the app or closing a support request does not delete them. Trial records enforce the five-job limit; installation keys authenticate requests; support records handle blocked registrations. Purchase-verification digests are a technical audit cache, not proof of ownership or a tax record. The server stores no name or email address.
- To request deletion, email [email protected] with the installation key shown in KitDone → Settings → Delete Server Records (named “Server Data Deletion Proof” in earlier versions). A support code can help locate a record, but does not prove ownership. Support sends a challenge valid for 15 minutes, tied to your installation and the specific server records and counts to delete. Review the scope in the app, sign it with your device key, and send the resulting proof to support. The server verifies and consumes this proof once in the same transaction as deletion. If records changed, a new challenge is required. Never send your trial recovery code. If you no longer hold the installation key, support cannot treat the support code alone as authorization. On iPhone, the same screen proves your request with Apple App Attest instead of a signing key. Deleting server records on iPhone does not remove the flag Apple keeps for your device, so a new free trial may not start there; your purchase is not affected.
Deletion removes the authorized installation, its purchase-verification cache and review-permit record, and, if it owns a trial record, that trial record, recovery digest, usage, grants, device marker and related registration/support records. Other installations and their purchase records remain; their link to the deleted trial is removed. A blocked installation cannot authorize deletion of another trial record merely because its support request refers to it. Your local gear and jobs, exported backups, your Google Play or Apple purchase and already saved offline permits remain. A later registration may receive a new trial on Android; on iPhone Apple’s device flag remains, so a new trial may not start. Deleted trial recovery stops working. A later online purchase check can create a new technical verification record. Provider logs and operational backup copies follow the provider’s own retention and recovery procedures; the live-database deletion does not erase those copies immediately.
We tell you the scope and outcome of your verified request. A request for another installation needs proof for that installation. We do not claim a tax-retention requirement for these technical records or an automatic legal exemption based on the absence of accounts. Rights and any justified retention limits depend on the laws that apply to you.
8 Children and teens
KitDone is for people aged 13 and over (13–15, 16–17 and adults), not for children under 13. The app does not ask for your date of birth. The app does not currently use Google’s or Apple’s age signals and does not itself check a parent’s consent; any parental approval Google Play asks for when downloading or buying is handled by Google Play, and on iPhone Apple’s own parental controls, such as Ask to Buy, are handled by Apple. Some places (including some US states and Brazil) have laws about age checks in apps; we are assessing them and will update this policy if the app changes.
For parents and guardians: the app has no accounts, social features, ads or tracking. The only data sent to our server is what sections 3 and 4 describe. You can contact us about a minor's data (the support code from the minor's phone helps us find it). If your local law requires your consent, please contact us; this policy does not claim that the app performs that verification.
9 Support messages and updates
When you contact support, we receive your email address, your message and any attachments you choose to send. We use them to reply and follow up and keep them as long as needed for the request and related legal obligations; you can ask to access, correct or delete them through the same address. We publish updates at https://kitdone.com/privacy and https://kitdone.com/ar/privacy with the actual revision date, and give notice or ask for consent where required before a material change in processing.
If you send an idea through the form on kitdone.com, we receive your name, email address and message and use them only to follow up on your suggestion; we do not publish or sell them. The form is protected by Cloudflare Turnstile, which checks that the sender is a person.