Privacy notice

What we collect

• To identify your account: your phone number, a PIN and a one-time recovery code (the PIN and recovery code are stored only as irreversible hashes — we can never read them).
• Emergency and health information you enter: optional name, blood type, allergies, medications, conditions, implants, blood-thinner status, weight, and free-text notes.
• Your people: up to two emergency contacts and whether you allow a rescuer to message each of them.
• Your bike and insurance: motorcycle details and insurance details you choose to add.
• Your email address, which is required. It has two jobs, both about this account and neither about marketing: getting you back in if you lose your PIN, and telling you when something changes the keys to your account — a new PIN, a new recovery code, a change of phone, email or name, a copy of your account downloaded, a new tag code, or your tag paused. It is not shown when someone scans your tag unless you switch that on yourself — it starts off, like every field, and the switch says beside it that this is the address your recovery link goes to. It is encrypted where we store it. One more message goes to it: when you sign up or change it, a link that confirms the address is yours, because a recovery link only goes to a confirmed address. Nothing else is sent to it unless you ask for it — no newsletter, no product mail. The one thing you can ask for is the scan alert below, which is off until you turn it on.
• Optional: your date of birth, if you provide it.
• Optional: a testimonial for our home page, and the name you sign it with. Both are encrypted where we store them. It is shown only once you switch it on AND we have read and approved it — change the words and it waits for us again — and beside it we show that name and your country. Switching it on or off is recorded in your account activity.
• When you last reviewed your medical details: the date you last opened your emergency page and saved it. It is shown on your tag page, under your medical information, so whoever reads it can judge how current it is — an allergy list saved last week and one saved four years ago say different things. It records that you looked, not that anything changed, and it appears only if you have at least one medical field switched on. Nothing else moves it: editing a contact, a bike, your email or your PIN does not.
• If you claim a pre-printed sticker: the blood group printed on it, kept beside your account so we can warn you if the group you have stored later differs. Changing your tag code clears it. The sticker's own record — its code, the blood group printed, when it was claimed — stays after you delete your account, with nothing about you in it, so that the same code is never handed out again; but because its code was your tag code, anyone holding both records can match the two.
• Scan events: we keep only the time of the most recent opening of your tag, and nothing about who opened it — no IP address, no location, nothing about their phone or browser. There is no history: each opening replaces the last time, so all that exists is one moment per rider. Our host, Vercel, is the exception: like every request to the site, an opening passes through Vercel's request log, which records the address opened — for a tag page, its code — and the browser description (user agent), and can include the IP address. We can read that log for one hour after the request.
• The scan alert, only if you turn it on: it is off unless you switch it on from your dashboard. Then, when your tag is opened, we email you that it was opened and when (the date and time, in UTC) — nothing about who opened it, and nothing from your account but the address it goes to. We send at most one every 6 hours; to know when the next may go, we keep the time of the last alert we sent, on your account, overwritten each time. Our email provider, Resend, carries each alert and keeps its own record of every message it carries, so with alerts on, Resend holds a record of when each alert went out (see the providers below).
• Account activity: when someone signs in as you, and when the keys of your account change — a new PIN, a new recovery code, a change of phone, email or name, a copy of your account downloaded, a new tag code, your tag paused or switched back on, the scan alert switched on or off. Each entry is what happened and when, and nothing else: no IP address, no location, nothing about your phone or browser. It is there so you can see activity that was not yours; you read it on your account page and it comes with you when you export. Signing in also leaves a record with Supabase, described with the providers below.

Why we hold it

We process this information solely to provide the emergency-info service you asked for. We ask for your explicit consent to store health information when you sign up, and you can withdraw it at any time by deleting your account.

Your email address is the one exception to that sentence, and it is a narrower one: it exists so you can recover your account and so we can tell you when the keys to it change, and it is used for those two things and nothing else, plus the scan alert if you turn it on. That is why we ask you to confirm it. An account is not active until you confirm your address: we mail a link, and you open it and enter your PIN. A sign-up you never confirm is deleted, with everything you entered, 24 hours after you started it. When you change the address later, the new one gets no recovery link until you open the link we send and press Confirm while signed in. Addresses on accounts that existed on October 13, 2026 were counted as confirmed without that step. If you ask for a recovery link and your address is confirmed, we send you one message with a link that works once and expires in 30 minutes.

What a scan can show

Every field starts private. Nothing about you is shown until you switch it on in your Privacy settings. That is now true of every field we hold, with no exceptions at all. Some of them identify you rather than help treat you — your email address, your date of birth, your weight, your full insurance, policy or member numbers, and your bike's VIN — and those help identity thieves more than they help responders. On the Privacy page each of them carries a mark, with a line saying plainly what the mark means, and like everything else they start off. The decision is yours. Until September 12, 2026, it was ours: those fields could not be published at all, whatever you set, and the honest description of that is that we were deciding for you.

We never sell or share it

We do not sell, rent, or share your information for advertising. There are no advertising trackers on our pages and no analytics script from anyone else — visits to our public pages are counted through our own server, without a cookie, as described below — and we set only the cookies strictly needed to keep you signed in, hold a sign-up you have not finished yet, remember your language, and remember whether you chose the light or dark view. The single third-party script in the whole product is the bot check, and it runs on exactly four pages: our contact page, the sign-up page, the sign-in page and the account-recovery page. It sets no cookie. Cloudflare states that it sets no cookie and never uses what it sees to profile you, and that is the right way to read it: the challenge runs in a frame of its own, but the small script that loads it runs in the page like the rest of the page's code. So this is Cloudflare's undertaking about your phone, your email, your name and your PIN — not something the page makes impossible. What Cloudflare does learn is that some visitor loaded one of those four pages, with that visitor's IP address, browser description and a technical fingerprint of the secure connection; Cloudflare says it also uses these to improve the check. It runs nowhere else, and above all it never runs on the page a rescuer opens when they scan your tag: that page makes no outside request at all.

When you write to us

If you use the contact form, your name, your address and your message are emailed to our inbox. KINTAG is free, so messages are answered as and when we can: it can take a long time, and we promise nothing about when. Nothing is stored on the site: there is no submissions table, so there is nothing to export, erase or leak. The only record a message leaves is a timestamp against a hashed, non-identifying key, kept for one hour so nobody can flood the form. The message itself stays in our inbox until we delete it, and we do that by hand: once a month we delete every conversation that has been closed for more than 30 days, and empty the inbox's deleted folder in the same sitting. Ask us to erase a message sooner and we will, once a reply from the address you wrote from confirms it is yours.

Nine providers are involved, and here they are by name. Vercel runs the application. Supabase hosts the database. Between them they hold everything this notice describes, which is what hosting means — and they hold it in the state we hold it: the sensitive fields are the same ciphertext there that they are everywhere else, and the key that opens them is kept somewhere they are not. Supabase also checks your PIN when you sign in, and for that it keeps four things of its own: an account identifier we generate, which is not your phone number or your email; a one-way hash made from your PIN, described under “How we protect it”; a record of each session you are signed in on, with the IP address and the browser description (user agent) it began from; and its own log of sign-ins and account changes, which can include the IP address. We never show them to anyone and use them for nothing else. A session record is deleted when you sign out every other device, change your PIN or erase your account, and records older than 30 days are removed the next time you sign in. That log is kept by Supabase under its own rules and is not removed when you erase your account; what it names you by is the generated identifier, which points at nothing once your account is gone. Resend delivers the account-recovery link, the link that confirms your address, the account notices described above and, if you turn it on, the scan alert, so it handles your email address for those messages. It also carries every contact-form message to our inbox, with your name, your address and what you wrote. It never sees the emergency or health information in your account — only what you choose to write in a message. Resend keeps a copy of each message it carries for 30 days. Cloudflare Turnstile runs the cookie-less bot check on the four pages named above. It sees the visitor's IP address, browser description and a fingerprint of the secure connection, and uses them to tell people from bots and, as Cloudflare states, to improve the check — never a form field, and never anything from your tag. Cloudflare also receives the mail addressed to us, contact-form messages included, and passes it straight on to our inbox; it states that it does not read or store it. Help Scout is the inbox a contact-form message arrives in, so it holds what you wrote and the address you wrote from. Upstash keeps the counters that limit how often something can be tried — signing in, signing up, recovering an account, sending a message, opening tag addresses that lead to no tag — as scrambled keys and times. Where a counter belongs to your account (sign-in attempts, PIN confirmations, recovery links, account notices), its key is scrambled from your account's internal ID with a secret Upstash does not hold, so it cannot be matched back to you without that secret; no counter holds your name, your phone number, your email address or anything on your tag. When it is unavailable, those counters are kept in our own database instead. Sentry receives a report when our server hits an error: what went wrong and where in our code, with numbers, email addresses, codes and links removed first. It never receives your information, the address of the page you were on (only its general kind, such as “a tag page”), your IP address or anything your browser sent. PostHog, on its servers in the United States, counts visits to our public pages — the home page, sign-up, sign-in, account recovery, contact, donations, the site map and these legal pages — and never your tag's page, never your account pages, and never while you are signed in. Your browser never talks to it: our server tells it which of those pages was opened, the site you came from if it was another one, and your IP address shortened (the last block of an IPv4 address, most of an IPv6 one) so it points to a range of connections rather than to yours. Each visit is sent with a new random label that is never reused, so no two visits can be linked to each other or to you. No cookie is set for it and nothing is stored on your device. Buy Me a Coffee takes donations: it processes the payment and tells us one was made. Of what it sends, we keep only the first word of the name the supporter gave it, the payment's number, when it was made and a scrambled, one-way form of their supporter number — never their email address, the amount, the currency or their note — and we show that first word on our home page, and remove it if the payment is refunded. If a supporter asks us to take their name down, we delete it and keep only that scrambled number, so a later donation from them is not listed either. If the name was given in any unusual form, or not at all, we keep nothing. It is not involved with your account or your tag in any way. That is the whole list. None of them is on the page a rescuer opens when they scan your tag, and two can hear something about it, both only from our server: Upstash, which our server asks whether the connection opening a tag page has been opening addresses that lead to no tag — a scrambled key and a time, never which tag — and Sentry, only if our server fails while building it — a report that says a tag page failed, never which tag. Upstash has been the second since September 17, 2026. And if you turn on the scan alert, a third hears that your tag was opened: Resend, only from our server and only after the page has been served — a mail to you saying when, never who. Upstash, Sentry and Plausible joined on September 16, 2026. PostHog replaced Plausible for counting visits on September 24, 2026, and since then your browser's user-agent is no longer sent. We described Vercel and Supabase by role rather than by name until September 12, 2026, on the grounds that we were not tied to one. Naming them is the better answer: if we move, that is a change to this notice, rather than something you would have to think to ask about.

Where it is stored

Your account is held in the United States. Vercel runs the application on servers in the United States, in the Washington, D.C. area, and Supabase hosts the database in the United States, in Ohio; your browser reaches the application through Vercel's worldwide network. So your information, the health details you enter included, is stored and processed in the United States, which may be a different country from the one you live in, with different data-protection laws.

What protects it there is what protects it everywhere: the sensitive fields are stored as ciphertext, and the key that opens them is kept somewhere the database is not. That defeats someone who obtains the database alone; it does not defeat our own server, which has to decrypt to show your tag, as “How we protect it” says.

Accepting this notice when you register is your consent to that transfer: to your information, health details included, being stored and processed in the United States as described here. If you do not agree, do not create an account; if you already have one, deleting it withdraws that consent and erases the data, as “How long we keep it” describes.

How long we keep it

We keep your information for as long as your account exists. When you delete your account, it is erased from our database immediately — the whole record, not a flag that hides it.

Our database is backed up, as any database is, and a deleted account survives in those backups until they roll off. That takes at most 30 days. Backups are never used to bring a deleted account back; if we ever had to restore a backup after a failure, the deletions are re-applied. And the sensitive fields in a backup are the same ciphertext they are in the database — the key that opens them is kept somewhere the backups are not.

Your rights

These are self-serve — no request or waiting on us. Depending on where you live (for example under the CCPA/CPRA, Washington's My Health My Data Act, Québec's Law 25, Mexico's LFPDPPP, Brazil's LGPD, and similar laws across the Americas), you may have additional rights.

To ask for one of those, write to us through the contact form. We answer within 10 business days, and there is no extension. A correction you ask us for is made within 5 business days.

First we have to know the account is yours, and we can only do that one way. Everything on the list above is self-serve because it sits behind your PIN — that is the check. A message arriving by email carries no PIN, so if you write asking us to hand over or erase an account and we cannot tie the request to that account, we will refuse it. That refusal is protecting you: acting on an unverified email is exactly how somebody else would delete your account or get a copy of it. If you have lost your PIN, the recovery page gets you back in, and once you are in, every right on this list is one click away with nothing to prove.

If we refuse a request, we will say why, and you can ask us to reconsider by replying to that answer. We will look at it again and give you a decision. If you are still not satisfied, you can complain to the data-protection authority where you live; the answer we send you will not pretend otherwise.

• Access & portability: download your full account as a JSON file from your Account settings.
• Erasure: delete your account and all its data instantly, from the same screen.
• Correction: edit any field in your dashboard at any time.
• Withdraw consent: deleting your account withdraws consent and removes the data.

How we protect it

Your PIN is never kept as you typed it, here or anywhere else: our server first turns it into a keyed SHA-256 code, mixed with a secret key that is not in the database, and Supabase, which checks it when you sign in, keeps only a one-way hash of that code. Your recovery code and any recovery link are stored as keyed SHA-256 hashes, mixed with the same secret. Never in the clear, and none of them can be read back: without that secret, even a full copy of the database is no help in working out your PIN. Traffic is encrypted over HTTPS, sign-in is rate-limited, we minimize what we collect, and a scan record holds nothing but your tag and a timestamp.

The most sensitive fields are also encrypted in the database itself: your name, allergies, medications, conditions, implants, notes, weight, email and date of birth, plus your emergency contacts' names, numbers and relationships, your insurance member and policy numbers and your bike's VIN. Each value is encrypted with a key our server holds and is tied to your record, so it cannot be moved to someone else's. What this protects against, precisely: someone who obtains the database alone — a stolen backup or snapshot, or over-broad access at our hosting provider — gets ciphertext, not your information. What it does not protect against: our server itself. It has to be able to decrypt, because your tag has to open for a stranger holding a phone and no key. We would rather say that plainly than imply a protection we do not have.

Children

KINTAG is for adults: you must be 18 or older to have an account, and that is what you confirm when you register. Do not create an account for anyone under that age. If you believe a minor has an account, write to us and we will delete it.

Changes

If we change this notice materially we will publish a new version here, and a note at the top of your dashboard will say so until you dismiss it. That note tells you; it does not ask you to agree again. Your account records which version you accepted and, separately, which version you were last shown.

Who is responsible for your information

KINTAG is run by one person, not a company: the operator named in our legal notice. That person decides what happens to your information and answers for protecting it. Québec's Law 25 calls this role the person in charge of the protection of personal information, and Brazil's LGPD calls it the encarregado. Here they are the same person, and there is nobody else to hand it to.

To reach them about your information — a question, a right you want to use, a complaint — use the contact form and pick “My data” as the topic. It arrives in the same inbox as everything else, and the topic says it is about your data; there is no separate address for it. A request to use one of your rights gets the answer described under “Your rights”.

Contact

Questions or requests: write to us.