Security

How we keep your family’s data safe

Kithful holds the everyday details of a family: schedules, shopping, kids’ chores, doctor visits. Here is, in plain words, what protects them. It’s a summary; the Privacy Policy covers what we collect and why.

Your household is walled off from every other one

Every family’s data lives in its own household. Every read and write the app makes is limited to the household that’s signed in, so one family can never see another’s calendar, lists or notes. Family members who share a household each get their own login.

We don’t sell your data and there are no ads in the app.

Signing in

• Passwords are never stored. We keep only a bcrypt hash, a one-way scramble that can’t be turned back into your password.
• Guessing is slowed down. Sign-in attempts are rate-limited, so a script can’t try thousands of passwords.
• Google and Apple sign-in are checked against the provider’s signed token before we trust who you are.
• Reset and confirmation links work once, expire (a password reset in an hour), and are stored only as a hash.
• One login per email address, so a reset email always goes to exactly one account.
• Your session cookie can’t be read by scripts on the page, is sent only over HTTPS, and isn’t sent when another site tries to post a form to Kithful behind your back.
• Changing or resetting your password signs you out everywhere else, and so does changing your account email, which also needs your current password (or, for a Google or Apple-only login, a tap on a link sent to your current address) and tells your old address.
• Removing a family member ends their access right away, on every device.

A code by email on a new device

When someone signs in with the right password on a phone or computer we haven’t seen, we email a one-time 6-digit code to the account’s confirmed email address, and the sign-in doesn’t finish without it. So a stolen password alone isn’t enough to get in. After the code, that device is trusted for 30 days.

• Each code works once and expires after 10 minutes.
• Five wrong tries and that code stops working; only a few codes can be sent an hour, so guessing goes nowhere.
• The email says which kind of device asked, so a code you didn’t ask for is your warning to change your password.
• Signing in with Google or Apple, or through a password-reset link, already proves the inbox, so those skip the code.
• You can see your trusted devices in Settings and forget them all if a phone is lost.

A login with no confirmed email address can’t get a code, so we ask everyone to add and confirm one in Settings.

Photos are read, then thrown away

When you snap a receipt, flyer or schedule, the photo is held in memory just long enough for our AI service (Google’s Gemini or Anthropic’s Claude) to read it, then discarded. We don’t store your scanned photos, only the details you confirm. Nothing read from a photo is saved until a person in your family checks it. The only photo kept is one you choose to save with a recipe (the picture of the dish).

Kids aren’t accounts

Children in Kithful are names a parent adds, not accounts. They have no email address or password, and Kithful never asks them for personal details. Kid Mode runs inside a parent’s household; each kid can have a 4-digit PIN, and a tablet can be locked to Kid Mode with a parent PIN so it can’t reach the grown-up side. Wrong PIN guesses lock it for longer each time.

Payments

Kithful Plus is paid through Stripe’s own checkout and billing pages. Card numbers never touch our servers or our code. Stripe tells us about a payment with a signed message we verify before we act on it, and only our server can change a household’s plan.

In your browser

• Every connection is HTTPS, and browsers are told to never use plain HTTP for kithful.app.
• A Content Security Policy limits where scripts, images and styles can load from.
• Other sites can’t show Kithful inside a frame, and every change (a save, a delete) must come from Kithful itself.
• The camera is allowed only for Kithful’s own barcode and photo capture; the microphone and your location are switched off.

Your data, your call

From Settings you can download everything your household has stored as one file, or delete the household and all of its data. A deleted household is removed, not hidden.

Found a problem?

Please tell us privately at [email protected] with the steps to reproduce it. We read every report and fix real issues as fast as we can. There’s no paid bug bounty yet. Our contact is also published at /.well-known/security.txt.

What we don’t claim

Last updated 2026-10-08. Kithful isn’t affiliated with the apps named here; their names belong to their owners.