Kindlings privacy policy
Kindlings was called Spirit before its public release; this policy covers it under either name. Last updated: October 20, 2026. This is a plain-words policy, not legal advice; it's checked by someone who knows the rules before the public release.
Short version: your stuff lives on your phone. The few things that have to go online are sent only to make a feature work, and your backup, notifications and chat messages are locked so that nobody but you (and, for chat, your friend) can read them, including us. We don't sell anything about you or use trackers or analytics. Ads only play when you choose to watch one, in the Android app (see "Ads and purchases"). If you sign in to a Kindlings account (optional), your things sync between your devices locked so that only your devices can open them; Google only tells us it's you.
What stays on your phone
Everything you put in Kindlings is saved on your phone: your calendar, reminders, notes, habits, workouts, food, weight, medicine, your Clearing check-ins, your Kindlings and games, and your settings. It isn't sent anywhere unless you use one of the features below.
The Clearing (your daily check-in: how you felt, what it was about and a few words) is private like your health: it stays on your phone, and goes only into your locked backup and your locked Kindlings account sync, like your notes. It's never on a leaderboard, never shared with friends and never in a notification's words (the daily reminder only says "How was today?"). Kindlings never reads it to decide anything, and there are no ads in the Clearing.
The Clearing's journal is locked like locked notes: it opens with your screen lock, and with a Kindlings account (or automatic backup with your screen lock) its words are encrypted on your phone with the same key as locked notes, so they stay unreadable in your phone's storage, your backups and on the server. Without either, the screen lock hides it but its words are saved on your phone as usual.
Fresh start in the Clearing (a private tracker for something you're leaving behind) is kept the same way: you name it yourself, and its name is locked like the journal (encrypted with a Kindlings account or automatic backup with your screen lock). When it started, your best stretch and what it cost a day are saved with it and synced and backed up locked like the rest of your data. It's never on your profile, a leaderboard, the Today screen, a share or anything sent to friends, and its notifications only say "Milestone reached 🌱", never its name.
The Clearing's Focus timer keeps what you're working on only on the device you started it on, until it's over; its notifications say only that the focus or the break is done. Breathe and Ground me save nothing but your choices (and what you type in Ground me is never saved). The Clearing's Your glow is worked out on your phone. For its patterns the app notes, one number a day for 400 days, the last time you used it each evening and how many events your day had; they're kept with your check-ins (locked in backups and your account's sync) and never sent anywhere else. The Clearing's sounds are made on your phone, with nothing downloaded or sent. Wind down's reminder for tomorrow and good thing are saved like any reminder and your locked journal.
Chatting and playing with your Kindling (its chat at the top of Friends) happens on your phone: what you tell it and the games you play with it aren't sent anywhere, and they're kept on your phone (and in your locked backup) until you clear the chat.
Screen lock: for locked notes, or if you lock the whole app, your phone checks your fingerprint, face or PIN itself; Kindlings only gets a yes or no. The lock stays on this phone: it isn't sent anywhere or put in your backup. For the whole app it's a privacy screen for someone holding your unlocked phone: your things are saved on your phone as usual. If your phone has no screen lock at all, Kindlings can't ask for one: the app, locked notes and the journal open without it, and Kindlings says so.
Locked notes: a locked note's words (its title, text and checklist) are encrypted on your phone when you have a Kindlings account (with its key, which only your approved devices have, so they come back with your account on a new phone, by its recovery code, its passkey backup or approving from another device) or automatic backup with your screen lock (with a key only your Kindlings backup passkey opens). Each time, your phone's fingerprint, face or PIN opens them. They stay encrypted in your phone's storage, in your online backup and in a backup file you save, so someone who copies them can't read them, and a new phone opens them with the same passkey (or a recovery code made since October 10, 2026). Without backup, the lock hides the note behind your screen lock (a privacy screen) but its words are saved on your phone as usual.
Your Kindlings account (optional)
A Kindlings account is optional: Kindlings works without one. With one, you sign in with Google, and your calendar, reminders, notes, habits, health, the Clearing, Kindlings and settings are the same on your phone and laptop.
- Google only says who you are. Google's sign-in answer tells Kindlings a Google id for you, your email address, name and profile picture. The server keeps only a scrambled form of the id (a hash), never your name, picture or Google password; your email address is shown on your own devices only. On an iPhone Home Screen app, Google's answer waits on the server for at most 20 minutes until your phone collects it, then it's deleted.
- No account until you say so. Signing in with a Google account that has no Kindlings account yet asks first: "Make my account", or use a different Google account. Until you answer, nothing from your device is sent, and the server keeps only the scrambled id and your device's public keys, for at most 10 minutes (never your email).
- Your things are locked on your device before they're sent, with keys that only your approved devices have. The server stores and passes on locked records, and can't read them. It does see how many records you have, their sizes, and when and from which device they change. A locked copy is also kept each day for the last 30 days, in case something goes wrong. Something you delete is remembered (locked, without its contents) for 400 days, so every device hears about it, even one you haven't opened in a year.
- Your devices: each one makes its own keys, which can't be copied off it; the server keeps their public halves, each device's name (like "Chrome on Android") and when it was last used. A new device is approved from one you already have (a code or QR, and your screen lock). Your devices are told at once about a new device or a way back in being used. A device unused for a year signs out by itself (never your last one).
- Ways back in: a recovery code (the server keeps only a scrambled form of what proves it, and keys locked with it) and an optional passkey backup in your password manager (the server keeps its public key and keys locked with it). After using either, everything opens on that device at once, but for 24 hours it can't add or remove devices or change your ways back in, unless one of your other devices says it was you (after the passkey backup, only when another of your devices was used in the last 30 days).
- Kindlings Plus bought on a phone counts for its account, for one account only.
- Your Friends profile becomes your account's, so it works on every device; each device signs its own requests.
What goes online, and why
| What | Where it goes | Why | Can anyone read it? |
|---|---|---|---|
| Backup (only if you turn it on) | The Kindlings server (on Cloudflare) | So a lost or new phone can get your stuff back | No. It's locked on your phone before it's sent, with a key kept in your Google or Apple account and opened with your screen lock (or with a backup or recovery code). We can't open it. |
| Notifications (only if you turn them on) | The Kindlings server | So reminders arrive even when the app is closed | The words are locked on your phone; the server only knows when to send each one, under a name that doesn't say what it is (not "medicine" or "birthday"). They reach your phone through its push service (Google's or Apple's), still locked. Which kinds of friend notifications you turned off, and which chats you muted (your friends' account numbers, nothing else), are kept with them so the server doesn't send those. |
| Your town (only if you set it) | The Kindlings server, then MET Norway (weather) | For the weather | The town's spot is rounded to about a kilometre and sent with your time zone; the server asks MET Norway for that spot's forecast and keeps the latest one (asking again every couple of hours at most) so others in the same area get it too (the spot itself is forgotten once nobody has asked about it for 30 days). MET Norway never sees your phone. Searching for a town happens on your phone, in Kindlings' own list of towns: only the part of the list for the first two letters you type is fetched from the Kindlings server. |
| A food's barcode number (only when you scan or type one in Add food) | Open Food Facts, straight from your phone | To fill in the food's name and nutrition | Only the barcode number is sent (with the app's name), not your name, your food log or any picture: the camera is read on your phone. Open Food Facts sees your internet address, like any website. A food you've saved already is found on your phone without asking. |
| Your rough location (only if you tap "Use my location" in the welcome, or "Use where I am now" in More › You) | Nowhere: it stays on your phone | To find your town's name | Your phone rounds the spot to about a kilometre and finds the nearest town in Kindlings' own list of towns; only the part of the list for that area is fetched from the Kindlings server, never the spot itself. The rounded spot is then your town's spot for the weather (see "Your town"). |
| Friends profile (only if you make one in Kindlings › Friends) | The Kindlings server | So friends can find and add you | Your name (it doesn't have to be unique), your main Kindling's look, your invite code, who your friends are, friend requests and who you've blocked. Anyone with your invite code or link can see your name and Kindling (unless you've blocked them); your friends see your name, Kindling, game scores (including your highest Kindling Trials floor and your highest floor in each Tower), streaks, and on your profile your Kindlings home (your background and your Kindlings as you've dressed and named them) and your collection: which Kindlings you own with their elements, levels, cosmetics and which are Radiant (the Daily word only as colored squares, never the letters). Your friends also see your account level by your name (a number that goes up with everything you do in the app; never what you did to earn it). If you pick a title from your badges, friends see it by your name, and your profile shows up to 6 of your badges with their tiers; health badges (like food) never leave your phone. If you turn on Show to friends on the Fitness leaderboard, friends see three numbers: your weeks in a row on your workout plan, and this week's days hitting your food goal and days with your habits done (never your weight, calories, food or how much you lift); turning it off deletes them from the server. A random account id and a hash of a secret made by your phone prove it's you; there's no email or password. A public key is kept so chat can be locked. So the server doesn't have to ask every friend each time, your account also keeps a copy of what your friends and requests show you (name, Kindling, code, scores, when they were last on), refreshed a few at a time; a copy goes when they leave your lists, and all of it when you delete your account. |
| Chat messages (only with friends you add) | The Kindlings server | So your friend gets them, even when your phone is off | No. Each message is locked on your phone with a key only you and that friend's phones have, so the server stores and passes on scrambled text. It keeps the last 500 of each chat until either of you removes or blocks the other, or deletes your account. The server sees who you message and when. Each phone keeps the lock it first got for each friend, so even someone who broke into the server couldn't swap in their own; to be sure, compare the 30-number safety code (the chat's ⋯, then More options) with your friend (it's the same on both phones), and the chat warns you if the server ever sends a different lock. Workout plans, meal plans and word results you share in a chat are locked the same way (only names, foods and numbers go; never your weights, workouts or what you ate). |
| Live connection (while a chat with a friend is open) | The Kindlings server, only while connected | So messages and moves show up at once, and your friend can see you're in the chat ("Here now") | No (the messages on it are still locked). Not stored: the server only knows who has the chat open right now and whether they're on a game's page. |
| When you were last on (only with a Friends profile, and only while Show when I'm online is on in Friends settings) | The Kindlings server | So your friends see a green dot while you have the app open, and "Active 5 min ago" | Only your friends, and only those who show theirs too. Your phone says it's here about every minute and a half while the app is open; the server keeps just the latest time, to the minute (your friends' accounts keep a copy of it until their next refresh). Turning the switch off deletes it and stops it both ways. |
| Kindlings Plus membership (members only) | The Kindlings server | So the perks work and friends see the Plus badge | Your phone's random id is kept as a member, with when it was turned on. A membership bought in Google Play also keeps Google Play's purchase code (a token), the plan (monthly or yearly), when the paid time ends and whether it renews, so the server can ask Google whether it's still paid; a scrambled form of the code (a hash) points to the phone that has it, so Google Play's notices (renewed, cancelled, refunded, ended) reach it. Your Friends account (if you have one) is marked Plus so friends see the badge. |
| Friend games (only with friends you add) | The Kindlings server | So the game can be played on two phones and each move checked | No. Games are not locked: the server keeps each game's board (for Word Duel, the two secret words and every guess; for Kindling Clash, the teams you pick: Kindling types, elements, levels, moves and runes; each side's choices for a round stay hidden from the other phone until both are ready; for Gin Rummy, both hands and the pile, each phone seeing only its own hand; for Kindling Dice, the dice, which you kept and both scorecards, and the server rolls the dice; for Word Grid, the letters, when each of you started and the words each of you found, each phone seeing the letters only once you start and the other's words only once the game is over; for Chess, every move and a draw offered), whose turn it is, when the last move was made, and your wins and losses with each friend, so it can check moves and say whose turn it is. Kept until the 20 newest games of a pair are passed, or either of you removes or blocks the other, or deletes your account. |
| Trades (only with friends you add) | The Kindlings server | So two phones can swap Kindlings safely | No. Trades are not locked: the server keeps what each of you offered, who confirmed and when, so it can check you both own what you offer and swap it once. The 10 newest trades of a pair are kept, until either of you removes or blocks the other, or deletes your account. |
| Outfit gifts (only to friends you add) | The Kindlings server | So an outfit you give a friend reaches them once | No. The server keeps who it's from and which outfit until their phone has it, then deletes it, and counts how many you gave today (up to 3). The note you add goes inside your chat, locked like any message. Your profile also lists which outfits you have, so a friend doesn't give you one twice. |
| Invite eggs (only between friends) | The Kindlings server | So you and a friend you invited each get an egg, once | No. The server keeps who your first friend was (once you've had your egg), how many invite eggs you've earned (up to 3) and which friends they were for, so none is given twice; the egg waits like a gift until your phone has it. It's deleted with your Friends account. |
| Reports (only if you tap Report in a chat) | The Kindlings server | So someone can look at a problem | The last 20 messages of that chat, unlocked by your phone, with both names, codes and the time, for review. After a review, Kindlings can block a reported account (it can't use Friends or be found) or delete it, and the report is then removed; a report is deleted after 90 days at the latest. |
| Nudges (only if a friend taps Nudge and your notifications are on) | The Kindlings server | So a friend can remind you about today's Daily word, once a day | The server writes this one notification itself ("@name nudged you"), so it isn't locked like your reminders. Your Friends account remembers which phone gets your notifications while they're on. |
| Your internet address and a random phone id | The Kindlings server | Daily limits, so nobody can flood the server | Counted for the day, then deleted. The phone id is a random number made by the app, not your phone's real id. |
What we can't promise
- Someone holding your unlocked phone can see what's on it, apart from what's behind your screen lock.
- What the server has to read to work, it can read: your Friends name, invite code and friends, game moves and scores, trades and the rounded spot for weather (see the table). Your backup, chat messages, locked notes' words and notification words are locked so it can't.
- Scores and game details your friends see aren't secret from them, and a phone's own numbers (like a game score) can't be fully checked by the server.
- With a Kindlings account: the server sees how many locked records you have and when they change (not what's in them). A device you remove keeps what it already had, and chats aren't re-locked when a device is removed. Like any website, whoever controls the app's code could change what it does, so Kindlings' owner keeps two-step sign-in on every service it runs on.
Who else is involved
- Cloudflare runs the Kindlings server and stores what's described above.
- MET Norway for the weather. The list of towns comes from GeoNames and the US ZIP code database, kept on the Kindlings server; neither is asked anything.
- YouTube, only if you tap a Wonder Slowly card in the Clearing: it opens the video in YouTube, under YouTube's own rules. Until then the Kindlings server fetches the channel's newest videos and their pictures itself, so YouTube never hears from your phone.
- Open Food Facts (a free, open food database) when you scan a food's barcode. Its own privacy policy: world.openfoodfacts.org/privacy.
- The USDA's FoodData Central list of everyday foods comes with the app; finding a food by its name in Add food happens on your phone, so what you type isn't sent anywhere.
- Google for signing in to a Kindlings account (only if you use one): it tells Kindlings who you are. Its own privacy policy: policies.google.com/privacy.
- Google or Apple: your passkeys (for backup and the screen lock) are kept by your phone's password manager, and notifications pass through their push service, locked. In the Kindlings Android app, notifications from the Kindlings server (friends, your account) pass through Google's Firebase Cloud Messaging, locked so Google can't read them; your reminders are set on the phone itself and don't leave it.
Ads and purchases
Kindlings offers optional gem packs, a one-time starter pack and the Kindlings Plus membership (monthly or yearly) in the Kindlings Android app, through Google Play. In the Android app you can also choose to watch an ad (for a gem in the shop, or to double the coins from a game); an ad never plays unless you tap to watch one, and there are none on the website, in the Clearing or anywhere else.
- Purchases are paid through Google Play; we never see your card, your name or your Google account. Google Play gives the app a purchase code (a token); the Kindlings server sends it to Google to check that the purchase is real and paid, and confirms it to Google, and then the app puts your gems in your wallet. The server keeps only a scrambled form (a hash) of the purchase code with your phone's random id, for a year, so that if the purchase is refunded the gems can be taken back on that phone (the wallet can go below zero until it's earned back); Google keeps the purchase under its own privacy policy. The app keeps a short mark of each purchase in your game (in your backups and your account's sync), so the same purchase is never given or taken back twice.
- Kindlings Plus is a Google Play subscription. The app gives the server its purchase code with your phone's random id; the server checks it with Google and keeps it with the membership (see the table above), and Google Play tells the server when it renews, is cancelled, refunded or ends. When you buy, Google Play gets a scrambled form (a hash) of your phone's random id, which Google uses only to spot fraud. You cancel or change it in Google Play; you keep Plus until the end of what you paid for.
- Ads come from Google AdMob, and only when you tap to watch one. To show an ad, Google's ad code in the app collects what Google lists for it: your phone's advertising ID and app set ID, your internet address (and from it a rough location), the phone's model and settings, and how you used the ad (watched, skipped, tapped); Google uses them under its own privacy policy (https://policies.google.com/technologies/ads), including to measure ads and stop fraud. You can reset or delete your advertising ID in your phone's settings (Google › Ads). In the European Economic Area, the UK and Switzerland you're asked first, the first time you watch one, whether Google may use your data for personalized ads; "Do not consent" still lets you watch ads, just not personalized ones, and More › About › Ad choices changes your answer. Ads are limited to ones suitable for teens (parental guidance at most).
- Checking an ad was watched: before the app gives an ad's reward, Google tells the Kindlings server the ad was watched, with your phone's random id and a one-time number the server gave for that ad. The server keeps only the number and its kind (gem or double) for an hour, and when each ad was started for a day, so nobody can fake ads or watch more than the daily limit; nothing else about you or the ad. The rest of the app never sends anything to Google's ad code.
How long it's kept
- Backup: the last 7 daily copies, until you turn backup off or delete everything. If you stop using Kindlings without doing that, the locked copies stay until you open the backup on a phone and turn it off.
- Notifications: only upcoming ones; sent ones are forgotten after two days. If Kindlings isn't opened for 2 years, the phone's notification sign-up is deleted too.
- Friends profile: until you delete it (or delete everything). Chat: the last 500 messages of each chat. Games: the 20 newest per pair of friends. Trades: the 10 newest per pair. All of these go when either friend removes or blocks the other, or deletes their account; a deleted account also disappears from its friends' phones (with the chat and games kept there) the next time they open Friends.
- Reports: until they're reviewed, and never more than 90 days.
- Kindlings Plus: your phone's random id is kept as a member while you're a member. A Google Play membership's purchase code and dates go when it ends for good (it ran out or was refunded, or moved to another phone); while a payment is being retried, it's kept, turned off, so it can turn on again.
- Gifts from Kindlings (sent to your Friends account) wait on the server only until your phone has them.
- Kindlings account: until you delete it. Your locked records stay while the account exists; the daily copies are the last 30 days; deletes are remembered 400 days. Deleting the account takes 7 days when it's asked from one of your devices (or after signing in with your passkey backup or recovery code), and 30 days when it's asked with only Google's sign-in (so a mistake, or someone else, can be undone from any of your devices), then everything of it on the server is deleted. What's already on your own devices stays there (it's yours) until you clear them.
- Daily counts (to stop abuse: new profiles, friend requests, server use) are deleted the next day.
Deleting it
- More › Your data › Clear this phone deletes everything on your phone (your data, settings, name, town, screen lock and notification sign-up), but keeps your online backup and Friends account, so you can restore them. With automatic backup off, your Friends account is deleted too, since nothing could open it again.
- More › Your data › Delete everything, here and online deletes everything on your phone and online: the backup and its passkey, your notifications, and your Friends account (friends, chats and games). If your phone is offline, the online copies are deleted as soon as it's back online. Neither cancels a Kindlings Plus membership, which is through Google Play.
- Automatic backup › Turn off deletes the online backup.
- Notifications › off stops them and removes your phone from the server's list.
- Kindlings › Friends › settings › Delete my account deletes your Friends profile, friends, requests, blocks, chats, games and trades from the server, and takes you off your friends' lists.
- Your Kindlings account: More › You › Kindlings account › Delete my Kindlings account (with your screen lock). Seven days later everything on it is deleted: its locked records and daily copies, its Friends profile (friends, chats and games), its devices, its ways back in and its scrambled Google id. Your devices are told (a notification where they're on, and on Today when you open Kindlings) and any of them can tap Keep my account until then. Lost every device and your recovery code? Sign in with Google on any device and tap Can't get in at all? Delete this account: Google's sign-in alone can delete your account, never open it, and then it waits 30 days (any of your devices can stop it). With your passkey backup or recovery code, sign in with it first and delete from the account page: 7 days. On a signed-in device, Clear this phone and Delete everything only take that device off the account; the account keeps everything.
- Without the app (a lost phone, for example): see Delete my account, or email us (below) with your Friends name and invite code.
Keeping Friends safe
If someone reports a chat, Kindlings' owner reviews it and can block an account (it can't use Friends or be found) or delete it. Blocking someone yourself stops them from finding or messaging you.
See also the terms of service.
Children
Kindlings isn't made for children under 13. Making a Friends profile asks you to confirm you're 13 or older.
Changes and contact
If this policy changes, the app will say so. Questions or requests: hello@kindlings.app.