Privacy policy
This policy applies to the Krypton app and krypton.today (the “service”), operated by Fantagram Inc. (“we”). It sets out what we receive, what we don’t, and what we can’t read. The rules for using the service are in our Terms of use.
At a glance
- We don’t take your phone number or email to sign up or sign in. Your account is created and signed in with a key that stays on your device.
- Names, bios and photos, and posts, replies and videos, are sealed on your device before they reach our servers. Neither the servers nor our staff hold the keys to open them.
- The servers do know how account numbers are linked to each other (the connection map), and surface details such as who sent what to whom and when.
- Our staff see only what is reported and join requests sent directly to the Krypton team. A reported item is opened to us by the reporter’s device.
- Krypton+ payments are handled by the app store. Your card number and Apple ID never reach us.
- We don’t run ads, sell personal data or use it for tracking.
1What we don’t receive
- A phone number, email address or any government ID number for signing up or signing in (if you email us, we do receive that email — section 2)
- Your address book, location, or advertising identifier
- Your recovery PIN itself (we keep only a derived value used to check it — section 2)
- The name carried in an invite link, an invite-request link, a QR code or a fam link (it sits after the # in the link, so it never reaches the server). An invite link’s secret doesn’t reach the server either. For an invite-request link, a fam QR code or a fam link, the app of the member who opens it sends the server only a check key derived from the secret, so it can be checked against the derived value the server already holds — the secret itself doesn’t reach the server (links and QR codes made with an earlier version of the app send the secret). The server doesn’t store it.
- Which web addresses you preview (your own device fetches the link preview directly — section 3)
- Payment details such as your card number or Apple ID (Krypton+ payments are handled by the app store — section 2)
Permissions the app asks for (all optional)
- Camera
- When you scan a fam QR code or an invite-request QR code. What the camera sees is read only on your device; it isn’t saved or sent.
- Photos
- When you choose photos or videos for a post or your profile, and when you save a photo or video to your photo library (saving asks only for permission to add). Only what you choose is resized and sealed on your device before upload.
- Notifications
- To receive notifications.
If you don’t allow a permission, you can still use everything in Krypton except that feature, and you can turn permissions off at any time in your device settings. The app doesn’t ask for microphone, location or contacts access.
2What the servers know
These are things the servers need to know for the service to work. They are not sealed. Emails to us, in the last row, come to our mailbox rather than the servers.
- Account number
- A random number created when you join. It isn’t tied to your name.
- Public keys
- Your account’s signing and encryption public keys, each device’s public key and certificate.Sign-in, checking who sent something, sealing things to you
- Membership status and number
- Pending, full member or suspended; your role (founder, Krypton team, member and so on); the order in which you became a full member; your Krypton+ periods — the period you bought and any period given by a founder (including who gave it).Joining, deciding Krypton+ features (number of photos, video length, original quality, scheduled posts)
- Connection map
- Who is fam with whom; who invited whom and became their backer; who was trusted to invite by whom; fam requests and introductions and their answers (accepted or passed); who shared how many past posts with which new person in their fam; and when each happened.Working out who receives a post, joining with backers, sharing past posts with each person only once
- Post metadata
- Author, time posted and edited, audience (fam, chosen people, only me), who received an envelope (who can open the post), scheduled time, disappearing time, whether chat is closed and when it was closed or reopened, a mark that the post was sent to chosen people (passing it along is blocked), the people in each chat (at first the author and the person replying, then anyone invited in) and when they joined and left, each chat’s message count and times, a mark that a post was received through a chat invite and how many steps away it came (who invited whom isn’t recorded separately — the line the inviter sends into the chat is kept like any other reply, with only its writer and time), who passed a post to whom, for a note whose page it’s on and when the page owner hid it, and the size, dimensions and length of photo and video files.Delivery, sending replies only to the people in the chat, update order, scheduled and disappearing posts, storing files
- Invitations
- The inviters (two people, or one person who may invite alone), status, expiry, a check value made by mixing the name written on the invitation with a value that exists only in the link (the server can’t learn the name from it alone), and the number of wrong name entries (after five, the invitation is cancelled).
- Invite requests
- The requesting account, a value derived from the link secret, status (waiting, accepted, “I don’t know them”, withdrawn, ended), the member who answered, the invitation attached, creation time and expiry (7 days). For a request to the Krypton team, a sealed introduction that only the team account’s key can open is added, along with signs used to spot abuse of sign-up — how many accounts were started from the same place on the same day, and how long it took from creating the account to sending the request.Attaching the invitation of the member who answered to the person who asked, screening requests to the Krypton team
- Sign-up start records
- When someone starts signing up without an invitation: a check value made by mixing their IP address with a key that changes every day (not the IP address itself), and how many sign-ups were started with that check value that day. No account number or time is recorded. Records older than two days are deleted automatically every day.Stopping mass account creation, screening requests to the Krypton team
- Meeting in person (QR) and fam links
- The number of your QR code or fam link and a value derived from its secret (a QR code works for only 5 minutes; a fam link works once, within 24 hours), the accounts that sent you a fam request with it and when, and when a fam link was first opened (not who opened it — used to count how many links you can send a day). Deleted one day after expiry. The request itself stays in the connection map.Adding fam by QR code
- Who sees your card, and handed cards
- Which of Fam only, Up to 2nd or Everyone you chose for your card, and when you last changed it — the servers know this because they need to know who to give it to (they don’t know what it says). For a card you handed over (section 3): whose card it is, who it went to (or, for a link, which link it’s attached to), and when — even if that person is within your range.Giving your card only to the range you chose (your fam; your fam plus people in your 2nd degree, that is, your fam’s fam; or every member) and to the people it was handed to
- Blocks and reports
- Who blocked whom; who reported what, for which reason, and the report’s status.
- Notifications
- Your device’s push token, device type, notification language (Korean, English, Japanese), per-type on/off settings (chats, screenshots and saved photos, requests), and a log of notifications sent (recipient account, type, time, whether delivered). Notifications about a request to recover your account can’t be turned off.
- Settings
- Whether “Show my past posts” to new fam is on or off.Sharing past posts
- Screen capture attempts and saved photos and videos
- Who tried to capture whose screen, where (chat, person page, post, updates), and when. Who saved a photo or video from which of someone’s feed posts to their photo library (each post is recorded only once; saving chat photos isn’t recorded).To let the owner of that screen or post know
- Devices
- Each device’s last sign-in time and whether it has been removed.
- Recovery
- Only if you set it up — a sealed backup, the server’s share, a derived value to check your PIN with the number of wrong tries and any lock time, who in your fam holds key pieces, and the status of recovery requests. A recovery link is stored only as a value mixed with a secret key that only the server holds (HMAC), and is erased three days after the request ends.The server can’t open the backup on its own; the pieces your fam hold are needed
- Krypton+ purchases
- If you buy Krypton+: the store (Apple or Google), transaction number, product, the end of the current period (a lifetime pass has no end), when it was refunded or cancelled, and whether it was a live or test purchase. When you buy, your account number is attached to the transaction so the purchase the store confirms can be linked to your account. Payment details such as your card number or Apple ID are handled by the store; we don’t receive them.Working out your Krypton+ period and reflecting renewals and refunds, stopping one purchase being used by another account, keeping transaction records as the law requires
- Emails to us
- When you email support@krypton.today or privacy@krypton.today: your email address, the message and anything attached (such as proof that you hold rights, or screenshots that identify a post). The same applies to infringement or removal requests from people who aren’t members.Answering questions; handling appeals, infringement, removal, withdrawal and data-rights requests
3What we store sealed
These are sealed on your device and then sent to us. Neither the servers nor our staff hold the keys to open them.
- Your name, bio, profile photo and backers shown on your card (backers are carried as account numbers only, without their names)
- Posts, replies, notes, photos and videos (files are stored as ciphertext)
- Link previews — made by the writer’s device and sealed with the post
- Notes left with an introduction, and the reason written when passing a post along
- The name written on an invitation, device names
- Your card, sent when you ask someone to join your fam by QR code or fam link — only the owner of that QR code or link can open it
- Handed cards — so that your name also reaches people outside the range you chose for your card, your device seals your card so only that one person can open it: the person you ask to join your fam; in a chat, each person who hasn’t received your card yet; and when you save a photo or video from a feed post or capture a screen and its owner is told, that owner
- Your card attached to your QR code or fam link, and the name and one-line bio of the person asking in an invite-request link — sealed with a key derived from the secret after the # in the link. The servers never receive that secret, so they can’t open it; only members who open the link can
- The names of the people a passed-along post came through — the person passing it along seals their own name and the names they know of those before them with that post’s key. Only people who receive the post can open them
- The name, one-line introduction and “who will you use it with” in a request to the Krypton team — only the team account’s key can open them (on the team’s device, or in a staff-console page where that key has been unlocked)
- The line carried in a chat notification — only the recipient’s device can open it
- Who invited whom to a chat — a line the inviter’s device seals and sends into that chat. Only the people in the chat can open it
What sealing doesn’t mean
- Recipients can read it. A post opens on each recipient’s device and may stay there. Recipients who are Krypton+ members can save photos and videos to their photo library, and saved copies are outside the seal.
- Reports are opened to us. The reporter opens that post or card to us (section 8).
- The Krypton team reads requests sent to it. The team opens the name, introduction and “who will you use it with” in the request and decides whether to accept (section 8).
- A card set to Everyone is visible to every member. By default your card is sealed only to each person in your fam and in your 2nd degree, one by one; if you choose Fam only, only to your fam. If you choose Everyone on My page, it’s also sealed with a key every member holds (the member key), so anyone who becomes a member can see it. The servers know which you chose (section 2). Cards uploaded with an earlier version of the app stay sealed with the key every member holds (the member key) until the app is updated and uploads them again.
- Metadata isn’t sealed. The servers know what’s in section 2. Posts are padded to set sizes to hide their length, but the size of photo and video files is visible.
When a link preview is made, the writer’s device connects to that site directly, so the site sees the writer’s connection. Recipients’ devices don’t contact the site unless they tap the link.
4Records created automatically
- IP addresses — we don’t record them in our database or server function logs. The one exception is the check value made when someone starts signing up without an invitation: the IP address is mixed with a value used only that day, and records older than two days are deleted automatically every day (section 2). IP addresses, request times and request addresses do appear in the platform logs of Supabase, our server provider (the addresses our server functions use to query the database can contain account numbers), and are deleted after 7 days. Cloudflare processes IP addresses while delivering photos, videos and web pages; those records follow Cloudflare’s privacy policy and the periods Cloudflare sets. Observability logs for the Cloudflare Worker in front of file storage are turned off.
- Notification log, last sign-in per device, screen capture attempts and saved photos and videos, sign-up start records — section 2
The “new message” and “typing” signals in an open chat pass through the server (Supabase Realtime) only to the people who were in that chat when they opened it. When someone leaves a chat, the app closes that connection; until then, signals can still reach a connection that was already open. The signals carry no content, and the signals themselves aren’t kept.
The app contains no analytics, advertising or crash-reporting tools.
5Purposes and legal bases
We use personal data only for the purposes below. For each purpose we list the information used and the legal basis.
- Providing the service
- Joining (two backers, invite requests, requests to the Krypton team), sign-in, delivering posts, replies, photos and videos, adding fam (including in person by QR code) and introductions, passing posts along, inviting fam to a chat, sharing past posts with new fam, scheduled posts, disappearing posts, recoveryInformation used — account number and public keys, membership status, connection map, post metadata, sealed content, invitations and invite requests, QR codes, settings, devices, recoveryLegal basis — performance of a contract (Korea’s Personal Information Protection Act (PIPA) Art. 15(1)(iv); GDPR Art. 6(1)(b))
- Notifications
- Telling you something is waiting, a new chat, someone new in your fam, a screen capture attempt, that your photo or video was saved, or a request to recover your account. Notifications carry no names or content.Information used — push token, device type, notification language, notification settings, notification logLegal basis — performance of a contract (PIPA Art. 15(1)(iv); GDPR Art. 6(1)(b))
- Providing Krypton+
- Confirming purchases, reflecting renewals, cancellations and refunds, stopping one purchase being used by another account, managing Krypton+ given by a founder, deciding limits on number of photos, video length, original quality and scheduled postsInformation used — Krypton+ purchase records, membership status and Krypton+ periodsLegal basis — performance of a contract (PIPA Art. 15(1)(iv); GDPR Art. 6(1)(b))
- Safety and operations
- Handling reports, blocking, restricting accounts, stopping mass creation of accounts without invitations, screening requests to the Krypton team, telling the owner of a screen or post about capture attempts and saved photos and videos, keeping a log of staff actions, answering questions and handling appealsInformation used — block and report records, sign-up start records, screening signs on invite requests, capture and save records, staff action log, emails to usLegal basis — legitimate interests (PIPA Art. 15(1)(vi); GDPR Art. 6(1)(f)): protecting members and the service from abuse, and letting the owner of a screen or post know
- What the law requires
- Keeping purchase records, responding to legal requests, reporting child sexual abuse material, handling removal requests for infringing posts, withdrawals and data-rights requestsInformation used — Krypton+ purchase records, the information in section 2, report copies, emails to usLegal basis — legal obligation (PIPA Art. 15(1)(ii); GDPR Art. 6(1)(c))
We don’t use personal data for any other purpose, such as advertising, sale or profiling.
- We don’t process any information on the basis of consent. The camera, photos and notifications are used only when you allow them on your device, and you can turn them off at any time in your device settings.
- The information in section 2 is needed for the service (recovery and Krypton+ purchases only if you choose them, and emails only if you send them). Without it you can’t use Krypton.
- You can object to processing based on legitimate interests (section 13).
We don’t receive or separately collect sensitive information such as health, beliefs or political opinions. The connection map knows only who is linked with whom — not people’s professions or the nature of their relationships.
6What other members see
- Fam and people in your 2nd degree
- Your card — name, bio, backers and a blurred (mosaic) profile photo. By default your card opens only for your fam and people in your 2nd degree, or only for your fam if you choose Fam only. A backer appears by name only when the viewer can open that backer’s card.
- All members (card set to Everyone)
- If you choose Everyone with the small button at the top left of your card on My page (Fam only · Up to 2nd · Everyone), every member sees your card. The default is Up to 2nd (founders start with Everyone). If you narrow it, the servers immediately delete what was open to the wider group — what was wrapped with the key every member holds and, for Fam only, the envelopes of people who aren’t your fam — and your device seals your card again with a new key (a card uploaded with an earlier version of the app closes when your device reseals it). What was already seen while it was wider can’t be undone (section 15).
- People in your 2nd degree
- A half-blurred profile photo. If you choose Fam only, this photo doesn’t open for people in your 2nd degree.
- Fam
- Your full profile photo and the posts you share with “Fam”
- The page owner’s fam (notes)
- A note you leave on another member’s page is seen by that member and their fam — your name is sealed in with it. Your device seals it only to the page owner and you; when the owner opens the app, their device seals it again to their fam. The servers take out the envelope of anyone who stops being the owner’s fam, or who blocks or is blocked by the writer or the owner, right away; the envelope of anyone suspended or no longer a member is taken out when the owner’s device next checks (what was already seen can’t be undone). A note the owner hid stays hidden even if the writer deletes it and writes again. It’s fam only, whatever the owner’s card is set to. The owner can hide or delete notes on their page. Notes written before this change, or with an earlier version of the app, stay sealed to the writer’s fam and aren’t sealed again.
- Chosen recipients
- The post and a “Selected” mark showing it was sent to them in particular. They can’t see who else received it. The author sees the list of recipients.
- New fam
- Up to 30 of the posts you shared with “Fam” in the last 30 days. You can turn this off with “Show my past posts” in Settings.
- People in a chat
- A reply to a post is seen only by the people in that chat. At first that’s the author and the person replying; if someone in the chat invites someone in their fam, the invited person sees the post and the replies from when they joined. People in a chat see who’s in it, who invited whom, and who joined or left. Anyone who leaves or is removed keeps the replies they received while they were in it. Only the author knows who sent a heart to the post.
- People a post is passed to
- If a recipient passes your post along to someone in their fam, that person sees it too. They also see the names of the people the post came through — names sealed and attached by whoever passed it along. Posts sent to chosen people and “Only me” posts can’t be passed along.
- The owner of a screen
- If you try to capture someone’s chat, page or post, they get a notification and your name appears in their updates.
- Authors (saving)
- If you save a photo or video from a feed post to your photo library, the author gets a notification and your name appears in their updates. Saving chat photos doesn’t notify anyone.
- The owner of a QR code or fam link
- If you scan a QR code or open a fam link and send a fam request, only its owner sees your card.
- Members who open your link
- Members who open your QR code or fam link see your card; members who open an invite-request link you sent see your name and one-line bio.
- People you hand your card to
- The person you ask to join your fam, the people in a chat with you, and the owner of a post whose photo or video you save or of a screen you capture see your card even if they’re outside the range you chose (section 3).
- The Krypton team
- If you ask the Krypton team to join, the team sees the name, introduction and “who will you use it with” in your request (section 8).
By default your card is visible only to your fam and people in your 2nd degree, but if you choose Everyone or hand it to someone further away, others see it too. Don’t put sensitive things such as health or beliefs on your card. For posts, you choose who sees them with the audience setting (fam, chosen people, only me).
7Retention and deletion
Each kind of information is kept for the period below and deleted when that period ends. Traces of relationships no longer in use are deleted automatically once a day.
- Removed fam
- 30 days after removal
- Unanswered requests and introductions
- 30 days after the last activity
- “Pass” records
- 180 days
- Unused invitations
- 30 days after expiry or cancellation (an invitation used to join stays with the backer record)
- Sign-in challenges
- 1 day after expiry
- Handled reports
- Once handling is finished and 180 days have passed since the report (open reports are kept; reports the law requires us to keep — for example, those reported to the U.S. NCMEC, for 1 year from that report — are kept for that period)
- Screen capture attempts and saved photos and videos
- 30 days
- Notification log
- 30 days
- Disappearing posts
- 24 hours (from when the post appears if chosen when writing, or from when it’s chosen later). The post, chat and photo records are deleted within a minute, and photo and video files are removed from storage shortly after.
- Sign-up start records (IP check values)
- Two days (deleted automatically every day)
- QR codes, fam links and their requests
- One day after expiry
- Handed cards
- A card handed with a fam request is deleted as soon as the request ends (accepted, passed, cancelled, blocked or removed from fam), and any left over are deleted daily once 30 days old. A card attached to an invite-request link — when the request ends (expired ones in the daily cleanup); to a QR code or fam link — with the code, one day after expiry; handed in a chat — when that person leaves or is removed from the chat, or when the post is deleted; carried in a save or capture record — with that record, after 30 days.
- Recovery link check values
- Three days after the recovery request ends
- Invite requests, records of shared past posts
- While you use your account (deleted along with your account — see section 12)
- Records of joining and leaving chats
- While the post exists (deleted along with the post, including when it disappears)
- Krypton+ purchase records
- 5 years from the transaction (the period Korea’s Act on the Consumer Protection in Electronic Commerce sets for payment records). Records of a pass still in use (a lifetime pass that hasn’t ended) are kept for as long as that account exists.
- Emails to us
- 3 years after we finish handling them (the period Korea’s Act on the Consumer Protection in Electronic Commerce sets for complaint and dispute records)
- Staff action log
- Kept unalterable for 3 years from the action, then deleted
- Everything else
- While you use your account. What is deleted and what remains after you delete it is set out in section 12.
When a retention period ends or the purpose is fulfilled, we delete the information without delay. We delete the database rows and remove photo and video files from storage so they can’t be restored. Deleted information stays in the production database’s daily backups for up to 7 days before it’s gone (backups are used only to recover from failures). Purchase records kept because the law requires it are stored apart from other information and used only for that purpose.
8Reports and what we can open
We can’t see posts as they are shared, and we have built nothing that would let us. Instead, when someone reports, the reporter’s device opens the reported item to us.
We look at reported items to deal with breaches of our terms and unlawful content, and to take the action the law requires (section 5 — legitimate interests and legal obligation).
- A reported post or reply
- We see that post or reply as it was when reported, its photos and videos (if the files still exist), and the author’s name. If a disappearing post vanishes or the post is later deleted, the sealed copy from the time of the report stays with the report.
- A reported person
- We see that person’s card (name, bio, blurred photo). The full photo isn’t sent.
- A request to the Krypton team
- The team account’s key (on the team’s device or in the staff console) unseals the name, one-line introduction and “who will you use it with”, and the team also sees how many accounts were started from the same place on the same day and how long it took from creating the account to sending the request. The team uses this to decide whether to accept. When a new request arrives, we email staff only the number of waiting requests and the staff-console address — no names or introductions.
- Metadata we see alongside
- The account numbers of the reporter and the reported person, the reason and the time. For each account: status, role, join and deletion times, member number, Krypton+ period, number of people in their fam, number of backers, number of devices and number of reports. No names.
- Staff action log
- Who took which action (suspending, lifting a suspension, handling a report, a founder giving or withdrawing Krypton+), on which account, when, and with what note — kept for 3 years from the action so it can’t be changed or deleted (section 7).
- What we don’t see
- Posts that weren’t reported, and that person’s other posts and chats
When we take action, we tell the reported member the reason (until in-app notices are ready, they can ask support@krypton.today). We don’t tell them who reported. Appeals follow the process in section 6 of the Terms of use.
Because we can open report copies, they may be provided together with the report record when there is a legal request (section 9).
Handled reports are deleted once handling is finished and 180 days have passed since the report (open reports are kept; reports the law requires us to keep — for example, those reported to the U.S. NCMEC, for 1 year from that report — are kept for that period; section 7). The reporter’s account number stays on the record, so misuse of reporting is visible.
9Disclosure to third parties
We don’t sell personal data or hand it to other companies for advertising or marketing. We disclose it only in these cases.
- Legal requirements — we check that a request follows the procedure the law requires, such as a warrant, and provide only what is needed. All we can provide is what the servers know (section 2) and report copies opened to us (section 8); we can’t open other sealed content either. Where the law allows, we tell the member concerned.
- Reporting child sexual abuse material — if we find child sexual abuse material, we report it as the law requires to the U.S. National Center for Missing & Exploited Children (NCMEC) and the relevant authorities, together with the content and related account information.
- Imminent danger — when there is a clear and imminent risk to someone’s life or safety, we give the relevant authorities, such as the police, only what is needed to prevent it.
- Krypton+ payments — when a member buys Krypton+, their account number (a random number) is passed with the transaction to the store that processes the payment (currently Apple; Google Play payments on Android are still being prepared). From the store we receive only the transaction number, product, period and whether it was refunded. The store handles payment details under its own privacy policy.
10Service providers
We use the companies below to run the service. They handle sealed ciphertext, the information in section 2, and connection details while delivering data.
- Supabase, Inc.
- Database, server functions, Realtime (live signals in chats)
- Cloudflare, Inc.
- Storing and delivering photo and video files (ciphertext) — R2 and Workers. Delivering the krypton.today website and the invite, invite-request, QR and fam link pages — Pages. Forwarding email sent to support@ and privacy@krypton.today to our mailbox — Email Routing
- Zoho Corporation
- Our mailbox — stores the questions and requests emailed to support@ and privacy@krypton.today
- Apple Inc.
- Delivering iPhone notifications (Apple Push Notification service). We pass the device push token and the notification text, which carries no names or content. Chat notifications also carry a line sealed so only the recipient’s device can open it; Apple sees only ciphertext. Apple knows which device a token belongs to.
- Google LLC
- Delivering Android notifications (Firebase Cloud Messaging). We pass the device push token and notification text with no names or content. Chat notifications also carry a line sealed so only the recipient’s device can open it; Google sees only ciphertext. Google knows which device a token belongs to.
We have data processing agreements with these companies so that they don’t use the information outside the work we give them and protect it to a standard equal to or higher than this policy. They pass work on to other companies only as those agreements allow. If the companies we use change, we’ll update this policy and let you know.
Krypton+ payments are processed by the store under its own responsibility, so they are covered in section 9 rather than here.
11International transfers
While you use the service, information is transferred over the network, whenever needed, to the countries below to be stored and processed. All transfers use encrypted connections (HTTPS).
- Fantagram Inc.
- CountryUnited States, South Korea
- When and howWhen our staff sign in to the staff console over an encrypted connection to run the service and handle reports
- ItemsInformation in section 2, report copies, requests to the Krypton team
- PurposeRunning the service, handling reports, reviewing join requests
- RetentionSection 7
- Contactprivacy@krypton.today
- Supabase, Inc.
- CountryStored in Seoul, South Korea (AWS); the company is in the United States. Server functions run, only while processing, in the Supabase region closest to where you use the app, which is in one of these countries: South Korea, Japan, Singapore, India, Australia, the United States, Canada, Brazil, Ireland, the United Kingdom, France, Germany or Switzerland.
- When and howEvery time you use the app, over an encrypted connection
- ItemsInformation in sections 2 and 3 (section 3 as ciphertext)
- PurposeDatabase, server functions, live signals
- RetentionSection 7 (deleted information stays in backups for up to 7 more days)
- Contactprivacy@supabase.com
- Cloudflare, Inc.
- CountryFiles are stored in a data center Cloudflare places in the Asia-Pacific region (Cloudflare doesn’t disclose the country and doesn’t guarantee the region) and delivered through Cloudflare data centers worldwide close to the user. Headquarters in the United States
- When and howWhen you upload or download photos and videos, and when you open krypton.today
- ItemsPhoto and video ciphertext, IP addresses while delivering
- PurposeStoring and delivering files, providing the website
- RetentionFiles until the post is deleted; access records for the period Cloudflare sets
- Contactprivacyquestions@cloudflare.com
- Apple Inc.
- CountryUnited States
- When and howWhen we send a notification to an iPhone, and when you buy Krypton+
- ItemsPush token, notification text with no names or content, the sealed line in chat notifications, and the account number attached to a Krypton+ purchase (section 9)
- PurposeiPhone notifications, linking Krypton+ payments to your account
- RetentionWhile delivering for notifications; transaction records under Apple’s privacy policy
- ContactApple privacy contact
- Google LLC
- CountryUnited States
- When and howWhen we send a notification to an Android device
- ItemsPush token, notification text with no names or content, the sealed line in chat notifications
- PurposeAndroid notifications
- RetentionWhile delivering
- ContactGoogle privacy contact form
- Cloudflare, Inc. (Email Routing)
- CountryCloudflare data centers around the world, near the sender. Headquartered in the United States
- When and howWhen you email support@ or privacy@krypton.today, while it is forwarded to our mailbox
- ItemsSender’s email address, the name and content you write in the email
- PurposeForwarding questions and requests to our mailbox
- RetentionHandled only while forwarding, not stored. Delivery logs for the period Cloudflare sets
- Contactprivacyquestions@cloudflare.com
- Zoho Corporation
- CountryUnited States
- When and howWhen a question or request arrives in our mailbox
- ItemsSender’s email address, the name and content you write in the email
- PurposeAnswering questions and requests
- RetentionSection 7
- Contactprivacy@zohocorp.com
- Google LLC (Google Fonts)
- CountryUnited States
- When and howSent directly by your browser when you open krypton.today
- ItemsIP address, browser information, requested address
- PurposeLoading the website’s fonts
- RetentionAs set out in Google’s privacy policy
- ContactGoogle privacy contact form
We can’t provide the service without these transfers. If you don’t want them, you can stop them by deleting your account (section 12).
EU and UK — South Korea is a country the EU and the UK recognize as providing an adequate level of data protection. Transfers to other countries rely on safeguards such as adequacy decisions or the EU Standard Contractual Clauses; you can ask for a copy at privacy@krypton.today.
Japan — our agreements require the receiving companies to take measures to the standard Japanese law requires. On request, we’ll tell you what those measures are and give you information about each country’s regime (for country regimes, see the Japanese Personal Information Protection Commission’s survey, 外国における個人情報の保護に関する制度等の調査).
12Deleting your account
This is how to delete a Krypton account (operated by Fantagram Inc.). Delete it yourself under Delete account at the bottom of Settings in the app. It works only on the device that holds your account key. Pending or suspended accounts can’t delete themselves in the app — follow “If you can’t use the app” below and write to privacy@krypton.today. It can’t be undone.
Deleting your account doesn’t cancel an auto-renewing subscription in the app store. Cancel it first in your device’s store subscription settings (Manage subscription in Krypton’s Settings). Krypton+ applies only to the one account that bought it, so when you delete your account any remaining period (including a lifetime pass) can’t be moved to another account or restored.
What is deleted
- Your posts, replies and notes, with their photo and video files, the chats on your posts, and notes others left on your page
- Your profile and its envelopes, and every envelope sent to you (you can no longer open others’ posts)
- Device records and push tokens, your recovery setup and any key pieces you hold, recovery requests, pass records, member-key envelopes, your encryption public key
- Your member number and Krypton+ periods (including any given by a founder), block records (both those you set and those others set on you), notification settings, invite requests you sent (including sealed introductions sent to the Krypton team), records of shared past posts (both those you shared and those shared with you)
What is ended or withdrawn
- Everyone is removed from your fam (the removed records are deleted after 30 days)
- Invitations you sent that are still in progress are cancelled
What remains
- Account number and status
- Your account number, signing public key, join and deletion times and status. Other members’ backer records point to this number and are needed to check the chain of backers, so we keep it while we run the service. Your name was never on the server.
- Backer records
- Who brought whom in. Kept while we run the service, for the same reason.
- Reports
- Deleted once handling is finished and 180 days have passed since the report. Kept longer if the law requires.
- Krypton+ purchase records
- Deleted 5 years after the transaction (Korea’s Act on the Consumer Protection in Electronic Commerce). Once your account is deleted, this applies to lifetime pass records too.
- Other remaining records
- Records of posts you passed along (to whom, and the sealed reason) and of posts other members passed along to you — used to show other members how a post reached them, and deleted when that post is deleted. Records of being trusted to invite. When you joined and left chats on other people’s posts — deleted when that post is deleted. These remain after you delete your account.
- Records with set periods
- Notification log (30 days), capture and save records (30 days), sign-up start records (two days), QR codes, fam links and their requests (one day after expiry), emails to us (3 years after handling) — deleted when the period in section 7 ends.
- Staff action log
- Deleted after 3 years, as in section 7.
- What went to others
- Posts and photos already delivered to other people’s devices, and copies recipients saved to their photo library, can’t be recalled. Replies others wrote to you remain theirs.
If you can’t use the app
If you no longer have a device with your account key, recover your account with your recovery setup and then delete it. If you have no way to recover it, or your account is pending or suspended, email privacy@krypton.today. We don’t collect names or emails, so if we can’t confirm you own the account we can’t delete it — but its content is ciphertext we can’t open.
13Your rights and how to use them
You have the right to access, correct and delete your personal data and to ask us to stop processing it. In the EU and UK you also have the rights to restrict processing, to data portability, to object to processing based on legitimate interests, and to complain to a supervisory authority.
In the app
- Edit your profile, edit posts (up to 10 minutes after posting) or delete them, make a post disappear, close a chat, leave a chat or remove people from one (authors)
- Remove people from your fam, block someone, turn off “Show my past posts”
- Turn off notifications by type (chats, screenshots and saved photos, requests), Manage subscription
- Delete your account (section 12)
By contacting us
- Where — privacy@krypton.today. Requests are free.
- Verification — we don’t know your name or email, so we verify requests with a signature made with that account’s key. If you lost your device, recover your account first and then make the request. If we can’t verify you, we may be unable to act on the request, to the extent the law allows.
- Representatives — someone may make a request on your behalf. We need your authorization and a signature made with your account’s key to verify you.
- Access and copies — we can’t open sealed content, so we provide what the servers know (section 2). You can see sealed content yourself in the app.
How quickly we answer
We answer within 10 days of receiving a request. If we can’t do it in that time, we tell you why and when we will (for EU and UK residents, within the one month the law sets).
We don’t make automated decisions without human involvement that significantly affect members’ rights.
Where to get help
If you don’t get an answer or think we handled a request wrongly, you can ask the bodies below for help.
- Personal Information Dispute Mediation Committee (Korea) 1833-6972 (kopico.go.kr)
- Personal Information Infringement Report Center (Korea) 118 (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office (Korea) 1301 (spo.go.kr)
- Korean National Police Agency 182 (ecrm.police.go.kr)
- EU and UK residents — the supervisory authority where you live
- Residents of Japan — the Personal Information Protection Commission (個人情報保護委員会)
14Children
Krypton is a service for people aged 18 and over. We don’t knowingly collect personal data from anyone under 18, including children under 14, and members who invite and back others must not bring in anyone under 18. If we learn that someone under 18 has joined, we close the account and delete that information. If you know of such a case, please tell us at privacy@krypton.today.
15Security and its limits
Organizational measures
- We limit the people who handle personal data to a minimum number of staff. Staff access is granted through staff-console accounts kept separate from app accounts, with two exceptions: requests to the Krypton team are opened with the team account’s key (on the team’s device, or in the staff console — the console unlocks the team key, locked with a passphrase staff set, only inside that page; the server holds only the locked key and knows neither the passphrase nor the unlocked key), and Krypton+ is given or withdrawn from the founder’s app.
- Changes our staff make (suspending, lifting a suspension, handling reports, giving or withdrawing Krypton+) are kept for 3 years in a log that can’t be changed or deleted (section 7).
Technical measures
- Posts, profiles and files are sealed on your device (end-to-end). Your account’s private keys stay in your device’s secure storage.
- Only server functions can use the database (row-level access control). File addresses aren’t public; only people who hold an envelope get a short-lived pass.
- All traffic uses encrypted connections (HTTPS).
- The staff key that opens reports stays on staff devices and is never sent to the server.
- Five wrong recovery PINs lock recovery for 24 hours, and five wrong name entries cancel an invitation.
- Notifications carry no names or content.
- App screens can’t be captured or recorded by default.
- The production database is backed up daily (kept for 7 days).
- Traces of past relationships are deleted after set periods (section 7).
Physical measures
Our servers are in Supabase (AWS) and Cloudflare data centers and are covered by those companies’ physical security controls.
The wider environment
We handle personal data in the United States and South Korea (staff, database); in Japan, Singapore, India, Australia, Canada, Brazil, Ireland, the United Kingdom, France, Germany and Switzerland, where server functions may run; and in the data center Cloudflare places in the Asia-Pacific region (Cloudflare doesn’t disclose the country). We take security measures after understanding each country’s data protection regime (section 11).
What we can’t prevent
- Someone photographing the screen with another device
- Recipients saving photos and videos to their own photo library (for feed posts the author is notified; for chat photos no one is)
- A recipient copying what they received elsewhere
- The shape of the connection map — knowing one person’s name, someone could infer others around them
- Someone collecting the cards members can see — we can slow this down, not stop it entirely
- The key every member holds (the member key) is shared by all members, so someone who gets hold of one member’s device together with a copy of the server data could read every card set to Everyone (including cards uploaded with an earlier version of the app). A card sealed with a link’s secret can likewise be opened, until it’s deleted, by someone who has both the link and a copy of the server data
- Narrowing who sees your card doesn’t undo what someone already saw, or the keys they already received, while it was wider. So that your photos keep opening, the keys for the half-blurred and full photos stay the same: someone who already received one and also gets a copy of the server data can open the photo that’s up now (the same goes for someone you removed from your fam, or who is no longer in your 2nd degree)
16Tracking, ads and cookies
The app contains no analytics, advertising or crash-reporting tools. It doesn’t read advertising identifiers, doesn’t combine your data with other companies’ data, and shows no ads. We don’t let other companies collect members’ activity through the app or the website. Because we don’t track you, we don’t respond differently to a browser’s “Do Not Track” signal.
krypton.today uses no cookies. Only your chosen language is kept in browser storage (localStorage), and it isn’t personal data. It’s removed when you clear site data in your browser settings. Fonts are loaded from Google Fonts, so when you open a page your browser sends your IP address, browser information and the requested address to Google LLC (United States) (purpose: loading fonts; Google’s privacy policy applies).
The invite, invite-request, QR and fam link pages don’t send the name and secret after the # in the link to the server; the page reads them only in your browser and hands them to the app. The website is provided by Cloudflare, which sees access records (section 4).
17Privacy officer and contact
- Operator
- Fantagram Inc. · 131 Continental Dr., Suite 305, Newark, DE 19713, U.S.A.
- Representative
- Kim Han Seok (CEO)
- Phone
- +1 (909) 529-1617
- Privacy officer
- William Yang (COO)
- Privacy contact
- privacy@krypton.today (privacy questions, exercising your rights, complaints)
- Other questions
- support@krypton.today
18Changes to this policy
If we change this policy, we’ll tell you what is changing and when it takes effect, in the app and on this page, 7 days before it takes effect — or 30 days before for changes that are less favorable to you. Earlier versions will remain available on this page.
Until the official launch (public release on the App Store), changes take effect as soon as we publish them. The 7-day and 30-day notice applies from the version we confirm at launch.
This version: v1.3 · effective 2026-10-12 (first published 2026-10-03). Before then, v1.2 (effective 2026-10-10) applied, and before that, v1.0 (effective 2026-10-08). v1.1, announced on 2026-10-09 to take effect on 2026-10-16, never took effect and was replaced by v1.2.
What changed from v1.2:
- If the Korean, English and Japanese versions differ, the English version now prevails instead of the Korean version (section 18).
- We now say “fam” instead of “connection”, and the narrowest card setting is now called Fam only (formerly 1st only). The Korean and Japanese versions use “Fam” too. The relationships and ranges they refer to haven’t changed.
- We now say “backer” instead of “sponsor”. The meaning hasn’t changed.
What changed from v1.0 to v1.2:
- You choose how far your card is seen: Fam only, Up to 2nd or Everyone. Fam only is new; the default, Up to 2nd, and Everyone open to the same people as in v1.0. We’ve added what the servers delete right away when you narrow it, and what can’t be undone (sections 2, 3, 6 and 15).
- Corrected: sign-up start records keep no account number or time (section 2).
- Added two things the servers already knew but this policy didn’t list: when you last changed who sees your card, and the record of cards handed to people within your range (section 2).
- “Hiding” is now “blocking”, as the app calls it (sections 2, 5, 12 and 13).
- A note you leave on another member’s page is seen, with your name, by that member and their fam rather than by your fam. Notes written before this change stay sealed to the writer’s fam. We’ve set out when the envelopes of people who stop being fam or come to block each other are taken out (sections 2 and 6).
- Page owners can hide or delete the notes on their page. A hidden note stays hidden even if the writer deletes it and writes again. We’ve added that the servers know whose page a note is on and when the owner hid it (sections 2 and 6).
- When you delete your account, notes others left on your page are deleted too (section 12).
This policy is available in Korean, English and Japanese. If the versions differ, the English version prevails.