How we keep your family's account safe
Your family trusts us with names, emails and a shared balance. Here is, in plain words, how we protect them, and how to tell us if you find a problem.
Card details go to Stripe, never to us
The free account never asks for a card. If you choose Kindred Plus, the payment is handled by Stripe, a payment processor certified to PCI DSS Level 1, the highest level in the card industry. You enter your card on Stripe's secure checkout.
We never see or store your full card number. We receive only what we need to show you your Plus subscription, such as the card brand, the last four digits and the payment status.
What we store about payments
- For Plus: your plan, renewal date and payment status
- For Plus: the card brand and last four digits, from Stripe
- Your payout choice: a PayPal email or a gift card brand
No passwords to steal
You sign in with a link we email you. There is no password that could be guessed, reused from another site or leaked.
Links expire in 20 minutes
Each sign-in link works once and stops working 20 minutes after we send it. A used or old link can't be replayed.
Secure session cookies
Once you are in, your session lives in an HttpOnly, Secure cookie. Scripts on a page can't read it, and it is only sent over HTTPS.
Same-origin checks
Every request that changes something, like a payout or an invite, is checked to make sure it came from our own pages and not from another site.
Built to limit what can go wrong
Strict Content Security Policy
Our pages may only load scripts and styles from our own domain, plus Stripe.js from js.stripe.com for Plus payments and the Meta pixel when it is turned on. Inline scripts are blocked, which shuts the door on most script injection attacks.
Encrypted in transit
All traffic uses HTTPS, and HSTS tells your browser never to connect to us over plain HTTP.
Signed click IDs
Every store click carries a signed ID. Purchase reports from affiliate networks are only credited when the signature checks out, so nobody can forge cash back into an account.
Rate limits
Sign-in requests, store clicks and forms are rate limited to slow down automated abuse.
Kept safe, kept small
- Daily backups of our database, so an outage doesn't lose your balance.
- Access to member data is limited to the staff who need it to support you.
- We never sell your personal information.
- Ask us to show, export or delete your data at any time.
The details are in our privacy policy.
Keep your account safe
We will never ask for your card number, a sign-in link or a code by email, text or phone. Sign-in emails come only after you ask for one on our site.
If you get a sign-in email you didn't request, you can ignore it. The link expires on its own.
Found a security problem? Tell us.
We welcome reports from security researchers and members. Email support@example.com with the subject Security, and include:
- What you found and where, with the URL or page
- Steps to reproduce it
- What an attacker could do with it
We reply within 2 business days and keep you updated while we fix it. Please give us reasonable time to fix the issue before you disclose it publicly.
Please test only against your own account, don't access or change other members' data, and don't run tests that degrade the service for others.