Kumi Privacy Policy

Last updated: 17 October 2026

This policy explains what personal data the Kumi app collects, why we process it, who we share it with and what your rights are. We wrote it to be clear: if anything is unclear, write to us (contact details below).

Kumi is an app designed for women, to help genuine friendships grow and to find good things to do together. It is not a dating app. Use of the app is also governed by the Terms of Use and the Community Guidelines.

This is a translation of the Italian policy; if the two ever differ, the Italian version prevails.

1. Who processes your data (Data Controller)

The Data Controller is Noemi Di Gennaro, an individual who runs the Kumi app and the website kumiapp.space as a sole operator. No Data Protection Officer (DPO) has been appointed, as the conditions of Article 37 GDPR do not apply.

For any request about your data or this policy, write to:

info@kumiapp.space

We normally reply within 30 days.

2. What data we collect

We only collect the data needed to make the app work. In detail:

Account data

• Email address (to sign up and sign in). If you choose to sign in with Apple or Google, we only receive what is needed to sign you in: an account identifier and, if you share it, your email address.
• Password: we never see it; it is stored in encrypted form by our authentication provider (Supabase).

Profile data (you enter it)

• Name (or what you'd like to be called), city, age.
• From your city we derive, with OpenStreetMap, the city centre and the country: they are used to show you people in your area or your country. For your profile we do not use your phone's GPS and nobody sees where you actually are (the optional location described below is only used to suggest places when you create an event).
• Date of birth: we ask for it at sign-up to know you are at least 18; it stays private (no other user sees it) and we only derive the age shown on your profile.
• Bio, interests, languages you speak.
• Profile photos (one or more).
• The positions on your "spectrum" (the playful scales like Home ⟷ Adventure).

Kumi Premium subscription (only if you subscribe)

• Apple handles the payment: we never see your card details. Apple sends us the transaction details: an identifier, the product, start and expiry dates, whether it renews, and any refund. We use them to know whether Premium is active.

Waitlist on the website (only if you sign up on kumiapp.space)

• Your email address and, if you write it, your city. We use them only to write to you when Kumi is out; we don't use them for anything else or give them to anyone.
• Which page you signed up from (for example the website or our Instagram page), so we know where to spread the word. We use no cookies or tracking tools.

Activity in the app

• The "likes" you send and mutual "matches".
• The messages you exchange in private chats and event chats, including the photos and voice messages you send: they are stored in a private area and only the people in the conversation can see them. The GIFs you pick are links to GIPHY.
• The events you create or join, including the event's location (name of the place and map coordinates).

Location (optional)

• If you allow it, when you create an event from one of the quick ideas (for example "Coffee & chat") we use your phone's location to suggest nearby places: cafés, libraries, parks. The location is rounded to about 100 metres before it leaves your phone, is not stored by Kumi or linked to your account, and no other user sees it. If you don't allow it, we suggest places in the city on your profile and everything works the same. You can change your mind at any time in your phone's settings.

Community safety data

• The people you block and those you chose to "pass" in discovery (so they are not shown to you again).
• The reports you send (with the reason you chose).
• A technical profile status (e.g. "verified", "suspended") used for moderation.

Technical data

• The minimum information needed for the service to work and stay secure (e.g. the IP address used to connect to our services and to the map services). We do not use advertising trackers or profiling for marketing purposes.
• If you agree to receive notifications, a technical identifier of your phone (the Apple or Google push notification "token"): it is only used to deliver alerts, for example when a message arrives, and it is deleted when you sign out or delete your account.

Profile verification — an important note

To build trust in the community, you can ask for the "verified" badge. We ask you for a selfie taken on the spot with the front camera: a person from the Kumi team compares it by eye with your profile photo and approves or rejects the request (if rejected, we tell you why). Only verified profiles can use events.

• The selfie is kept in a private area of our servers, visible only to the Kumi team and to no other user; we keep it for as long as your account exists, because it is what makes the badge valid, and we delete it if you delete your account or ask us to.
• No automatic facial recognition: the comparison is made by a person, not an algorithm. We do not create "face prints" or other biometric data, so we do not process special categories of data (Art. 9 GDPR). If we ever introduce an automatic verification that processes biometric data, we will first ask for your explicit, separate consent and update this policy.
• When you choose your main profile photo, your phone checks on the device (using the operating system's features) that a face is clearly visible: this check sends nothing to our servers.

3. Why we process your data and on what legal basis

We do not use your data for targeted advertising and we never sell it.

4. Who we share your data with

We do not sell your data. We only share it with the technical providers needed to run the app, who process it on our behalf (data processors):

• Supabase — our "backend": it securely stores your account, profile, photos, messages, events and safety data. The Kumi project is hosted in a data centre in the European Union (Frankfurt, Germany), so your main data stays within the European Economic Area.
• Brevo (France, EU) — sends account emails (email confirmation, password reset): it receives your email address and the text of the message.
• Apple and Google — if you sign in with their account, they handle the sign-in; Apple also delivers push notifications to iPhones (it receives the phone token and the text of the alert, for example "Giulia: Hi!") and, if you subscribe to Kumi Premium, handles the payment as the seller on the App Store.
• OpenStreetMap — when you create an event and search for a place, the text you type is sent to OpenStreetMap's geocoding service (Nominatim) to find its coordinates. The maps you see load their images from OpenStreetMap or Google Maps servers. These requests may include your IP address. For "nearby places" your phone asks OpenStreetMap (Overpass) directly for places in the area: OpenStreetMap receives your IP address and the already-rounded location (about 100 metres), but not your name or any other profile data.
• GIPHY (United States) — when you open the GIF picker in a chat, the words you search for and your IP address reach GIPHY so it can show you results. We send GIPHY no profile data.
• Ticketmaster — "Events in town" come from Ticketmaster's public catalogue: we send them none of your data. If you open an event on their website, Ticketmaster's privacy policy applies.

Some of these providers (Apple, Google, GIPHY) are based outside the European Union: in those cases the transfer takes place with the safeguards required by the GDPR (for example standard contractual clauses or the EU-US Data Privacy Framework).

In addition, some data in your public profile (name, age, city, photos, interests, languages, spectrum) is by nature visible to other Kumi users, because that is the heart of an app for meeting people. Your messages are only visible to the people you chat with (private chats) or to the participants of an event (event chat).

Finally, we may disclose data if required by law or by a competent authority.

5. How long we keep data

• Account and profile: for as long as your account is active. If you ask for deletion, we remove them (see section 7).
• Messages: they remain for as long as the account exists; you can ask for them to be removed.
• Events: event data is kept for as long as it is useful for organising it and for the community's history.
• Website waitlist: until the email announcing Kumi's launch, then we delete it. If you ask us earlier, we remove it straight away.
• Reports and blocks: we may keep them afterwards for as long as needed to keep the community safe and prevent abuse.

When data is no longer needed for the purposes above, we delete or anonymise it.

6. How we protect your data

• Access to data is protected by database-level security rules (Row Level Security): each user can see and change only their own data, and messages only between the people entitled to them.
• Passwords are stored in encrypted form by the authentication provider and are never visible to us.
• Communication between the app and our servers is encrypted (HTTPS).

No system is 100% secure, but we are committed to adopting appropriate measures and improving them over time.

7. Your rights

Under the GDPR you have the right to:

• Access your data and know how we process it.
• Correct inaccurate or incomplete data (you can change most of it directly in your profile).
• Delete your data ("right to be forgotten") and close your account — you can do it yourself in the app: Settings → Delete account.
• Restrict or object to certain processing.
• Ask for portability of your data in a readable format.
• Withdraw consent at any time (where processing is based on consent), without affecting processing already carried out.

To exercise these rights, write to the email in section 1. We reply within the time limits set by law (normally one month).

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the country where you live.

8. Minimum age

Kumi is only for adults (18 years or older). We do not knowingly collect data from people under 18. If we become aware of an account belonging to a minor, we remove it. How we prevent and handle any risk to minors is explained in our Child Safety Standards.

9. Cookies and similar technologies

Kumi is a smartphone app and does not use advertising cookies. We only use the technologies strictly needed to make it work (for example to keep you signed in).

10. Changes to this policy

We may update this policy (for example if the app's features or the Data Controller change). We will publish the updated version with a new date at the top and, for important changes, we will let you know in the app.

11. Contact

For any question about this policy or your data: info@kumiapp.space

Thank you for being part of Kumi. 💛