What we hold, and why

Kindred is an email list service for therapists and practitioners. This page explains what personal information we hold, why, where it is kept, and how to have it removed. It is written to be read, in the spirit of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

Two kinds of people

• Practices that use Kindred (our customers): we hold your name, email address, sign-in details and the settings you enter, such as your mailing address.
• Readers who sign up to a practice’s list: the practice decides what its form asks for. Kindred holds that information on the practice’s behalf and uses it only to send that practice’s letters. We never sell, rent or share readers with anyone else, and readers of one practice are never visible to another.

What we keep with each signup

To show that a reader asked to hear from a practice, Kindred records the wording on the form, the page it was on, and the date and time. We keep a scrambled version of the signup’s internet address, used only to stop automated spam, never the address itself.

Where it is kept

Lists and consent records are stored in a Canadian data centre (Supabase, Montréal). Letters are delivered through Postmark, an email delivery service whose servers are in the United States, so a reader’s email address and the letter itself pass through them in order to be delivered. Our website is hosted by Hostinger.

Opens and clicks

Letters include a small tracking image and tracked links so a practice can see roughly how many people opened a letter and which links were clicked. Open figures are estimates and are shown as such.

Leaving and removal

Every letter has an unsubscribe link that works immediately. Addresses that unsubscribe, bounce permanently or report a letter as spam are kept on a do-not-mail list so they are never written to again. To have your information removed entirely, or to see what we hold about you, write to hello@rootedkindred.com.

Security

Signing in to Kindred takes an email link and a code from an authenticator app. Access to each practice’s data is enforced in the database itself.

Last updated: draft, October 2026.