Security & Data Practices

Every story, photograph, conversation, and memory shared with Kulohi represents something deeply personal.

We believe those moments deserve thoughtful protection.

While no online service can guarantee perfect security or uninterrupted availability, protecting your information is one of our highest priorities. We continuously work to improve our systems, evaluate new security practices, and strengthen the safeguards that help keep your information safe.

Kulohi is operated by Gremlin Labs LLC, doing business as Kulohi.

Security is more than protecting data.

It is about protecting the trust you’ve placed in Kulohi.

Every decision we make considers not only confidentiality, but also reliability, privacy, and the long-term care of the memories entrusted to us.

Kulohi uses a combination of administrative, technical, and organizational safeguards designed to help protect your information.

These safeguards may include:

• encrypted communications;
• secure cloud infrastructure;
• authenticated access controls;
• continuous monitoring;
• regular software updates;
• security logging;
• backup and recovery procedures.

Security practices evolve over time as technology and industry standards continue to improve.

Where appropriate, information transmitted between your device and Kulohi is encrypted using industry-standard security protocols.

Sensitive information stored within Kulohi is protected using appropriate security measures designed to reduce unauthorized access.

Access to member information is intentionally limited.

Only authorized personnel with a legitimate business need may access information required to:

• provide customer support;
• investigate technical issues;
• maintain system reliability;
• comply with legal obligations;
• investigate suspected abuse or security incidents.

Access is limited to the minimum information reasonably necessary to perform those responsibilities.

Kulohi uses secure authentication systems to help protect member accounts.

Kulohi is preparing an optional passkey sign-in feature through a staged rollout. It may not yet be available, is not required, and will not replace existing recovery methods during the initial rollout. When used, a passkey can let a member approve sign-in with Face ID, Touch ID, a device PIN, a supported password manager, or a security key. The biometric or PIN check happens on the member's device; Kulohi and its authentication provider receive the public-key proof needed to verify sign-in, not the member's fingerprint, face scan, device PIN, or private key.

Members using a shared household device should understand that a saved passkey may be available to another person who can unlock that device or its password manager, depending on the device's settings. Removing a passkey from Kulohi stops that credential from being accepted by Kulohi, but does not necessarily delete the saved copy from the device or password manager.

Members are encouraged to:

• choose strong passwords;
• enable multi-factor authentication when available;
• protect their devices;
• avoid sharing login credentials with others.

Kulohi works with carefully selected technology providers to help operate the Service.

These providers may assist with:

• cloud infrastructure;
• authentication;
• artificial intelligence;
• secure databases;
• payment processing;
• analytics;
• communications.

Providers are expected to maintain appropriate security practices while performing services on behalf of Kulohi.

Security is an ongoing process.

We regularly review our systems, evaluate potential risks, monitor for unusual activity, and make improvements designed to strengthen the security of Kulohi over time.

As new threats emerge, our practices will continue to evolve.

If we become aware of a security incident that materially affects your personal information, we will investigate the matter promptly.

Where appropriate and required by applicable law, we will notify affected members and provide information about the nature of the incident, the steps we are taking, and any actions members should consider.

Security is a shared responsibility.

Members can help protect their information by:

• using strong passwords;
• enabling additional security features when available;
• reviewing Kindred permissions regularly;
• keeping devices up to date;
• reporting suspicious activity;
• protecting access to their email accounts.

We appreciate the work of security researchers and members who responsibly report potential vulnerabilities.

If you believe you have discovered a security issue within Kulohi, please contact us as soon as possible.

We ask that security concerns be reported privately so they can be investigated and addressed responsibly before public disclosure.

Although we work hard to provide a reliable experience, temporary interruptions may occur due to maintenance, software updates, infrastructure providers, internet connectivity, or circumstances beyond our reasonable control.

We continually work to improve reliability and minimize service disruptions whenever possible.

As Kulohi evolves, we may update this Security & Data Practices document.

When significant changes are made, we will update the “Last Updated” date and, where appropriate, provide additional notice.

Questions regarding security or responsible disclosure may be directed to:

Gremlin Labs LLC

Security Team

Email: security@kulohi.com

Website: https://kulohi.com

Questions?

Protecting your memories means protecting the trust you’ve placed in us.

If you have questions about our security practices or wish to report a potential security concern, contact security@kulohi.com. Responsible security disclosure is welcome, and we appreciate your help in keeping Kulohi safe for everyone.