Alex from Kinde here. Apologies for the late reply!

Does Kinde store user data on their own servers?

Yes. We need to store the data to provide our customer auth as a service to you.

If so, does this mean Kinde owns the user data?

No. Your data is owned by you. Kinde is a custodian of that data on your behalf. "You own all data, information or content you and your Authorized Users upload into the Platform (Your Data), as well as any data or information output from the Platform using Your Data as input (Output Data)". This is set our in our Terms, see section 16 of https://docs.kinde.com/trust-center/agreements/terms-of-service/

Are there any potential security or privacy issues with this setup?

This is a balance that you need to decide yourself. The risk of setting up auth in house and having to maintain security updates and feature requests vs relying on a third party company who does this for a living.

Being biased on this answer, we think Kinde is an excellent choice to rely on your customer auth needs. We are constantly updating our product based on feedback so that we meet our customer's expectations, regularly go through security and compliance tests to ensure that we're as secure as possible, and have an awesome team to keep us at the top of our game. This is all done so that you can focus on building your product rather than tinkering with auth.

Hope that answers your question. Feel free to reach out to us via the Slack community or the live chat on our website.

Cheers, Alex