LEGAL & PRIVACY
Privacy Policy
1. Who we are
Kept is developed and operated by Kept (“we”, “us”, or “our”). For privacy inquiries, data protection questions, or requests regarding this policy, contact us at pritamfinds@gmail.com.
2. The short version
Your journal is stored encrypted on your iPhone. There is no account, no sign-up, no login, and no server holding your journal entries. The only time anything you wrote leaves your phone is when you explicitly tap to generate a summary.
3. What is stored on your device
All your personal writing remains locally on your device:
- Database: Journal entries, entry timestamps, entry source tags, optional mood ratings (1–5), generated summaries, and search indexes are stored in an encrypted SQLite database (SQLCipher / AES-256).
- Encryption Key: The 256-bit database key is generated on your device and held securely in the iOS Keychain with
AFTER_FIRST_UNLOCKprotection. It is never transmitted off your device. - Photos: Photos attached to entries are stored as ordinary files within the app's sandboxed container, protected by your iOS device passcode.
- Device Backups: The encrypted database and Keychain item are included in your standard encrypted iOS backups (iCloud or local iTunes/Finder backups).
4. What leaves your device, and when
Nothing is transmitted automatically in the background. The only outbound journal transmission occurs when you manually tap to generate a periodic summary.
Summary Data Transmission Flow:
Path: Your Device → Convex Backend Function → OpenRouter → Your Device.
Transmitted Payload: Anonymous install ID (deviceId), requested period label, entry count, device-computed facts, candidate quotes, and the raw entry text for that specific period only.
What Convex Stores: Only an anonymous daily counter row (deviceId, day, count) enforcing our 4-per-day rate limit. Convex never stores journal text or summaries.
No User Identity Sent to AI: The request to OpenRouter carries no user name, email, IP identifier, or account profile. Entries are processed ephemerally and are not retained or used for model training.
Never Transmitted: Mood ratings, photos, onboarding answers, or entries outside the selected period never leave your device.
5. Setup analytics
Only the onboarding setup flow is measured. Once you are in the app, nothing is recorded, ever.
This scope is strictly enforced in code: nothing outside the setup module imports analytics. There are no screen views, no app opens, no entry tracking, no search tracking, no reading telemetry, and no settings changes recorded once setup finishes. We measure only where users encounter difficulty or drop off during initial setup.
- No Identifiers: We never call
identify(). Mixpanel receives only an anonymous per-install ID. IP-based geolocation is disabled. - Events Collected During Setup: Onboarding steps reached and completed, duration to complete, reason category chosen, summary cadence selected, number of selected focus areas and exclusions (count only), backfill photo count picked, and purchase outcome.
- Never Sent: Entry text, prompt text, search queries, mood values, which specific subjects are on your mind, which subjects you excluded, word counts, photo filenames or dates, summary text, screen names, or anything done after onboarding ends.
- Opt-Out: You can turn analytics off in App Settings. Turning it off immediately stops all transmission, clears the local queue, and removes the anonymous ID.
6. Purchases
All subscription and one-time purchases are processed directly by Apple through In-App Purchases. We never receive or store your credit card or billing details. RevenueCat validates receipt state against an anonymous app ID. Renewal reminder notices are generated locally on your device three days before each renewal.
7. Notifications
All reminders and renewal notices are scheduled locally on your device. Kept does not operate a remote push server, and no notification payload leaves your device.
8. Sub-processors
We engage the following third-party service providers to support app functionality:
| Partner | Data Handled | Purpose |
|---|---|---|
| Convex (Convex, Inc., US) | Journal text in transit; stores only anonymous rate-limit counter (deviceId, day, count) | Backend infrastructure & API key isolation |
| OpenRouter (US) | Journal text for the requested summary period | Inference routing & summary prose generation |
| Mixpanel (US) | Onboarding-flow setup events only (enums, counts, booleans; no identifiers or free text) | Setup analytics during initial onboarding |
| RevenueCat (US) | Anonymous app user ID, purchase state, receipt validation | Subscription state management |
| Apple Inc. (US) | In-App Purchases, receipts, encrypted device backups, local notifications | Operating system platform & distribution |
9. Your rights
Because Kept holds no user accounts, email addresses, or cloud-stored journals, traditional data retrieval requests do not apply:
- Data Export: You can export your full journal as Markdown files or as an encrypted backup file from the app at any time.
- Data Deletion: Deleting an entry or deleting the Kept app from your device permanently removes your local database and Keychain encryption key.
10. Children's privacy
Kept is not directed at children under the age of 13. We do not knowingly collect personal data from children.
11. International transfers
Sub-processors utilised for inference and setup analytics operate in the United States. Transfers from the EU/EEA and UK are governed by standard contractual clauses (SCCs) to ensure equivalent data protection safeguards.
12. Legal bases (EU & UK)
Under the GDPR and UK Data Protection Act, our legal bases for processing data include:
- Contract Performance: Generating requested summaries and processing subscription entitlements.
- Explicit Consent (Article 9): Free-form journal entries may inadvertently contain special category health information. By tapping to generate a summary, you explicitly consent to the ephemeral transmission required to produce your one-page summary.
- Legitimate Interest: Anonymous setup flow analytics during onboarding, which you can opt out of at any time.
13. Changes to this policy
If we update our privacy practices or sub-processors, changes will be posted directly to this page with an updated effective date.