Privacy Policy

Overview

Keep is developed by Toby Jones. This policy explains what happens to your information when you use Keep on iPhone. In short:

• What you put in your vault stays on your iPhone, encrypted. We can't see it.
• You don't need an account. We never ask for your email, phone number or real name.
• Keep is free and shows ads from Google AdMob. Ads never see anything in your vault or anything you share. You choose whether ads can be personalised, and the Remove Ads subscription switches them off completely.
• If you turn on Sharing, a small amount of data passes through our relay so phones can find each other. Everything is listed below.

Your vault stays on your device

Photos, videos and files you add are encrypted on your iPhone with AES-256-GCM. The key is kept in your iPhone's Keychain, can only be unlocked with your Face ID, Touch ID or PIN, and never leaves the device. Your vault isn't uploaded, synced, or included in iCloud or computer backups.

• Photo library access is used only to remove originals after you hide them, if you ask Keep to. Importing uses Apple's own picker.
• Camera is used only to scan another person's Keep code when you add them.
• Face ID and Touch ID are handled by iOS. Keep never sees your face or fingerprint data.
• Nudity detection uses Apple's on-device Sensitive Content Analysis, and only if you've turned on Sensitive Content Warning in iOS Settings. Nothing is sent anywhere for this.
• Age check: before nude images can be sent or viewed, Keep asks iOS for your age range using Apple's Declared Age Range. Keep only learns whether you're over the age of majority, never your date of birth.

Sharing (optional)

Sharing is off until you turn it on. When it's on, Keep connects to our relay server, hosted on Vercel with storage by Upstash. The relay does three jobs, and none of them let it read what you share:

• Connecting phones. It passes short connection messages so two phones can talk directly.
• Mailbox. If the other phone isn't open, your item waits on the relay, already end-to-end encrypted to their device. It's deleted as soon as they collect it, or after 30 days at most.
• Notifications. It sends a generic alert ("Something new…") through Apple's push notification service. Alerts contain no names and no content.

While Sharing is on, the relay stores:

• a random Keep address that isn't tied to your identity, and a scrambled (hashed) secret that proves the address is yours
• the display name you choose (up to 40 characters) and your public key, so people you give your friend code to can add you. These expire after 30 days unless refreshed.
• "added you" notices, for up to 30 days
• encrypted items waiting in your mailbox, until collected or for 30 days at most
• your push notification token, and an Apple DeviceCheck token so a device banned for abuse stays banned if Keep is reinstalled
• the IP addresses (IPv4 and IPv6) your device last connected from, and their approximate location (city, region and country), kept for 90 days for safety, so abusers can be identified if they're reported

Other services involved in Sharing:

• Apple: push notifications, DeviceCheck and Declared Age Range.
• Vercel and Upstash: host the relay and its storage.
• ipify.org: when Sharing starts, Keep asks ipify for your phone's public IP addresses.
• ipinfo.io: if you're reported, the relay looks up the name of your internet provider from your IP address.
• Google STUN servers: help two phones connect directly. Like any server you connect to, they see your IP address.

None of these services can see what you share.

Advertising

Keep shows ads from Google AdMob: a banner, a sponsored card, occasional full-screen ads, and a short video before you share something. Ads appear around your vault, never inside it. Google is never given your photos, videos, files, PINs, or anything you share or receive.

To show and measure ads, Google's software on your iPhone collects some information and sends it to Google:

• your IP address and approximate location derived from it
• device details such as model, operating system and language
• how you interact with ads (views and taps), and crash data from the ad software
• your device's advertising identifier, only if you allow tracking

Your choices:

• Allow tracking. Keep asks once, using Apple's App Tracking Transparency prompt. If you allow it, Google may use your advertising identifier to show ads that suit you better and to measure them across apps and websites. If you ask Keep not to track, ads still show but aren't personalised that way. Change it any time in Settings › Privacy & Security › Tracking.
• Consent (UK and EU). Where the law requires it, Keep shows Google's consent form before any ads load. You can change your answer any time in Keep's Settings › Privacy Choices for Ads.
• Remove Ads. While the subscription is active, Keep shows no ads at all and doesn't start Google's ad software.

Google's use of this information is covered by Google's Privacy Policy and how Google uses information from apps that use its services.

Purchases

The Remove Ads subscription is processed entirely by Apple through the App Store. We never see your payment details. Keep only checks with Apple whether your subscription is active.

Reports and safety

If you report someone, we receive your Keep address, theirs, the name you know them by, the reason you choose and anything you write. We also receive their stored network details: IP addresses, approximate location and internet provider. You can choose to attach items they sent you. These are encrypted on your iPhone so that only our Review Team can open them, and they're deleted when the report is closed.

Reports about content involving a minor never include content. The reported person is banned immediately, and we point you to the authorities, such as NCMEC's CyberTipline in the US.

Reports and messages about them are kept for up to about 13 months. We may share report information, including network details, with law enforcement where the law requires it.

What we don't do

Keep has no analytics of its own. We don't sell your information or share it with data brokers. Apart from the ads described above, nothing about you is shared with third parties for advertising.

Diagnostics

If you choose to share analytics with app developers in your iPhone's Privacy settings, Apple may give us anonymised crash and performance reports to help fix bugs. They don't identify you, and you can turn this off at any time in Settings.

Your choices

• Turning Sharing off stops Keep from contacting the relay.
• Settings › Erase Everything deletes your vault from your iPhone. Deleting the app does too. Either way it can't be recovered.
• To ask for a copy of, or the deletion of, relay data linked to your Keep address, email us with your friend code.

Children's privacy

Keep doesn't ask anyone for personal information. Sending or viewing nude images is blocked for anyone under the age of majority where they live.

About this website

This website, unlike the app, uses Google Analytics to count visits. See the site privacy policy for details.

Changes to this policy

If anything about how Keep handles data changes, we'll update this page and, where required, the App Store's privacy label before that change ships.

Contact

Questions about this policy or how Keep handles data can be sent to hello@thecaffeinemediacompany.com.