Privacy policy · last updated 12 September 2026
Privacy
There is no account. Nothing you write leaves your phone.
Who is responsible
Killian Van Hoof, Route de la Cezille 7, 1272 Genolier, Switzerland. Contact: hello@ikept.org. This policy covers the KEPT iPhone app and this website.
What never leaves your phone
- The sentences you write, including anything you write when you give up. They are read on the device, by Apple's on-device model where it exists and by the app's own rules everywhere else. They are never sent anywhere.
- Your proof photos. They are taken live in the app and never imported from your gallery.
- Anything read from Apple Health — workouts, distances, step counts, sleep. These figures are kept in a separate store on the device that is never synced, not even to your own iCloud.
- Your record: totals, chain, ranks.
Your iCloud, not ours
Your promises and your proof photos are copied into your own iCloud account, under your Apple ID and Apple's terms, so that a lost or replaced phone does not cost you your record. Nothing about this reaches a server of ours, and we cannot see any of it. A phone signed out of iCloud simply keeps everything locally, and the app says so.
If you invite someone as a witness, the promise you chose to share and its proof are placed in a record shared with that person, again inside your own iCloud. We have no access to it.
The two things that go out
| What | Where | Why |
|---|---|---|
| Crash reports: the technical report when the app dies — the code that failed, the device model, the iOS version. Never the text of a promise, never a photo, never a location. | Firebase Crashlytics (Google). | To find and fix what breaks. Governed by the same switch as the counters below. |
| Anonymous counters: which kind of proof was used, how many words a promise had, whether a screen was opened. Never the text of a promise, never a photo, never a location. | TelemetryDeck (Germany, EU). | To know which parts of the app are used. You are told at first launch and can turn it off at any time in Me → Anonymous usage stats. Off means nothing is sent, crash reports included. |
Permissions, and what happens if you refuse
- Camera — to take a live proof. Refuse it and the app says so; nothing is ever imported from your gallery.
- Notifications — at most three lines per promise, plus one line in the morning. Refuse and the app still works, silently.
- Apple Health — read-only, optional, and only for the window of a promise. KEPT never writes to Health.
- Location — optional, to record a route or name the place on a proof. The place is never used to judge you.
- Motion & Fitness — optional, for step counts inside a promise's window.
Payments
Subscriptions are handled by Apple. We never see your card, your address or your Apple ID. Manage or cancel in Me → Subscription or in your Apple Account settings.
Children
KEPT is not directed at children under 13.
Deleting your data
Me → Erase my record deletes every promise, proof and photo the app holds, and the words you published to your witnesses. The deletion travels to your own iCloud with the next sync. Deleting the app removes the rest. Anonymous counters cannot be tied to you, so there is nothing there to delete.
Your rights
Under Swiss data protection law and the GDPR you may ask what personal data we hold about you, and ask for it to be corrected or erased. In practice we hold none: we receive no identifier, no content and no contact details. If you believe otherwise, write to hello@ikept.org and we will answer.
Changes
If this policy changes, the date at the top changes with it. A change that would send something new off your device would be announced in the app before it happened.