Privacy

In short. KEPT has no account. Your Words and proofs live on your iPhone. What you read from Apple Health stays there. What leaves it is named below: once you allow it, KEPT's server passes your Word and your photo proof to Anthropic's model, which reads them; what you share with a witness goes to that one person through your own iCloud; a device profile, usage counts and crash reports go out unless you switch them off; Weeks you earn are counted on KEPT's server. If you join the waiting list or use the feedback page on ikept.org, what you send is kept on Cloudflare, and your email also goes to Loops, which sends KEPT's emails.

Who is responsible

Killian Van Hoof, Route de la Cezille 7, 1272 Genolier, Switzerland. hello@ikept.org. This policy covers the KEPT iPhone app and ikept.org.

What goes where

What	Where	When	How you stop it
The words of your Word, the date	KEPT's server (Google Cloud, Zurich), then Anthropic (United States or another country)	When you continue past writing, once per text	NOT NOW on the KEPT Eye page, or later Settings → "Proof read on KEPT's server" off: nothing is sent; on Review you choose to continue on your word (the Word is kept Declared, never Verified) or to allow KEPT Eye
A reduced copy of your proof photo, the Word, what a photo of it should show	Same	When you take a proof photo	Settings → "Proof read on KEPT's server"
Your timer's start and end	KEPT's server, checked by its rules	When you prove with KEPT's timer	Same switch
The Words you chose, your first name, how each ended, the proof's summary and photo	Your own iCloud, shared with the one witness you invited	SEND THE LINK, and at each change	Invite nobody
Your WITNESSED and SEEN marks, your first name	The author's iCloud	When you tap them	Do not tap
A derived installation code, the Week's Monday, its rank, the instant	KEPT's server	When you earn a Week	—
Apple's signed proof of your plan	KEPT's server, then Apple	When you earn a Month on us and hold a plan	—
A device profile, session counts, KEPT's own counts (see §6)	TelemetryDeck (EU)	From the first launch, on by default	You → Settings → "Usage stats"
Crash reports, start-up records	Firebase Crashlytics (Google)	Start, crash	Same switch
A check that the app is genuine	Apple and Google	Start, and before each server call	Cannot be switched off
Your email address, if you join the waiting list	Cloudflare, on KEPT's account (its network spans several countries), and Loops, which sends the emails (United States)	When you join on ikept.org	The link in any email stops them; hello@ikept.org deletes it
What you send on the feedback page, and a random code if you vote	Cloudflare, on KEPT's account	When you ask or vote on ikept.org/feedback	Do not send it; to have it removed, hello@ikept.org

1. On your iPhone

Your Words, their hour and outcome, the proof's figures and times, the judge's few words, your proof photos, your first name if you typed one, which Words you shared, and a random identifier for KEPT's server, drawn by the app. None of this is synced to iCloud in this build; it is part of an iPhone backup if you make one. An older store of the app is opened at launch and synced by iCloud; this build writes nothing to it.

Notifications are written on the phone. The line at your hour quotes your Word and can appear on your lock screen. "Sam saw it." names your witness, never the Word.

Permissions: Camera, for the live proof, never your library. Notifications, asked at your first Word. Apple Health, read-only, asked when a Word needs it. Location and Photos: never asked in this build.

2. Apple Health

Read only for a Word about a run, a walk or a workout, between your signature and your deadline. KEPT reads workouts only, and never writes. KEPT compares the workout with your Word on your iPhone. Its kind, distance, length, start and end stay there: nothing read from Apple Health goes to KEPT's server, to Anthropic or to iCloud. A witness of that Word sees that it was kept, never the source, the figures or the hours of the workout.

3. KEPT Eye

Nothing here happens before you say yes on "KEPT EYE READS YOUR WORD." One switch stops the first three rows above from then on, the reading of your Word included: Settings → "Proof read on KEPT's server".

KEPT's server (Google Cloud, Zurich) receives your Word and your proof, and passes them to Anthropic's model (United States or another country), which reads them. A timer's run is checked by KEPT's server alone. A workout from Apple Health is checked on your iPhone and never leaves it. The first three rows above reach the server with the random installation identifier and a request identifier, so the same proof is judged once; neither is passed to Anthropic. The sentence, the photo and the workout travel as they are. Anthropic stores what it receives in the United States, and its model may read it there or in another country: either way, it leaves Switzerland.

KEPT's server keeps the judge's answer for a time — the verdict, a few words on what it saw and what it looked for, any figure it read, the reason it gave — under a random installation identifier. Never your name, never the photo, never the sentence as you wrote it. Anthropic receives no identifier of you. Anthropic deletes what it receives within thirty days, except what its safety systems flag, which it may keep up to two years, and what the law requires it to keep. In detail, under the installation identifier the server keeps one line per call (date, model, size, duration, cost, verdict or whether an answer came back, the kind of proof, the kind of failure); the judge's answer — for a photo the verdict, the few words it wrote about the frame, what it was looking for, the question it asked and any figure it read there; for a workout or a timer its decision, its reason and the few words it wrote about them — so a retry is answered without asking again; and a daily count. Lines and answers carry a deletion date 90 days out, but automatic deletion is not switched on yet, and the counts carry no date. KEPT's own logs record whether the judge answered, its verdict and the kind of failure — never the content. Google keeps technical logs of each request (time, internet address, device type) for its own period. What comes back stays on your phone with the proof.

4. Your witnesses

One person per link. The link holds one empty seat; the first Apple Account to accept it takes the seat. Inviting creates a space inside your own iCloud, shared with that person. KEPT places in it only the Words you choose, one at a time: the words, the hour, when you signed, how it ended; after a proof kept by the timer or a photo, its source, its printed figures, its times, and the photo at its own size, stripped of place, camera and date; after a proof kept by Apple Health, only that it was kept, and a Moment's photo if you added one. With them, your first name and the time your phone last refreshed the space, at most every twelve hours. Never your Record, your other Words, your other witnesses, the rest of your Health. The invitation message goes by the app you pick and quotes that Word.

Your witness can tap WITNESSED and SEEN; each mark lands in your space with their first name and the time, and iCloud records which account wrote it. A witness who leaves or blocks you writes a note in your space first. Your phone shows their name as Apple lists it on the share. Their phone keeps a copy of what you shared, outside its backup, and deletes it when the space goes. Remove deletes the space. We have no access to it; Apple holds it.

Hide and Block stay on your phone. Report prepares an e-mail to hello@ikept.org with the reason and two identifiers, never a name or a photo; it leaves only if you send it.

5. Weeks and the Month on us

When you earn a Week, your phone sends KEPT's server a code derived from the installation identifier, the Week's Monday, its rank and the instant — nothing of a Word; kept two years. When those receipts reach six, twelve and so on, the server also records, under the same derived code, that a Month was earned — its rank and two instants, nothing of a Word — with no deletion date, so a Month earned and not yet applied outlives the receipts. When you earn a Month and hold a plan, the app sends Apple's signed proof of the plan; the server asks Apple to move your next charge, or signs the offer you confirm yourself. That month is recorded under a scrambled form of the plan's identifier, with no deletion date today.

6. Usage counts, crash reports, Apple

Both are on from the first launch, before you see the switch. One switch stops both from then on: You → Settings → "Usage stats". It changes nothing for KEPT Eye or for your witnesses. They are pseudonymous: a scrambled device identifier, the same on this device every time. What was already handed over when you switch off can still leave shortly after.

TelemetryDeck's software sends a session start and a new-install signal with a device profile: model, iOS version, language, time zone, screen and text size, dates and counts of use. KEPT adds counts of its own. Each is a single event with at most two fixed answers, never any text:

A screen of KEPT appeared (its fixed name, such as "Today" or "Review"; every kind of proof has the same name).
You answered the camera or notifications question KEPT asked (yes or no).
You finished the first-launch screens.
A new Word was started (whether it would be your first).
A Word was given (whether it is your first, and how many weeks after your first Word).
A proof was kept (whether it is your first).
A Word was kept on your word (whether before your first kept proof).
A photo or timer proof was refused (whether before your first kept proof).
A Word closed without being kept (whether its time ran out or you closed it, and whether before your first kept proof).
A Moment was added to a Word.
A witness was invited (whether it is your first).
On the witness's phone, an invitation was accepted.
The offer was shown (from a new Word or from Settings).
A subscription was bought (monthly or annual) or is waiting for approval, a Month on us was confirmed with Apple, a purchase was cancelled or failed, or Restore was used (whether a subscription was found).

They never carry the words of a Word, a time, a place, a photo, a witness's name or anything read from Apple Health, and none says how a proof was made.

Crashlytics sends the failing place in the code, the device model, the iOS version, installation identifiers and a short record at each start; Google says it keeps them 90 days, possibly outside Switzerland and the EU.

Before each call to KEPT's server, the app proves itself through Apple and Google; no switch. Apple's push service wakes KEPT when a witness writes a mark; the push carries no content. Subscriptions are sold by Apple; we never see your card, your address or your Apple Account. If you use TestFlight, it sends Apple your feedback and crash logs under Apple's terms.

7. Deleting your data

Settings → Erase my record deletes, on this phone, your Words, Holds, Weeks, photos, notifications, your name, your KEPT Eye answer and the installation identifier (a new one is drawn); removes the rows from your iCloud where your Words are mirrored there (not in this build); and leaves the Words you witness and removes your witnesses through their own doors. It does not reach what was already sent: request lines, judge answers and daily counts under the old identifier, Week receipts, a Month on us already recorded. A Month earned and not yet applied stays yours. Deleting the app removes your Words and photos from the phone — not a shared space, nor what was already sent. A signed Word cannot be edited or deleted one by one.

8. Your rights, children, changes

Under Swiss data protection law and the GDPR you can ask what personal data we hold, and have it corrected or erased. We hold identifiers, not names: request lines and judge answers under a random installation identifier, Week receipts under a derived code, a month record under a scrambled plan identifier; no name, e-mail or phone number unless you wrote to us or joined the waiting list. Write to hello@ikept.org, or complain to the Swiss FDPIC or your country's authority. KEPT is not directed at children under 13. If this policy changes, the date at the top changes with it; a change that would send something new off your device is announced in the app first.

9. The waiting list

If you leave your email on ikept.org, Cloudflare keeps it on KEPT's account, with the day you joined and a random code. Loops (United States), the service that sends KEPT's emails, receives it too, for that purpose only, along with what it needs to send them. KEPT keeps no IP address with it and sets no cookie. It is linked to nothing in the app. It is used for one thing: an email asking you to confirm, then, once you confirm, a welcome email and at most three more, when you can test KEPT, when you can pre-order it, when it's out. An address that is not confirmed within seven days is deleted. It is not sold or passed on to anyone else. The unsubscribe link in any email stops the emails; ikept.org then notes the day next to your address, so that nothing on the site subscribes it again, not even entering it again. Unsubscribing does not delete it. To have your address deleted at once, write to hello@ikept.org; in any case it is deleted within twelve months. The site itself is served by Cloudflare, which handles each visit's connection.

10. The feedback page

What you send on ikept.org/feedback is kept by Cloudflare on KEPT's account, with the day. It carries no name and no address, and it is linked to nothing in the app. A person reads it first; if it goes up, anyone can read it, so leave out your name and anything private. If you vote, a cookie holds a random code for one year, so that one browser votes once. KEPT keeps that code with your votes, and no IP address. To have a request removed, write to hello@ikept.org.