Privacy Policy

Your people, notes, photos and memories stay on your device. Audio goes to Deepgram only to become text. The text of a note, with the names of your people and some context about them, goes to Anthropic (Claude) to extract facts, feelings and names; nothing is filed until you confirm it. Both run as a service with zero data retention: nothing is stored after the reply and nothing is used to train their models. Kept asks your permission in the app before the first of these. Photos are never uploaded by Kept. We do not sell your data, show ads, or build a social graph.

Everything you create in Kept — people profiles, notes, facts, feelings, places, photos attached to notes, and optional saved recordings — is stored locally on your phone in an on-device database. This data does not sync to our servers and is not accessible to us.

Photos are never uploaded or analysed by Kept. They are copied into the app’s own storage when you attach them, shown on the note and on the person’s page, and deleted with the note. Kept does not read text, scenes or faces from them.

Your phone’s own backup (iCloud Backup on iPhone, Google backup on Android) may include Kept’s database, photos and recordings, as it does for other apps; that copy is governed by Apple’s or Google’s terms and your backup settings. A backup file you make from Settings is a complete, unencrypted copy of your journal, and goes only where you choose to put it.

If you turn on Lock Kept, the app asks for your phone’s own Face ID, Touch ID, fingerprint or passcode when it opens. Kept has no passcode of its own and this is not encryption of the database.

You can add a person to Kept by picking them from your phone’s Contacts instead of typing their name. Kept never reads, searches or uploads your address book. It opens the system contact picker, which runs outside the app, and the only thing Kept receives is the card you choose.

From that card Kept reads the name (with its nickname, if there is one), the contact photo and the birthday. Phone numbers, email addresses, postal addresses and every other field are never requested or read. These fields are saved in the app’s own database on your phone, exactly as if you had typed them, and nothing from the picker is sent to our server when you import.

What they are used for:

• Name — labels the person in your journal, and lets Kept recognise them when you mention them in a note.
• Photo — shown on that person’s page. It never leaves your phone.
• Birthday — shown on their page and used for a reminder before the day, on your phone. It never leaves your phone.

The name is the one field that can leave your device, and only in the way every name in your journal does: when Kept extracts facts from a note, the text of the note is sent to our AI together with the names of the people in your journal so it can tell who the note is about (see “When data leaves your device”). That is the same whether you typed the name or picked it from Contacts. We do not use contact data for advertising, profiling, finding other users, or anything beyond the journal itself.

Deleting a person in Kept removes their name, photo and birthday from the app. Your Contacts card is never changed or deleted by Kept.

If you turn on plans from your calendar, Kept reads the next two weeks of events on your phone and compares their titles with the names in your journal, on the phone. An event becomes part of your journal only if you make it a plan; when you do, its title is sent to Anthropic once, with that person’s name, to write the question Kept asks you afterwards, and from then on it is a note like any other. The rest of your calendar never leaves the phone.

Text or photos you share into Kept from another app start a note like anything you type, and are handled the same way.

Kept sends data off your device only to make the features below work. The app asks your permission before the first of them, names the companies involved, and lets you turn it off again in Settings (“Send notes to AI”); with it off, nothing in this section is sent. Most of these happen when you use a feature; two follow from a note on their own, and are marked so.

• Voice transcription. When you record a note, audio is streamed securely to Deepgram to produce a text transcript, in the language you chose, with the names already in your journal sent as hints so they are heard correctly. If the live connection drops, the whole recording is sent to Deepgram afterwards instead; in rare cases that upload passes through our server, which does not keep it. We do not store your recordings. A recording made offline stays on your phone until it is transcribed, and recordings are kept on your phone only if you turn that on.
• Note extraction. When a recording finishes, or when you type a note, its text is sent to Anthropic (Claude) to extract structured facts, feelings, and people references, and, once you save, to spot the names of places, pets and companies in it so the transcriber recognises them next time. This is what fills in your review screen, so it happens before you confirm the note, not after. Alongside the text we send the names and nicknames of the people in your journal, their facts and your last few notes about each, so the extraction can tell them apart. Follow-up answers travel the same way, as text.
• Follow-up questions (on its own, after a note). Unless you turn them off in Settings, the note and that person’s recent notes are sent to Anthropic to choose one question to ask you afterwards.
• Briefings and Reflect. When you ask Kept for talking points, or reflect on someone, your notes about that one person — their facts, your recent notes, your intention and what you write in the reflection — are sent to Anthropic (Claude) to answer. When you make a plan, its text and that person’s notes go the same way, once, to write the question Kept asks you afterwards. Answers come only from your own notes, with the note they came from.

Each request is answered and the result returned to your phone. We keep no database of your notes and do not log their content. Deepgram and Anthropic run as a service with zero data retention: the request is deleted once answered, kept by neither of them, and never used to train their models. Nothing reaches your journal unless you confirm the note in the app.

We use trusted third-party providers to run Kept: Deepgram (transcription) and Anthropic (extraction, names in a note, follow-up and plan questions, briefings and Reflect), both as a service with zero data retention; Vercel (the API and this website); RevenueCat (subscription status); Supabase (usage diagnostics and feedback messages); and Resend (sending feedback, contact and waitlist email). These providers process data only to perform the service on our behalf, under data processing terms that give your data the same or equal protection as this policy: they may not use it for their own purposes, including training models, and the AI providers keep nothing once the request is answered. We do not share your data with advertisers, data brokers, or social platforms.

• We do not sell or rent your personal information.
• We do not use your journal content to train advertising profiles.
• We do not build a social graph or share your notes with other users.
• We do not read your journal. Our team has no access to your on-device data.

You are in control of your data at all times through the Kept app settings:

• Confirm before saving. Every note passes through a review step. Nothing is saved without your explicit approval.
• Export everything. You can export all your data from Settings at any time.
• Delete everything. You can permanently delete all people, notes, and facts from Settings. This action is irreversible.
• Optional recordings. You can choose whether to keep audio files alongside notes on your device.
• Send notes to AI. The permission behind every note. Off, nothing is sent and Kept asks again before the next note.
• Follow-up questions. After a note, Kept may ask one question to fill in a detail. You can answer, leave it, or turn the questions off in Settings.
• Lock Kept. Ask for your device passcode or biometrics whenever the app opens.

If you subscribe to Kept+, payment is processed by Google through Google Play or by Apple through the App Store. We do not receive your payment card details. Subscription status is managed through RevenueCat; we receive only the information needed to verify your plan.

With your permission, the Kept app sends limited, pseudonymous usage diagnostics so we can see which parts of the app work — for example, that onboarding was completed, that a note was filed, or that the subscription screen was shown. Each event carries only a fixed event name, the app version and platform, and a few predefined categories (such as “2–3 people”), tied to a random identifier created for that install.

Diagnostics never include your notes, transcripts, recordings, photos, contacts, names, places, searches, or any advertising or hardware identifier. They are stored in a separate analytics database, are never combined with your journal (which stays on your device), and are never shared with advertisers or data brokers.

Detailed events are deleted after 90 days; after that only daily totals remain, for up to 24 months. In the European Economic Area, the United Kingdom and Switzerland, diagnostics stay off unless you turn them on; elsewhere they are on by default. You can turn them off, or delete the diagnostics already sent, at any time in the app’s Settings.

When you write to us from the app (Settings → Something not working?) or through the contact form on this website, we store your message so we can read it and reply. It is kept with your email address if you give one (the app does not require it), the app version, phone system and language. It is not linked to your journal, which stays on your device, or to the usage diagnostics identifier.

Messages are deleted two years after they arrive. To have yours deleted sooner, write to us and we will remove it.

This website (keptjournal.com) uses Vercel Web Analytics to count page visits, which does not use cookies. We do not use third-party advertising trackers.

Kept is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Continued use of Kept after changes constitutes acceptance of the updated policy.

Questions about privacy? Email us at renato@bulholabs.com.