Privacy Policy

1. Who We Are

Keepli is operated by Keepli Technologies Inc. ("Keepli", "we", "us", or "our"), based in Ontario, Canada. We are the organisation responsible for the personal information described in this policy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Keepli mobile application (the "App") and the website at keepli.app (the "Site").

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Where you are located in another region, additional rights may apply (see Section 11).

Privacy Officer. We have designated a Privacy Officer who is accountable for our compliance with this policy and applicable privacy law. You can reach them at support@keepli.app.

2. Information We Collect

2.1 Information You Provide Directly

• Account and onboarding data: Your first name, last name and chosen focus areas provided during setup; and, if you create an account, your email address (email sign-in), your phone number (sign-in by SMS code), or the identifier your Apple or Google sign-in provides.
• Vault content: Documents, subscriptions, passwords, receipts, and personal records you save in the App. Stored locally on your device by default.
• Journal and notes: Text you write in program dashboards, the daily journal, or the planning hub.
• Health and wellness data: Data you enter yourself, and readings Keepli reads from Apple Health or Android Health Connect when you connect them, for programs such as sleep, fitness or cycle tracking. Readings from Apple Health and Health Connect (for example steps, sleep, heart rate, weight, workouts and temperature) are read on your device and are not copied to our server. Cycle, period and fertility records you log stay on your device too (and in your encrypted backup, if you use it). If you're signed in, your program logs also sync a copy to your account that is encrypted on your device before it's sent; Section 5.3 explains the key. What you choose to share with someone is described in the next item, and readings from a wearable account you connected directly in Section 6. Health data reaches an AI provider only when you ask an AI feature about it.
• Sharing a program: When you share a program with someone, what they see is stored on our server in readable form so their app can show it. For Cycle, shared with a partner in your Household or with a companion you invite, that is your cycle phase and day, when your next period is expected and, only if you turn it on, your fertile window; never your symptoms, flow, temperatures, test results or notes. For a pregnancy or new-baby program shared with your partner, it is the parts you choose to share, so you can both see and log them. A recovery supporter sees one word, such as "Steady". Tap Stop sharing and a household share's copy is deleted. A companion loses access as soon as you remove them; the last summary you shared with them stays stored, shown to no one, until you delete your account.
• Family Hub data: Names, shared documents, and messages within your family group — stored server-side only when you use the Family Hub feature.
• Location: If you turn on location sharing in your household, your device's precise location is sent to our servers so the members you share with can see it on the household map, including while the App is closed. An SOS sends your location at that moment to your household. During a Check on Me session, the guardians you pick see the location you share with your household; a session doesn't turn that sharing on or off. Location sharing is off until you turn it on, and you can turn it off at any time. Run and walk routes you record stay on your device. To show local weather, a rounded location (about 10 km) is used.
• Contacts: Only if you tap "Invite from contacts", Keepli reads your contacts on your device so you can pick one person. The name you pick is saved as the invite label, and that person's phone number or email is stored only as a one-way hash so the invite can be matched when they sign in. Your address book is never uploaded.
• Age check: Before you start, Keepli asks for your birth year to confirm you are old enough to use it. Only the result is kept (adult or teen, and for a teen the year they turn 18) — never your birth year or birth date.
• Financial data (statement import): If you use subscription detection, you may upload a bank or card statement, or let Keepli scan your Gmail or iCloud mailbox, so Keepli can identify recurring charges. Keepli does not link directly to your bank and never receives your online-banking credentials. See Sections 3 and 6 for how imported content is processed.

2.2 Information Collected Automatically

• Device identifier: A randomly generated device ID (not linked to your Apple ID or Google account) used to associate your data with your device for cloud features.
• Push tokens: If you grant permission, an Expo push token is stored to deliver notifications.
• Analytics events (pseudonymous): In-app events such as screen views and feature taps, keyed to an internal account identifier so we can tell one person's session from another's. Your name, email address and vault content are never attached.
• Crash reports (anonymised): Diagnostic crash reports containing device model, OS version, and a stack trace — never your vault data.

2.3 Information From Our Website

• Early-access list: If you join the early-access list on keepli.app, we store your email address, the part of the page you signed up from, and the time. We send you one confirmation email (via Resend) and one email when Keepli launches; every email has a one-click unsubscribe link.
• Feature requests: The roadmap's "Submit an idea" form opens an email in your own mail app; nothing is sent until you send it. Roadmap votes are stored only in your browser.
• Page-view statistics: Cloudflare Web Analytics counts page views on keepli.app without cookies and without identifying you (see Section 10).

2.4 Information From Third-Party Services

When you connect third-party services (a Gmail or iCloud mailbox for subscription scanning, Apple Health, Android Health Connect, or a wearable such as Fitbit, Oura, Garmin, WHOOP or Withings), Keepli uses only the data necessary to provide the requested feature, and only after you authorise the connection. Readings from Apple Health and Health Connect stay on your device. See Section 6 for details.

3. How We Use Your Information

We use information we collect only for the purposes we identify to you, namely to:

• Provide, operate, and improve the App and its features.
• Personalise your experience based on your chosen focus areas and programs.
• Detect recurring subscriptions from a statement or a mailbox scan, when you use that feature.
• Send push notifications, including daily re-engagement reminders (only with your permission).
• Sync data between your devices when you enable cloud features.
• Process subscription payments through RevenueCat.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.
• Generate aggregated product analytics.

We do not sell your personal information, and we do not use your vault content, journal, health data, or messages to train AI models. If we ever wanted to use your information for a materially new purpose, we would identify that purpose and obtain your consent first.

4. Consent & Legal Basis

Under PIPEDA, we collect, use, and disclose personal information with your consent, except where the law permits or requires otherwise. The form of consent we rely on reflects the sensitivity of the information:

• Express consent for sensitive information and optional features — for example, enabling health tracking, cloud backup, AI features, Family Hub sharing, or location sharing. You choose to turn these on. AI features ask for your permission, naming our AI providers, before anything is sent, and are controlled in Settings › Melo & AI.
• Implied consent for the basic operation you request — for example, storing an item you add to your vault on your own device.
• Withdrawal. You may withdraw consent at any time by turning a feature off, deleting the relevant data, or closing your account, subject to legal or contractual limits we will explain if they apply.

Where the EU/UK GDPR applies to you, our legal bases are your consent, the performance of our contract with you (providing the App), and our legitimate interests in keeping the App secure and reliable.

5. Data Storage & Security

5.1 Local-First Architecture

By default, all vault data, journal entries, and personal records are stored exclusively on your device. This data does not leave your device unless you explicitly enable a cloud feature such as:

• Encrypted Cloud Vault Backup
• Family Hub
• Community features (feed, groups and live audio Pods)
• Program sync while you're signed in (encrypted on your device first)
• Sharing a program with a partner, supporter or companion (as described in Section 2.1)

5.2 Cloud Storage

When cloud features are active, your data is transmitted over HTTPS (encrypted in transit) and stored in a PostgreSQL database with encryption at rest. We restrict access to production data to personnel who need it to operate the service.

5.3 Encrypted Vault Backup

When you use Encrypted Cloud Vault Backup, your data is encrypted on your device using AES-256-GCM with PBKDF2 key derivation before transmission, and we store only the encrypted copy. The key is derived on your device, and we never store it. Where it comes from depends on how you sign in:

• Apple or Google sign-in: from a recovery passphrase you set (until you set one, a random key kept in your device's keychain). Neither is ever sent to us, so we cannot decrypt your backup.
• Email and password: from your account password. Your device also sends that password to our server, over an encrypted connection, each time you sign in so we can check it; we keep only a one-way hash of it, never the password or the key. Because the password does pass through our server, we don't describe these backups as unreadable by us.

The same key encrypts the program logs that sync while you're signed in.

5.4 Safeguards

We maintain physical, organisational, and technological safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, biometric app locks for sensitive categories, access controls, and breach-response procedures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Third-Party Services & Subprocessors

Keepli relies on the following service providers ("subprocessors") to operate specific features. Each processes personal information only as needed to provide its service, and each has its own privacy policy:

• OpenAI & Anthropic (AI): power the AI document scanner, photo analysis you ask for (for example a meal photo or an ovulation-test strip), program insights, journal writing help, subscription detection, and the Ask Keepli (Melo) assistant. When you use an AI feature, the relevant content and the minimum context needed to answer are sent to the applicable provider to generate a response. The provider is selected by feature. If you talk to Melo by voice, your recording is sent to OpenAI for transcription and Melo's spoken reply is generated there too. OpenAI's moderation service also screens Community posts and comments when you publish them, and may check messages to Melo, and text you send to AI writing help and insights, for crisis and safety risks (see our Safety & Crisis Protocol). They process your input on our behalf and do not use it to train their models. OpenAI · Anthropic.
• RevenueCat (subscriptions): receives your Keepli account identifier and purchase information to manage subscriptions. Policy.
• Gmail and iCloud Mail (optional mailbox scan): if you use subscription scanning, you give Keepli your mailbox address and an app-specific password created in your Google or Apple account. Keepli uses it only to read your mailbox over IMAP for that scan, on our server, and does not store the password or your messages. Only the subscriptions you choose to keep are saved. Google policy · Apple policy.
• Wearables — Fitbit, Oura, Garmin, WHOOP, Withings (optional; direct connections are currently switched off in the App): if you connected one, we store the access token the provider issues so Keepli can fetch your readiness, sleep and activity metrics, and the metrics we fetch are stored on our server under your account. Disconnecting removes the token.
• Sign in with Apple / Google Sign-In: if you choose them, Apple or Google confirms your identity to us; we receive the identifier (and, if you allow it, the email) they provide.
• Apple HealthKit / Android Health Connect: if you grant access, Keepli reads metrics (steps, heart rate, sleep, temperature, etc.) on your device to show them in your dashboards and programs. The readings are not copied to our server; we keep only a record of which one you connected and when it last synced. If you share vitals with your household, only the metrics you pick are stored on our server, for the people you pick. Health data is never stored in iCloud and never used for advertising. It is included in the context sent to our AI providers above only if you turn on “Share health with Melo” in Settings › Melo & AI (off by default), and then only a short summary relevant to your question. We never sell this data, share it with advertisers, or use it for advertising.
• Supabase (database) and Railway (application hosting): host the Keepli server and its PostgreSQL database, where server-side account, household and community data is stored with encryption at rest.
• Upstash (Redis): short-lived operational data such as rate-limit counters and live-session routing.
• Cloudflare R2 (object storage): stores your encrypted cloud backups and any media you upload for cloud features. Cloudflare also serves keepli.app.
• Resend (email) and Twilio (SMS): deliver transactional messages — password resets, verification codes, sign-in codes and the early-access confirmation. They receive the address or number the message goes to.
• Apple Maps / Google Maps: render the household live map and place search on your device; your map provider receives the map tiles requested.
• Public reference services: openFDA, MedlinePlus and NIH RxNav (medication information), USDA FoodData Central and Open Food Facts (food search and barcodes), Open Library (book search), MET Norway (weather) and logo.dev (merchant logos) receive only the search term, barcode, rounded location or merchant domain needed to answer — never your name or account.
• PostHog (product analytics): receives the pseudonymous usage events described in Section 9. Policy.
• LiveKit (live audio): provides real-time audio infrastructure if and when you join a live audio Pod (voice room).
• Sentry (crash reporting): receives diagnostic crash reports that do not contain vault content or personal identifiers. Policy.
• Expo (push notifications): transmits push tokens to deliver notifications to your device. Policy.

We do not use advertising networks and do not sell or share your personal information for advertising.

7. Where Your Data Is Processed

Keepli is operated from Canada. When you use cloud features, your information may be stored or processed in Canada, the United States, or other countries where our service providers (Section 6) operate. Personal information processed or stored in another country is subject to the laws of that country, including lawful access by courts, law enforcement, and national-security authorities. We take reasonable steps, through contractual and technical safeguards, to protect your information wherever it is processed.

8. Data Retention

We keep personal information only as long as needed for the purposes described in this policy, or as required by law:

• On-device data stays on your device until you delete it or uninstall the App.
• Server-side account data (including encrypted backups and Family Hub data) is retained while your account is active and is deleted within 30 days of account closure.
• Location history from household location sharing is deleted automatically after 90 days; your latest shared position is kept until it is replaced by a newer one or you close your account.
• Analytics events may be retained for up to 24 months. They are keyed to an internal identifier, not to your name or email.

You can delete your data at any time via Settings → Delete account (the last row in Settings) in the App, or by emailing support@keepli.app. Deleting your account does not retroactively remove analytics events already collected, and new events are generated as you continue to use the App. To have those removed too, email support@keepli.app and we will delete them on request.

9. Analytics & Crash Reporting

Keepli collects a minimal set of diagnostics to keep the app reliable:

• Usage analytics: In-app events such as screen views and feature taps, sent to PostHog and keyed to an internal account identifier. No vault content, names or email addresses are included.
• Crash reporting: Unhandled exceptions send a diagnostic report to Sentry, including device model, OS version, and a code stack trace. No personal data is included.

Neither stream contains your vault content, and neither is sold or used for advertising. You can turn usage analytics off at any time in Settings → Privacy & safety → Share usage analytics; from then on that phone sends PostHog nothing. To have events already collected deleted, email support@keepli.app and we will do it.

10. Cookies & Tracking Technologies

The Keepli mobile app does not use cookies. Our website (keepli.app) uses only essential, first-party cookies necessary for site operation. It measures page views with Cloudflare Web Analytics, which sets no cookies and does not identify or track you across sites. We do not use advertising cookies, cross-site tracking, or third-party analytics cookies. We do not display advertising and do not work with advertising networks that set cookies.

11. Your Rights & Choices

Subject to applicable law, you have the right to the following. You can exercise each of them from within the App or by emailing support@keepli.app; each item says which part works where.

• Access: Request a copy of the personal information we hold about you, and information about how it has been used and disclosed. In the App: everything stored on your device, and what our servers hold for your account, through Export below. By email: what we hold on our servers (for example household, care, location, message and health-reading data), and how it has been used and disclosed.
• Export (portability): In the App: in Settings → Backup & data, Export to a file saves what is stored on your device as a file you keep, whether or not your Library has anything in it; Export my account data saves what our servers hold for your account (for example household, care, location, message and health-reading data) as one file; and Export passwords (encrypted) saves your passwords in a password-protected file. By email: a copy of your server-side data in a portable format.
• Correction: Request correction of inaccurate or incomplete information. In the App: edit what you have entered yourself, and change your account email and password in Settings → You & plan. By email: anything else we hold.
• Deletion: In the App: delete your account and all of your server-side data yourself via Settings → Delete account (the last row in Settings); the App then clears its local storage too. By email: delete one kind of data without closing your account, or your whole account if you can no longer sign in or deletion in the App does not finish — email support@keepli.app with subject "Data Deletion Request" and we will verify and delete it for you. See the account deletion page.
• Withdraw consent: Turn off any optional feature, or close your account, at any time.
• Opt out of analytics: In the App: turn off Settings → Privacy & safety → Share usage analytics; that phone then sends PostHog nothing. By email to support@keepli.app: we will exclude your account from usage analytics, and delete events already collected.
• Push notifications: Disable via your device's system settings or Settings → Notifications.

To protect your privacy, we may need to verify your identity before acting on a request — typically by confirming the request comes from the email address associated with your account. We will respond within 30 days, and will explain if we need more time or cannot fulfil a request.

Residents of the European Economic Area, the UK, and California have additional rights under the GDPR, UK GDPR, and CCPA respectively, including rights to portability and to object to certain processing.

12. Children & Family Data

Children as users. Keepli is not directed at children under 13 (or under 16 in the EEA), and we do not knowingly collect personal information from children to create their own account. The age check described in Section 2.1 stops anyone below that age from continuing. If you believe a child has provided us information, contact us and we will delete it promptly.

Teens (13 to 17). Teens can use Keepli with extra protections: community features are read-only, Melo follows stricter rules (see our Safety & Crisis Protocol), and the Duo and Family plans can only be bought by an adult.

Information you store about others. Keepli lets you keep records about your family — for example, a child's care records, medications, or documents. When you add information about another person, you are responsible for having the authority to do so, and that information is treated with the same safeguards as your own. In a Household or Family Hub, content you share is visible to the members you invite; you can remove shared content or members at any time. You can also invite people outside your household to follow a care plan. They see only what you choose, can't change anything, and you can remove them at any time. When you close your account, the server-side data you own is deleted as described in Section 8.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated "Last updated" date and, where practicable, an in-App notice. Your continued use of Keepli after changes take effect constitutes acceptance of the updated policy.

14. Contact & Complaints

If you have questions, requests, or complaints about your privacy or this policy, please contact our Privacy Officer:

• Keepli Technologies Inc. — Privacy Officer
• Ontario, Canada
• Email: support@keepli.app

We will work with you to resolve any concern. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or your provincial or regional privacy regulator.