Privacy

In short. KEPT has no account. Your Words and proofs live on your iPhone. What leaves it is named below: once you allow it, KEPT's server passes your Word and your proof to Anthropic's model, which reads them; what you share with a witness goes to that one person through your own iCloud; a device profile and crash reports go out unless you switch them off; Weeks you earn are counted on KEPT's server.

Who is responsible

Killian Van Hoof, Route de la Cezille 7, 1272 Genolier, Switzerland. hello@ikept.org. This policy covers the KEPT iPhone app and ikept.org.

What goes where

What	Where	When	How you stop it
The words of your Word, the date	KEPT's server (Google Cloud, Zurich), then Anthropic (United States or another country)	When you continue past writing, once per text	NOT NOW on the KEPT Eye page, or later Settings → "Proof read on KEPT's server" off: nothing is sent; on Review you choose to continue on your word (the Word is kept Declared, never Verified) or to allow KEPT Eye
A reduced copy of your proof photo, the Word, what a photo of it should show	Same	When you take a proof photo	Settings → "Proof read on KEPT's server"
One workout: kind, start, end, length, distance, the app or watch that recorded it. Or your timer's start and end	Same; a timer's run stays on KEPT's server, checked by its rules	When you prove with Apple Health or KEPT's timer	Same switch
The Words you chose, your first name, how each ended, the proof's summary and photo	Your own iCloud, shared with the one witness you invited	SEND THE LINK, and at each change	Invite nobody
Your WITNESSED and SEEN marks, your first name	The author's iCloud	When you tap them	Do not tap
A derived installation code, the Week's Monday, its rank, the instant	KEPT's server	When you earn a Week	—
Apple's signed proof of your plan	KEPT's server, then Apple	When you earn a Month on us and hold a plan	—
A device profile, session counts	TelemetryDeck (EU)	From the first launch, on by default	You → SETTINGS → "Usage stats"
Crash reports, start-up records	Firebase Crashlytics (Google)	Start, crash	Same switch
A check that the app is genuine	Apple and Google	Start, and before each server call	Cannot be switched off

1. On your iPhone

Your Words, their hour and outcome, the proof's figures and times, the judge's few words, your proof photos, your first name if you typed one, which Words you shared, and a random identifier for KEPT's server, drawn by the app. None of this is synced to iCloud in this build; it is part of an iPhone backup if you make one. An older store of the app is opened at launch and synced by iCloud; this build writes nothing to it.

Notifications are written on the phone. The line at your hour quotes your Word and can appear on your lock screen. "Sam saw it." names your witness, never the Word.

Permissions: Camera, for the live proof, never your library. Notifications, asked at your first Word. Apple Health, read-only, asked when a Word needs it. Location and Photos: never asked in this build.

2. Apple Health

Read only for a Word about a run, a walk or a workout, between your signature and your deadline. The sheet lists workouts, routes, steps and sleep; this build reads workouts only, and never writes. The matched workout's distance, length, start and end stay on your phone. That one workout goes to the judge (section 3). Its printed line, such as "5.23 KM · 27:14", goes to a witness only if you share that Word. Nothing else from Health leaves.

3. KEPT Eye

Nothing here happens before you say yes on "KEPT EYE READS YOUR WORD." One switch stops the first three rows above from then on, the reading of your Word included: Settings → "Proof read on KEPT's server".

KEPT's server (Google Cloud, Zurich) receives your Word and your proof, and passes them to Anthropic's model (United States or another country), which reads them. A timer's run is checked by KEPT's server alone. The first three rows above reach the server with the random installation identifier and a request identifier, so the same proof is judged once; neither is passed to Anthropic. The sentence, the photo and the workout travel as they are. Anthropic stores what it receives in the United States, and its model may read it there or in another country: either way, it leaves Switzerland.

KEPT's server keeps the judge's answer for a time — the verdict, a few words on what it saw and what it looked for, any figure it read, the reason it gave — under a random installation identifier. Never your name, never the photo, never the sentence as you wrote it. Anthropic receives no identifier of you. Anthropic deletes what it receives within thirty days, except what its safety systems flag, which it may keep up to two years, and what the law requires it to keep. In detail, under the installation identifier the server keeps one line per call (date, model, size, duration, cost, verdict or whether an answer came back, the kind of proof, the kind of failure); the judge's answer — for a photo the verdict, the few words it wrote about the frame, what it was looking for, the question it asked and any figure it read there; for a workout or a timer its decision, its reason and the few words it wrote about them — so a retry is answered without asking again; and a daily count. Lines and answers carry a deletion date 90 days out, but automatic deletion is not switched on yet, and the counts carry no date. KEPT's own logs record whether the judge answered, its verdict and the kind of failure — never the content. Google keeps technical logs of each request (time, internet address, device type) for its own period. What comes back stays on your phone with the proof.

4. Your witnesses

One person per link. The link holds one empty seat; the first Apple Account to accept it takes the seat. Inviting creates a space inside your own iCloud, shared with that person. KEPT places in it only the Words you choose, one at a time: the words, the hour, when you signed, how it ended; after a kept proof, its source, its printed figures, its times, and the photo at its own size, stripped of place, camera and date. With them, your first name and the time your phone last refreshed the space, at most every twelve hours. Never your Record, your other Words, your other witnesses, the rest of your Health. The invitation message goes by the app you pick and quotes that Word.

Your witness can tap WITNESSED and SEEN; each mark lands in your space with their first name and the time, and iCloud records which account wrote it. A witness who leaves or blocks you writes a note in your space first. Your phone shows their name as Apple lists it on the share. Their phone keeps a copy of what you shared, outside its backup, and deletes it when the space goes. Remove deletes the space. We have no access to it; Apple holds it.

Hide and Block stay on your phone. Report prepares an e-mail to hello@ikept.org with the reason and two identifiers, never a name or a photo; it leaves only if you send it.

5. Weeks and the Month on us

When you earn a Week, your phone sends KEPT's server a code derived from the installation identifier, the Week's Monday, its rank and the instant — nothing of a Word; kept two years. When those receipts reach six, twelve and so on, the server also records, under the same derived code, that a Month was earned — its rank and two instants, nothing of a Word — with no deletion date, so a Month earned and not yet applied outlives the receipts. When you earn a Month and hold a plan, the app sends Apple's signed proof of the plan; the server asks Apple to move your next charge, or signs the offer you confirm yourself. That month is recorded under a scrambled form of the plan's identifier, with no deletion date today.

6. Usage counts, crash reports, Apple

Both are on from the first launch, before you see the switch. One switch stops both from then on: You → SETTINGS → "Usage stats". It changes nothing for KEPT Eye or for your witnesses. They are pseudonymous: a scrambled device identifier, the same on this device every time. This build sends none of KEPT's own counts, but TelemetryDeck's software sends a session start and a new-install signal with a device profile: model, iOS version, language, time zone, screen and text size, dates and counts of use. Crashlytics sends the failing place in the code, the device model, the iOS version, installation identifiers and a short record at each start; Google says it keeps them 90 days, possibly outside Switzerland and the EU. What was already handed over when you switch off can still leave shortly after.

Before each call to KEPT's server, the app proves itself through Apple and Google; no switch. Apple's push service wakes KEPT when a witness writes a mark; the push carries no content. Subscriptions are sold by Apple; we never see your card, your address or your Apple Account. TestFlight sends Apple your feedback and crash logs under Apple's terms.

7. Deleting your data

Settings → Erase my record deletes, on this phone, your Words, Holds, Weeks, photos, notifications, your name, your KEPT Eye answer and the installation identifier (a new one is drawn); removes the rows from your iCloud where your Words are mirrored there (not in this build); and leaves the Words you witness and removes your witnesses through their own doors. It does not reach what was already sent: request lines, judge answers and daily counts under the old identifier, Week receipts, a Month on us already recorded. A Month earned and not yet applied stays yours. Deleting the app removes your Words and photos from the phone — not a shared space, nor what was already sent. A signed Word cannot be edited or deleted one by one.

8. Your rights, children, changes

Under Swiss data protection law and the GDPR you can ask what personal data we hold, and have it corrected or erased. We hold identifiers, not names: request lines and judge answers under a random installation identifier, Week receipts under a derived code, a month record under a scrambled plan identifier; no name, e-mail or phone number unless you wrote to us. Write to hello@ikept.org, or complain to the Swiss FDPIC or your country's authority. KEPT is not directed at children under 13. If this policy changes, the date at the top changes with it; a change that would send something new off your device is announced in the app first.