Privacy Policy
Kept by Shivam Pal · last updated 5 November 2026
Kept makes a sticker journal from photos. There is no Kept account, advertising or cross-app tracking. We do not sell your personal data.
Where your journal is stored
Sticker cutouts are made on your device. Your journal, original photos, stickers, notes and collections are saved on your device. On Android, Kept disables Android backup for the journal. Uninstalling Kept or clearing its storage removes the journal from that device. On iPhone, the journal can also sync through your private Apple iCloud storage when available. We cannot browse that private iCloud database. Sync depends on your Apple settings and connectivity and may take time.
On Android, you can allow Kept to attach a place to a sticker. Kept uses the location permission you grant and can send approximate or precise coordinates to the Android geocoding service to look up a place name. The coordinates and place label are stored with the sticker on your device. You can decline location access and still keep stickers.
Smart tagging and AI: what leaves your device
Smart tagging is on by default, and you can turn it off at any time in Settings → AI. On Android, Smart tagging sends a resized image of the finished sticker, the selected language and relevant daily challenge criteria through our Cloudflare service to OpenRouter and its model providers. The original photo and saved location are not included in that Android tagging request. On iPhone, while Smart tagging is on, Kept sends resized copies of the source photo and sticker, the capture date, available place context and on-device tags through our Cloudflare server to OpenRouter and its model providers: OpenAI or Google for names and search descriptions, and TypeSafe (Jev) for challenge checks. It may also analyse older stickers that have not been tagged. The iPhone app limits background place context to city/locality and country; it does not send GPS coordinates or the saved street/venue name as metadata. Images can themselves contain personal information.
You can turn Smart tagging off in Settings → AI and continue making stickers, naming them yourself and keeping your journal. An existing off setting stays off. Turning it off stops new AI analysis; it does not recall a request already sent or delete earlier service records. AI results can be inaccurate.
Service records and identifiers
- Install identifier. Kept uses a random identifier for quotas, service operation and abuse prevention. Android keeps it in app storage. It resets if you clear app storage or uninstall Kept. On iPhone it is kept in the device Keychain and can survive reinstallation. Service records can be linked to this identifier and, when you use Pro, to a subscription reference.
- AI request records. Kept’s server sends the generated names and tags back to your device so you can find stickers in your journal. It does not save images, prompts or AI answers in new request logs, including when a request fails. To operate the service, we record request and sticker identifiers, the model and operation used, time, app version, request and image sizes, HTTP status, latency, token counts and cost.
- Purchases: Google Play handles Android purchases. Kept queries Google Play for your subscriptions and uses the product ID, purchase token and purchase state to unlock Pro and acknowledge purchases. Android versions with server verification send the purchase token to our service to check the plan and its expiry with Google Play. We retain a hashed subscription reference for the access check and usage limits. We do not store the raw purchase token. On iPhone, Kept uses Apple-signed product and transaction identifiers, expiry, renewal and refund status to unlock Pro and verify server access. Each store processes its payments. Kept does not receive your payment-card details or store password.
- Abuse prevention: Cloudflare processes connection information, including IP addresses, for network security and rate limiting. On Android, Play Integrity can verify the Kept package, Google Play license and device integrity for an installation. Our service sends the integrity token to Google and stores the registration result. On iPhone, when device verification is configured, Apple DeviceCheck validates an app-generated device token and keeps two bits representing free-plan use. Our service keeps the installation's registration result, not the DeviceCheck token.
- Support: if you email us, we receive the address, message and any attachments you choose to send so we can respond.
- Feedback: if you send a note from Settings → Send feedback, we receive your message, the topic you picked, the app version, operating system version, app language and plan, through PostHog, so we can read it. It is sent even with usage analytics off, because you chose to send it; with analytics on, it carries the same random app identifier as your usage events.
We use service records to operate Kept, diagnose errors, measure reliability and cost, prevent abuse and improve the service. We do not use your journal to target advertising.
Usage analytics
Kept uses PostHog's EU Cloud for product events such as screens visited, onboarding steps, sticker counts, sharing and purchase outcomes. Events include a random app identifier, app version and device/OS details. They are pseudonymous, not anonymous. Photos, journal text and precise location are not included in these events, and IP-based location enrichment is disabled. Session replay and automatic interaction capture are disabled.
On Android, analytics identifiers and preferences are held in app storage and can reset on uninstall or when you clear storage. On iPhone, versions with reinstall measurement retain the random analytics identifier in this device's Keychain, separately from the AI service identifier. It can survive deleting and reinstalling Kept, but it is not synced through iCloud or migrated to another device through a backup. A separate marker in app storage helps us infer a possible reinstall and measure subsequent use; this is not a guaranteed record of an uninstall. We do not use this to identify your Apple Account or combine activity across your iCloud devices. PostHog person-profile processing remains disabled.
These iPhone versions also keep your usage-analytics choice in the device Keychain so an opt-out can survive a reinstall. Keychain persistence depends on the operating system; device erasure or loss of the stored entry may reset the identifier and preference.
Turn off Share usage analytics in Settings → Privacy to stop app analytics and analytics for new AI-limit events. Apple subscription lifecycle events (such as renewal, expiry and refund) are measured separately using a subscription identifier, so purchase reliability can be monitored even when the app is closed. These service records continue independently of the app analytics switch. Analytics events and submitted feedback are retained for up to one year under our current PostHog plan; contact us for deletion requests.
Retention and deletion
To request deletion of your service records, email shibru127@gmail.com with the subject “Kept data deletion” and describe which records you want removed. This can include AI request records, feedback and analytics events. We may ask for information to locate your records. You can remove the journal itself on your device.
On 5 November 2026, Kept stopped saving AI answers in its server logs. Earlier test records follow their original schedule. Answers older than 30 days are cleared the next time a request triggers the hourly cleanup. We keep request metadata for service diagnostics, cost accounting and abuse prevention until it is removed following a valid deletion request. We keep subscription and installation records while needed to restore access, process purchase updates and prevent abuse.
AI providers have their own retention rules. We restrict chat routing to providers that do not train on submitted data. TypeSafe states that it does not train on customer requests or responses. This is not a promise of zero retention: providers may retain data for service operation, safety, fraud prevention or legal obligations. OpenRouter also keeps request metadata and may preserve flagged content for legal/safety review. See OpenRouter data handling and TypeSafe data handling.
Delete individual journal items in Kept to remove them from your journal and connected iCloud devices. Deleting the app alone does not delete your iCloud data or server records. For access, correction or deletion requests, contact shibru127@gmail.com; we may need information to locate and verify the relevant records. Do not email an Apple password or payment-card details. Apple iCloud data can also be managed in iOS Settings → [your name] → iCloud.
Providers and international processing
Cloudflare hosts our service; OpenRouter and the model providers process inputs while Smart tagging is enabled; Google Play processes Android purchases and verifies app and device integrity; Apple supplies iPhone purchases, device verification and iCloud; PostHog processes usage and subscription analytics in its EU Cloud. Processing may occur outside your country. Provider retention and legal obligations may continue after our own records are deleted. We do not claim that a randomly generated identifier makes your data unlinked to you.
Children
Kept is not directed at children under 13. If you believe a child has supplied personal data to our AI service, contact us so we can investigate and address it.
Contact and changes
Shivam Pal · shibru127@gmail.com. We will update this page and its date when our practices change.