← Home

Privacy Policy

Owner-approved private-alpha policy; not attorney-reviewed. Effective date: October 5, 2026.

Information stored on your iPhone

KEEP? stores the purchases you save, including item and retailer details, prices, dates, return and refund status, order or tracking identifiers, notes and images you attach. It also stores app settings, pending imports and feature credentials in app storage or the iOS Keychain. Apple may include app data in device backups according to your Apple backup settings.

Manual entry, paper-receipt scanning and text recognition from screenshots run on the device. A photo you select through Apple’s photo picker remains in app storage unless it is part of content you deliberately submit for server parsing.

Gmail read-only access

If you choose to connect Gmail, KEEP? requests exactly this Google OAuth scope:

https://www.googleapis.com/auth/gmail.readonly

This permission lets KEEP? view Gmail messages and related metadata. KEEP? uses it to examine message history, first inspect message metadata and then retrieve the content of messages that appear relevant to orders, shipping, delivery, cancellations, returns or refunds.

KEEP? does not request permission to send email, create or change drafts, delete email, modify labels, change settings or mark messages as read. Gmail information is used only to provide and secure the email-import feature. KEEP?’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The service stores an encrypted Gmail refresh credential, an encrypted link to the owner’s KEEP? inbox, a one-way fingerprint of the connected address, Gmail history position and connection health. These remain until Gmail is disconnected. A failed revocation can leave an encrypted revocation record queued until revocation succeeds.

Email forwarding

Instead of connecting Gmail, you may configure your email provider to forward selected messages to a unique KEEP? address. The inbound provider receives the forwarded message and sends it to KEEP?’s service. Your email provider controls the forwarding rule; turning off KEEP? does not itself delete that rule.

KEEP? may extract retailer and item details, prices, currency, order and tracking identifiers, purchase, shipping, delivery, cancellation, return and refund information, and forwarding-verification details. Forwarded messages can contain your name, email or shipping address and limited payment information included by the retailer.

Receipt and email processing

When you submit shared content for parsing, or when a relevant Gmail or forwarded message is processed, KEEP? sends the content needed for that parsing request to its service. This can include the full relevant message and its markup, receipt text, image or PDF because filtering it first could remove order details. Some candidate Gmail and forwarded-message content is transferred to Anthropic’s Claude API as a service provider solely to extract structured purchase or lifecycle information for the user-facing import feature. Deterministic rules handle other messages without model processing where possible.

The raw parsing request is not saved as a receipt archive by KEEP?’s parse endpoint. Anthropic controls its own API processing and retention under the applicable commercial terms and account settings. Anthropic’s published standard API policy says inputs and outputs are automatically deleted within 30 days, subject to stated exceptions such as a different agreement, usage-policy enforcement or legal requirements. KEEP? could not confirm an account-specific shorter-retention setting without entering the provider account, so this policy does not promise one. The service can retain structured records derived from messages:

• Extracted inbox items, including subject and purchase, return, refund or verification information, wait until acknowledged by the app. They have a 14-day freshness window and are removed when cleanup runs.
• Owner-scoped review evidence can include retailer, item, amount, identifiers and short message excerpts. It is encrypted and has a 30-day expiry.
• A rolling diagnostic journal keeps at most 100 recent service entries. It can contain sender information, subjects, excerpts, extracted lines or identifiers and is count-limited rather than age-limited.

Notifications and device identifiers

KEEP? schedules return and refund reminders locally on your device. When remote notifications are enabled, the service stores an Apple Push Notification service device token associated with the owner-scoped inbox so it can notify that installation. Device tokens can rotate. The app requests removal when notifications are unregistered or an inbox is reset, but offline or failed cleanup can leave a token until Apple invalidates it or it is removed operationally. The current registry has no automatic age-based expiry.

The app also creates random, separate installation identifiers for limited purposes. A parse-installation credential authorizes only receipt parsing and is not an administrator credential. A different random identifier is used for the first-party activation events described below.

First-party activation measurement

KEEP? records a small set of onboarding and activation events on its own service. Each record contains a random installation identifier, an approved event name, a server timestamp and limited enumerated choices. It does not accept receipt text, product names, retailers, prices, order numbers, email addresses, inbox aliases or forwarding secrets. Records older than 90 days are removed when another activation event is written and may remain longer if no new event triggers cleanup.

Logs, diagnostics and security

Operational logs record request shape, timing, result and cost information needed to run and protect the service. Receipt contents are excluded by default; merchant names and redacted or truncated identifiers may appear. A development-only debug setting can include a short failed-parse excerpt and is intended to remain disabled in production. Fly.io controls its platform-level operational logs. KEEP? could not confirm a provider-specific retention period without entering the provider account and therefore does not promise a fixed period for those logs.

Authorized operators can access administrative diagnostics, including the count-limited journal’s subjects or excerpts, only when reasonably needed for user-requested support, security, abuse prevention or service diagnosis. Google user data is not used for advertising, credit decisions or unrelated profiling, and human access is limited to the exceptions permitted by Google’s Limited Use requirements.

Network traffic uses HTTPS. Owner data and administrative operations use separate credentials and access controls. Gmail refresh credentials and inbox links, and owner-scoped review evidence, are encrypted at rest by the application. Derived pending-inbox and diagnostic-journal files are stored with restricted file permissions but are not field-encrypted. Gmail history position, connection health and the one-way email fingerprint are also not encrypted fields. These controls reduce risk but no system can promise absolute security.

Service providers

• Anthropic provides model processing for eligible receipt and email parsing.
• Postmark receives and delivers messages sent to KEEP? forwarding addresses.
• Fly.io hosts KEEP?’s application service and its operational logs.
• GitHub Pages is the proposed host for this static public website and may process standard web-request information under GitHub’s terms.
• Google provides Gmail and OAuth when you connect Gmail.
• Apple provides the iOS platform, App Store and optional push-notification delivery and device backups.

KEEP? does not use advertising networks or third-party analytics SDKs. This website has no analytics, advertising trackers, cookies or third-party scripts.

Retention and deletion

Deleting a purchase removes its app record and related local reminders. Resetting a forwarding inbox requests removal of its pending inbox records and alias registration. Because this cleanup is a network request, offline or failed cleanup can leave those records until their freshness window or operational cleanup applies. Push registration, review evidence and diagnostic records have separate deletion or retention paths: the app requests removal of push destinations when it unregisters them; review evidence expires after 30 days or can be removed item by item; and the diagnostic journal remains subject to its 100-entry count limit. Activation records use the 90-day on-write cleanup described above.

Deleting the app removes its app container but may not remove Keychain values, Apple-controlled backups, previously forwarded mail, the forwarding rule in your email account or all server-side diagnostic and activation records. KEEP? does not currently offer a general account portal because the app does not use a conventional user account.

Disconnecting Gmail

You can disconnect Gmail from KEEP?. The service removes the active grant and attempts to revoke it with Google. You can also revoke KEEP? directly from your Google Account’s third-party access settings. Disconnecting Gmail does not delete purchases already saved on your phone or derived inbox, review and diagnostic records already subject to the retention rules above.

Your choices and rights

You can use KEEP? manually without Gmail or email forwarding, decline notifications, delete local purchases, reset a forwarding inbox and disconnect Gmail. Depending on where you live, privacy law may provide additional access, correction or deletion rights. Contact KEEP? using the address below; the operator may need limited information to verify and locate an owner-scoped record.

Age requirement

KEEP? is intended only for people who are at least 18 years old.

Changes to this policy

This policy may change as KEEP? changes. A revised policy will identify a new effective date. Material changes will be communicated through an appropriate product or release notice when required.

Contact

KEEP? is provided by ZENDELI CO. For privacy or support questions, contact support@keepapp.io.