Legal
Privacy Policy
The short version
- Your photos are visible only to the friends the app's rules allow, described below.
- Your contacts never leave your phone in readable form. Keeper sends only one-way codes (hashes) of phone numbers to find friends.
- No ads, no data sales, and no advertising or analytics trackers.
- You can delete what you've posted, and you can ask us to delete your account.
Who we are
Keeper ("Keeper," "we," "us") is a small, invite-only photo-sharing app. If you have any question about this policy or your data, email privacy@thatsakeeper.io.
Information we collect
Information you give us
- Phone number. You sign in with your phone number and a one-time code instead of a password. We keep a hashed form of your number so friends who already have it in their contacts can find you. While a sign-in code is waiting to be used, the number it was requested for is kept with it so the code can be delivered. Codes expire.
- Name and profile photo. The display name you choose and, if you add one, your profile photo.
- Photos and what you write. Photos you add to rolls or send as postcards, their shape (square, horizontal or vertical), captions, roll names and notes, comments, reactions, and the photos you star as favorites.
- Friends and invites. Who you're friends with, friend requests, and invites you send. An invite stores only a hash of the invited phone number. We never store the invited person's name.
Information from your contacts
If you choose Scan Contacts, Keeper reads your contacts on your phone, turns each phone number into a hash on the device, and sends only those hashes to our server to check which ones belong to Keeper users. Names, emails, addresses and the readable numbers in your contacts are never sent to us. We don't keep the list of hashes you send for matching. You can turn off contacts access at any time in iOS Settings.
A hash is a one-way code, but it is not perfect protection. Because phone numbers follow a known format, someone with enough effort and our app's code could work out which number produced a hash. That's why we keep hashes on our server only, under the same protections as the rest of your data.
Information created as you use Keeper
- Activity notifications (for example, "Sam reacted to your photo"), and which rolls, notifications and postcards you've opened or read, so the app can show what's new.
- A sign-in token stored in your phone's secure storage to keep you signed in.
- Standard server logs kept by our hosting provider, such as IP address, time of request and error details, used to keep the service running and secure.
What we don't collect
We don't collect your location, your browsing history, advertising identifiers, payment information or health data. We don't use third-party analytics, advertising or tracking tools, and we don't track you across other companies' apps or websites.
Camera, photo library and contacts permissions
Keeper asks for the camera and photo library only so you can take or choose a photo to add. Only the photos you pick and save are uploaded. Contacts access is used only for finding and inviting friends, as described above. Each permission is optional and can be changed in iOS Settings.
Who can see what
| What | Who can see it |
|---|---|
| A roll you're still shooting | Only the people on that roll. |
| A finished roll | The people on it, plus anyone who is friends with at least one of them. |
| Reactions, comments and notes on a roll | Anyone who can see that roll. |
| Your favorites (starred photos) | You and your friends, but only photos from rolls each friend could already open. |
| Postcards and their comments | Only the members of that postcard conversation. |
| Your name | Your friends, and people on a roll or postcard you share. |
| Your profile photo | You and your friends. |
| Your phone number | No one. Other users never see it from Keeper. |
Photos are delivered through private links that expire after about an hour, so a saved link stops working. Anyone who can see a photo can still take a screenshot of it, so share with people you trust.
How we use information
- To sign you in and keep your account secure, including limiting repeated sign-in attempts.
- To let you find friends, send invites, and connect you as friends when someone you invited joins.
- To store and show your rolls, postcards, comments and reactions to the people allowed to see them.
- To show you activity and unread counts inside the app.
- To fix problems and keep the service working.
We don't use your information for advertising, profiling, or training machine-learning models, and we don't sell or rent it.
How information is shared
- With other Keeper users, as described in "Who can see what."
- With our hosting provider (Render, in the United States), which runs our server and stores the database and photos on our behalf. It may process data only to provide that service and must protect it.
- When you send an invite, Keeper opens your own Messages app with a pre-written text. That message is sent by you, from your phone, through your carrier.
- For legal reasons, if we're required to by law or need to protect someone's safety.
Any service provider we use in the future to deliver sign-in codes by text message will receive only your phone number and the code, and only for that purpose. We'll update this policy before that happens.
How long we keep information
- Your account information, photos and posts are kept until you delete them or your account is deleted.
- Deleting a roll you created deletes its photos, reactions, comments and notes. When the last member leaves a postcard conversation, it is deleted along with its photos.
- Sign-in codes expire within minutes and are not reused.
- Our hosting provider keeps daily backups of the server's storage. Deleted data can remain in those backups for a limited time before they are replaced.
Your choices and rights
- Edit or delete what you post. Remove your photos from an open roll, delete rolls you created, leave shared rolls and postcard conversations, and remove a friend.
- Turn off permissions for contacts, camera or photos in iOS Settings.
- Delete your account. Email privacy@thatsakeeper.io from any address and tell us the phone number on the account. We'll confirm it's you by texting that number, then delete your account, photos and posts within 30 days.
- Get a copy of your data, or ask us to correct it, by emailing the same address.
Depending on where you live (for example, California or the EU), you may have additional rights to access, correct, delete or limit the use of your personal information. Email us to use any of them. We won't treat you differently for doing so.
Security
Data travels between the app and our server over encrypted HTTPS connections. Photos are only reachable through signed, expiring links, and access rules are checked on our server for every request. No system is perfectly secure, and we'll tell affected users promptly if we learn of a breach involving their information.
Children
Keeper is not intended for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has an account, email us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the effective date above. For significant changes, we'll also let you know in the app before they take effect.
Contact
privacy@thatsakeeper.io