Keepy Privacy Policy
1. Who we are
Keepy is an app that helps you keep track of the food at home and eat it before it goes bad.
The controller of your personal data is Fery, a solo developer based in West Jakarta, Indonesia ("Keepy", "we", "us"). Contact for anything in this policy: hello@getkeepy.app.
Keepy has no office in the European Union or the United Kingdom. We have not appointed a representative there under Article 27 of the GDPR or the UK GDPR: the data of people in the EU and UK that reaches us is occasional, mostly pseudonymous and low-risk (Article 27(2)). If you live in the EU or the UK, write to us directly at hello@getkeepy.app.
2. The short version
- Keepy works without an account. Your items, dates, places and settings stay on your phone.
- We do not sell your data, we do not show ads, and we do not track you across apps or websites.
- Expiry dates are read on your phone. They are never sent to an AI.
- A photo of a pack front is sent to a third-party AI service only when we don't know a product by its barcode, and only after you allow it. You can withdraw this at any time in Settings › Scanning.
- You can export your data (CSV) and delete it on the phone, inside the app. You can also delete your server data inside the app: signed in, your account and its data (Settings › Delete account); without an account, this phone's data (Settings › Data & privacy › Delete this phone's data from Keepy's server). If the in-app path isn't available, write to hello@getkeepy.app and we delete it for you.
3. What we collect, why, and on what legal basis
"Legal basis" is the reason the EU and UK GDPR (and Indonesia's UU PDP) allow us to use the data.
| Data | When | Why | Legal basis (GDPR / UU PDP) |
|---|---|---|---|
| Your kitchen: items, sizes, places, expiry dates, eaten / wasted / removed history, optional prices, your answers in the first run (name, household, shopping and waste habits, goals, reminder time), app settings | Always, on your phone only (unless you sign in, below) | To run the app | Not sent to us. If you're signed in: contract (Art. 6(1)(b)) |
| Device id: a random id the app makes when it is installed (not the advertising identifier) | With every request to our server | To count your free scans, to know which purchases belong to this phone, to stop abuse | Contract (6(1)(b)); legitimate interest in preventing abuse (6(1)(f)) |
| Scan counts: when a scan was counted, barcode or pack scan, the 30-day window | When a scan finds a product | The free plan: 50 scans per 30 days, up to 10 of them AI pack scans | Contract (6(1)(b)) |
| IP address, stored only as a hash: a shortened, keyed hash of your IP address, made with a secret key that only our server holds; the address itself is not stored | On pack reads, on the first app check, and when a wrong household invite code is entered | Rate limits per network, so one network can't use up the AI or guess invite codes | Legitimate interest in security and abuse prevention (6(1)(f)). A hashed IP address is pseudonymous data, and we treat it as personal data |
| App Attest key: a key made by your iPhone that the app uses to sign its requests, so the server can check they come from a genuine Keepy app | Once per install, then each request is signed with it | Security: keeping other software from using our server | Legitimate interest in security (6(1)(f)) |
| Barcodes you scan | Each barcode lookup | To find the product in the Keepy catalog or in Open Food Facts | Contract (6(1)(b)) |
| Pack-front photo | Only when a barcode is unknown (or there is no barcode), and only after you allow the AI read | A third-party AI service reads the product name, brand, size and category from the photo | Consent (6(1)(a); UU PDP Art. 20(2)(a)), withdrawn in Settings › Scanning. "Don't allow" sends no photo |
| What was read from the pack (product name, brand, size, category, text on the pack) and your corrections when you confirm or edit a product | When a pack is read and when you confirm it | To name the product for you, and to add it to the shared Keepy catalog so the next person doesn't need a scan | Contract (6(1)(b)); legitimate interest in a shared product catalog (6(1)(f)). The catalog holds product facts, not facts about you |
| Shared pack-front photo | Only if you turn on "Share pack-front photos" (off by default) | Kept as evidence for the product in the shared catalog | Consent (6(1)(a)) |
| Date photos | Never, unless a separate "help train date reading" choice is added later and you turn it on. There is no such choice in the app today | — | Consent, if ever asked |
| Account (optional, only if you sign in with Apple or Google): the provider's stable account id, the device ids linked to it, sign-in times, session tokens stored only as hashes. No email address and no name are stored. | When you sign in | To sync your kitchen between phones and to keep your Pro plan with your account | Contract (6(1)(b)) |
| Synced kitchen (only when signed in): the same item events as on your phone (items, dates, places, prices, who added or changed what). When shared households become available: the household name, members and their roles, the display name you choose for a household, invite codes | When you use sync or a shared household | To keep the same kitchen on every phone and with the people you share it with | Contract (6(1)(b)) |
| Purchases: which plan, start and end dates, trial, renewals, refunds. Card details are handled by Apple; we never see them | When you buy, renew or restore Keepy Pro | To give you Pro | Contract (6(1)(b)) |
| Crash reports from Apple (only if you chose to share analytics with app developers in your iPhone's settings): what the app was doing when it crashed, phone model, iOS version, app version. Apple doesn't tell us who you are | When the app crashes | To fix bugs | Legitimate interest (6(1)(f)), based on your choice in the iPhone's settings |
| Usage data (only while "Send anonymous usage data" is on): what you do in the app, as small named events such as "item marked eaten", "filter used" or which step of the first run you reached, with codes and counts only. No item or product names, barcodes, photos, prices, dates of your items, notes or anything you typed. Each event carries a random id made on this phone (not your account or device id), the app version, language, currency, plan and how many days since install | While you use the app, if usage data is on | To see which parts of Keepy help and fix what doesn't | In the EU, EEA, UK and Switzerland: consent (6(1)(a)); it is off until you turn it on. Elsewhere: legitimate interest (6(1)(f)); you can turn it off at any time |
| E-mails you send us | When you write to hello@getkeepy.app | To answer you | Legitimate interest (6(1)(f)) |
| Feedback you send in the app (Settings › Help › Send feedback): what it's about, your message, an e-mail address only if you add one, and, while "Include app details" is on, the app version, iPhone model, iOS version, the app's language and your plan. No items, photos or device id go with the app details | When you send it | To read it, fix problems and reply if you asked us to | Legitimate interest (6(1)(f)) |
We don't collect: your location, contacts, health data, the advertising identifier (IDFA), browsing history, or anything for advertising. Keepy has no crash-reporting or advertising tools of its own. Usage data is never linked to your account, and "Delete all data" and "Delete account" reset its random id. In the EU, EEA, UK and Switzerland it starts off; elsewhere it starts on, and the first run shows the switch ("Your choices") before anything is sent. You can change it any time in Settings › Data & privacy › "Send anonymous usage data"; turned off, nothing more is sent and anything waiting on the phone is dropped.
Photos from your library, camera, notifications and widgets
- The camera reads barcodes and dates on your phone. Only the pack-front photo described above leaves the phone.
- "From photos" reads the photos you pick on the phone in the same way. Nothing else in your library is read or sent.
- Reminders are local notifications made on your phone. Keepy doesn't use push notifications.
- Widgets show data from your phone and send nothing.
This website
- getkeepy.app sets no cookies and has no ads or trackers. Cloudflare, which serves the site, processes your IP address and the request (page, browser, time) to deliver the pages and protect the site. To count visits, the site uses Cloudflare Web Analytics, which works without cookies or anything else stored in your browser, and shows us only totals: visits per page, the site you came from, the country, the type of browser and device, and how fast pages load.
- The site opens in Indonesian if your browser prefers Indonesian, and in English otherwise. If you pick a language in the menu, your browser remembers that choice for your next visit. It is stored only in your browser, is not a cookie, and is never sent to us.
4. The AI read
When Keepy doesn't know a product by its barcode, it can read the front of the pack with a third-party AI service, in the United States, through Keepy's server.
- Before the first photo is sent, the app asks you. It explains what is sent (the photo of the pack front), to whom (a third-party AI service in the United States, through Keepy's server), why (to name the product) and how long it is kept.
- If you say no, no photo is sent, and everything else still works: barcode scans, typing the name, and quick pick.
- You can change your answer at any time in Settings › Scanning › AI pack read; "What is sent to the AI" on the same page shows the screen again. "Share pack-front photos" is a separate choice on the same screen, off unless you turn it on.
- We store, on your phone, the version of the text you answered and the date. When you share pack photos, that version goes with each shared photo.
- The photo is sent with the device id and a scan id, but no name, account, location or photo metadata.
- The AI service processes the photo for us as a processor, under a data processing agreement. Under its commercial terms it does not use the photo to train its models, and it deletes the photo within 30 days, unless it has to keep it longer to investigate misuse of its service or because the law requires it. Keepy's server doesn't keep the photo unless you share pack photos.
- A product the AI read is labelled "Read by AI · check it" in the app until you save it.
- Expiry dates are never sent to the AI. They are read on your phone.
- The AI result is a suggestion. No decision with legal or similarly significant effect is made about you by automated means.
5. Who receives data (processors and other recipients)
We share data only with these companies, only for the purpose given, and they act for us (processors) unless stated.
| Recipient | What | Why | Where | Role |
|---|---|---|---|---|
| Cloudflare, Inc. (Workers, D1 database, R2 storage, Durable Objects) | Everything that reaches our server (table in §3) | Hosting our server and database | Requests are handled on Cloudflare's global network; the database and photo storage are kept in the Asia-Pacific region | Processor, under Cloudflare's DPA |
| AI service provider (a third-party AI service) | Pack-front photos of products we don't know (only after you allow it) | Reading the product from the photo | United States | Processor, under the AI service provider's DPA |
| RevenueCat, Inc. | Device id as "App User ID", purchase history from Apple | Managing Keepy Pro subscriptions | United States | Processor, under RevenueCat's DPA |
| PostHog Inc. | Usage data (only while it is on), without IP addresses: PostHog is set to discard them | Counting which parts of Keepy are used | European Union | Processor, under PostHog's DPA |
| Discord Inc. | Feedback you send in the app: what it's about, your message and the app details (never your e-mail address or device id) | Notifying us that a message arrived | United States | Processor, under Discord's terms of service |
| Apple | Purchases and payments, Sign in with Apple, App Attest, and crash reports if you chose to share them | App Store payments, sign-in, app checks, crash reports | United States and others | Independent controller, under Apple's own privacy policy |
| Sign in with Google (only if you choose it). Keepy asks Google only for a sign-in token without your name or email; Google's page opens in the phone's browser | Sign-in | United States and others | Independent controller, under Google's own privacy policy | |
| Open Food Facts (Open Food Facts association, France) | The barcode you scan (sent from our server, not your phone; no device id) | Looking up products we don't know yet; showing their front photo with credit | France / EU | Public database. Its data and photos are under ODbL / CC BY-SA and are credited in the app. Keepy sends it nothing but the barcode |
| People in your shared household (when shared households become available) | Items, events and your display name in that household | You chose to share a kitchen | — | Other users |
| Authorities | Only when the law requires it | Legal obligations | — | — |
We don't sell or rent personal data to anyone.
6. Transfers outside your country
Some of our service providers are in the United States, and our server's data is stored in the Asia-Pacific region. When data leaves the EU, the UK or Indonesia, we rely on:
- for the EU and UK: the EU–US Data Privacy Framework where the provider is certified under it, and otherwise the European Commission's Standard Contractual Clauses (and the UK Addendum) in the providers' data processing agreements;
- for Indonesia: UU PDP Article 56, by making sure the receiving country has equal or higher protection, or that appropriate and binding safeguards are in place (the providers' data processing agreements), and otherwise by asking for your consent.
7. How long we keep data
| Data | How long |
|---|---|
| Your kitchen on the phone | Until you delete it, use Delete all data, or remove the app |
| Device id, scan counts, App Attest key | While Keepy is in use on that phone. Deleted when you delete this phone's data or your account in the app, or when you ask us |
| IP hash | Wrong invite-code attempts: 1 day. One-time app-check challenges: 1 hour. Pack reads: with the record of that read, until this phone's data or your account is deleted |
| Pack-front photo sent to the AI service | Not stored by Keepy unless you share pack photos. At the AI service: deleted within 30 days (see §4) |
| Shared pack-front photo (only if you turned sharing on) | 30 days; if the product is then confirmed, kept as evidence for that product, with photo metadata (EXIF) removed. Deleted when you turn sharing off, delete this phone's data or delete your account |
| Product facts in the shared catalog (names, sizes, categories, text on the pack) | Kept, because they describe products, not people. When you delete this phone's data or your account, the link to your device ids is removed |
| Records of pack reads (AI cost, result) | Kept for cost and quality checks. The device id and IP hash are removed when this phone's data or your account is deleted |
| Account | Until you delete it. A record with only the account number and the creation and deletion dates stays, so shared households keep working |
| Sign-in sessions | Access 1 hour; refresh 60 days from the last use. Ended sessions (signed out, expired, replaced, or ended by deleting the account) are kept 30 days after they end, then removed |
| Synced kitchen and households | Until you delete the item, leave the household, or delete your account |
| Purchase records | As long as they're needed for Keepy Pro. Deleting your account deletes Keepy's purchase records for it. Deleting only this phone's data keeps the record that links the Apple purchase to this phone, so a restore still works. Apple and RevenueCat keep their own records under their policies; RevenueCat deletes its record on request |
| Usage data at PostHog | 1 year, then deleted by PostHog. To have it deleted sooner, write to hello@getkeepy.app |
| E-mails to us | 2 years after our last message, unless we need them longer to deal with a legal claim |
| Feedback sent in the app | 2 years, then deleted. Deleted sooner when you delete this device's server data or your account. The notification in our Discord channel is deleted by hand along with the message |
8. Your rights and how to use them in the app
You can use these rights for free. Some of them work directly in the app; for the others, write to hello@getkeepy.app.
| Right | How |
|---|---|
| See and get a copy of your data (access, portability) | Settings › Data & privacy › Export to CSV gives two files: your items and their history. Your first-run answers and settings aren't in the files; you can see and change them in Settings. For data on our server (scan counts, account, synced data), write to hello@getkeepy.app |
| Correct it | Edit any item in the app. For an account or household name, change it in the app or write to us |
| Delete it on the phone | Settings › Data & privacy › Delete all data removes every item, history entry and setting from this phone |
| Delete it on our server | Signed in: Settings › Delete account (at the bottom of Settings) deletes your account, its sessions and its synced data, for every phone linked to it; your own items in a shared household are deleted too. Not signed in: Settings › Data & privacy › Delete this phone's data from Keepy's server deletes this device's server data (device id, scan counts, app-check key, shared pack photos); the record that links an Apple purchase to this phone stays. If the app can't do it (for example the phone doesn't support App Attest), write to hello@getkeepy.app and we delete it |
| Withdraw consent | Settings › Scanning: turn off "AI pack read" (no pack photo is sent any more), and turn off "Share pack-front photos" (the photos this phone shared are deleted from our server, and new ones are not stored). Settings › Data & privacy: turn off "Send anonymous usage data". This does not affect what was done before |
| Object to use based on legitimate interest, and restrict use | Write to hello@getkeepy.app |
| Complain | To your data protection authority (EU: your country's authority; UK: the ICO; Indonesia: the personal data protection agency, or the Ministry of Communication and Digital Affairs until the agency is in operation). Please write to us first so we can help |
Subscriptions: deleting the app or your account does not cancel a Keepy Pro subscription. Cancel it in your iPhone's Settings › [your name] › Subscriptions.
After a delete, product facts in the shared catalog stay without your device ids (§7). We answer requests within 3 × 24 hours where UU PDP sets that limit (for example access, correction, or stopping processing after you withdraw consent), and all other requests within 30 days. We may ask you to prove the data is yours, for example by sending the request from the app.
9. California (CCPA / CPRA)
- We do not sell or share your personal information (as "sell" and "share" are defined in the CCPA), and we have not done so in the last 12 months. We don't use it for cross-context behavioural advertising.
- Categories collected in the last 12 months: identifiers (device id, account id, hashed IP), commercial information (purchase history), user content (pack-front photos, product information), internet activity limited to requests to our server, and crash diagnostics if you share them through Apple. Sources, purposes and recipients are in §3 and §5. We collect no sensitive personal information as defined by the CCPA.
- You have the right to know, delete, correct, and not be discriminated against for using these rights. Use §8, or write to hello@getkeepy.app.
- Keepy may be below the size at which the CCPA applies. We honour these rights for everyone in California anyway.
10. Indonesia (UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi)
- The controller (Pengendali Data Pribadi) is named in §1. Legal bases are in §3: consent for shared photos and for the AI read (§4), contract for the app, legitimate interest for security.
- Your rights under UU PDP (information, access, correction, deletion, withdrawal of consent, objection to decisions based only on automated processing, portability, complaints) can be used as in §8.
- If a data breach affects you, we will tell you and the authority in writing within 3 × 24 hours, as UU PDP requires.
- Transfers outside Indonesia: §6.
- We have not appointed a data protection officer: Keepy doesn't process data on a large scale, monitor people systematically, or process specific (sensitive) personal data (UU PDP Art. 53). For anything about your data, write to hello@getkeepy.app.
- This policy is written in Indonesian and English. For users in Indonesia, the Indonesian version (
/id/privacy) applies if the two differ.
11. Children
Keepy is a household app for adults: you need to be 18 or older, or have a parent's or guardian's permission (see the terms of use). It is not aimed at children, and we don't knowingly collect data from children under 13 (under 16 in the EU, and below the age of consent in your country). If you think a child gave us data without a parent's or guardian's consent, write to hello@getkeepy.app and we will delete it.
12. Security
All traffic between the app and our server uses HTTPS. Requests from the app are signed with App Attest, which lets the server tell a genuine Keepy app from other software. Session tokens are stored only as hashes. IP addresses are stored only as shortened, keyed hashes. Photo metadata is removed before a shared photo is stored. No system is perfectly secure; tell us at hello@getkeepy.app if you find a problem.
13. Changes
If we change this policy, we update the date at the top. If a change affects what we do with your data in a significant way (for example a new AI provider), the app tells you before it applies and asks again where consent is needed.
14. Contact
hello@getkeepy.app West Jakarta (Jakarta Barat), DKI Jakarta, Indonesia