Privacy Policy

Reciptix LLP (“we,” “our,” or “us”) operates the Keeplea mobile application and website (“the Service”). Reciptix LLP is a limited liability partnership registered in the United Kingdom and is the data controller for personal data processed through the Service. This Privacy Policy explains what we collect, why, who we share it with, and what rights you have.

Summary

• What we collect: the email address you sign up with, the photos you capture or import and the items you save (plus the descriptions Keeplea generates from them), an approximate location for your captures when your device provides one, and basic technical data needed to run the app.

• What we use it for: running the app, understanding your captured photos so you can find them later, sending you the emails you’ve asked for, and improving the product.

• Who we share it with: a small set of trusted vendors that help us deliver the Service (Google/Firebase, Google’s Gemini API, RevenueCat, Bento, and a few others — listed in full below) — the AI assistant you choose to connect, such as ChatGPT or Claude, and Siri when you use it with Keeplea on iPhone (Section 5).

• What we don’t do: we do not sell your data, we do not use your individual photos or saved items for advertising, and we do not use your content to train AI models.

• Your rights: you can access, correct, export, or delete your data at any time. Contact us at support@keeplea.app.

1. Information We Collect

Account Information. When you create an account, we collect your email address (required) and optionally your name and profile photo. If you sign in with Apple, Google, or another authentication provider, we receive the basic profile information that provider chooses to share.

Your Captured Content. This is the data you create as you use the app. It includes:

• Photos (and any documents) you capture, upload, or import from your photo library of physical things you want to remember — for example appliance plates, product labels, paint bags, wine labels, or paperwork

• The descriptions and structured details Keeplea generates from those photos to understand what each item is (such as a product name, type, attributes, and text read from the image)

• Search-derived data we compute from those descriptions (text embeddings) so you can find items by meaning, not just exact words

• Titles, tags, and notes you add to your items

Importing photos. You can optionally import photos you already have to help fill your library. This uses your device’s standard photo picker, which gives Keeplea only the specific photos you select — Keeplea never gets access to the rest of your photo library. Imported photos are handled exactly like the photos you capture.

Subscription and Purchase Data. If you subscribe to a paid plan, we receive subscription status, plan tier, currency, renewal date, and original transaction identifiers from Apple, Google, or RevenueCat. We do not see or store payment card numbers or bank account details — those are handled by Apple and Google.

Shared Collection Data. If you share a collection of items with another user, your display name and profile photo (but not your email address) become visible to the other members of that collection, and theirs to you. Items you add to a shared collection, and the details Keeplea generates from them, become visible to its members.

Location (Optional). Keeplea attaches an approximate location to an item, rounded to city level (roughly 1 km) before it is stored, and uses it only to organize your items by place and detect trips. It comes from the GPS data embedded in a photo, if there is any, or — for photos taken with the in-app camera, and only if you allow the location permission — from a one-time, coarse device location at the moment of capture. We never track your location in the background or over time. The original photo is stored exactly as captured, so any precise GPS data your device embedded in the file stays in it; we use that data only to derive the rounded location. Your photos and their locations go only to the service providers in Section 4 and, if you connect one, an AI assistant, which can open the original files (Section 5). You control all of this from your device: deny or revoke the location permission, or exclude location when you pick or share a photo. Items you have already saved keep the location they were given.

Device and Technical Data. To operate the Service, we automatically collect:

• Device identifiers such as Firebase Installation ID

• App Check attestation tokens, used to verify that requests come from a genuine, untampered copy of the app

• Push notification tokens (so we can send you notifications you’ve enabled)

• App version, operating system, device model, language, and timezone

• IP address (logged automatically by our hosting infrastructure for security and abuse prevention)

• Crash reports and diagnostic logs via Firebase Crashlytics

• Usage events such as screen views, feature interactions, and error rates via Firebase Analytics

What we do not collect. We do not collect advertising identifiers (IDFA on iOS, GAID on Android). We do not access your contacts, your calendar, or your photo library as a whole — only the photos you pick. We use your device’s location only as described above. We do not collect audio: voice search listens only while you are searching by voice, with your permission, and turns your speech into text on your device; the recording is never stored or sent anywhere, and the text is used like a search you typed.

2. How We Use Your Information

We use the information described above to:

• Provide the core functionality of the app — storing your items, syncing across your devices, understanding your photos, letting you find items by searching or asking, and sharing collections with people you invite

• Let an AI assistant you’ve connected read your library when you ask it to (Section 5)

• Process the photos you capture to recognize what each item is and extract structured details and search embeddings, using the third-party AI service described in Section 4

• Send you transactional emails (account confirmation, password resets, and messages you’ve requested)

• Send you lifecycle and product emails (subscription confirmations, important changes, occasional product updates) — you can unsubscribe at any time

• Provide customer support when you contact us

• Detect, prevent, and respond to fraud, abuse, and security incidents

• Measure app performance, fix bugs, and improve the product

• Comply with legal obligations

What we never do:

• We do not sell your personal data to anyone.

• We do not use your individual photos or saved items for advertising or marketing purposes.

• We do not use your content to train AI models, ours or anyone else’s. The AI provider that processes your photos does so only to return a result to us and does not use your content to train its models.

• We do not share your captured content with third parties beyond what is strictly necessary to operate the Service as described in this policy.

3. Legal Basis for Processing (UK and EU Users)

Under UK GDPR and EU GDPR, we rely on the following legal bases to process your personal data:

• Performance of contract — to provide the Service you’ve signed up for, including storing and understanding your items, powering search, and delivering subscription benefits.

• Legitimate interests — to keep the Service secure, prevent abuse, measure product performance, improve the app, and send product and lifecycle messages about features and updates similar to the Service. You can opt out of emails via the unsubscribe link in any message and turn off push notifications in your device settings.

• Consent — for non-essential analytics and advertising cookies on our website (see Section 11), and for the optional location tagging of your captures described in Section 1, which you express through your device’s photo and share controls and, for in-app camera captures, the OS location permission. Where we rely on consent, you can withdraw it at any time (for location, by denying or revoking the permission in your device settings, or by excluding location when you pick or share a photo).

• Legal obligation — where we are required to retain or disclose data to comply with applicable law.

4. Third-Party Services and Sub-Processors

We rely on the following service providers to deliver the Service. Each processes personal data only on our behalf and only for the purposes described.

• Google / Firebase (United States and EU) — authentication, database (Firestore, including vector search), file storage (Cloud Storage), Cloud Functions, App Check (including reCAPTCHA Enterprise on our sign-in pages), push notifications (FCM), crash reporting (Crashlytics), and analytics (Firebase Analytics / Google Analytics 4).

• Google Gemini API (United States and EU) — recognizing and structuring the contents of your photos and generating the text embeddings that power search. Content sent to the Gemini API is processed only to return a result and is not used to train Google’s models.

• RevenueCat (United States) — managing in-app subscriptions, entitlements, and subscription analytics.

• Bento (United States) — sending transactional and lifecycle emails (account confirmation, subscription notifications, product updates).

• Apple (United States) — App Store distribution, in-app purchase processing, and push notification delivery (APNs).

• Google Play (United States) — Play Store distribution and in-app purchase processing.

• Website advertising and analytics (United States) — on our website only, and only with your consent where required: Google Analytics 4, Google Ads, and the Meta (Facebook) Pixel, used to measure traffic and our advertising. These do not have access to your in-app captured content. See Section 11.

We may add or change sub-processors over time. Material changes will be reflected in this policy.

5. AI Assistants and Siri

You can connect an AI assistant — such as ChatGPT (by OpenAI) or Claude (by Anthropic) — to your Keeplea library and ask it about the things you’ve saved. Nothing is shared with any assistant unless you connect it yourself.

Connecting. You approve the connection in the app or on a Keeplea sign-in page (auth.keeplea.app), which names the assistant you are approving. We keep a record of the approval — your account, the assistant, and when it was approved and last used — and store sign-in sessions, codes and tokens only in hashed form. The sign-in pages use Google reCAPTCHA Enterprise against abuse; nothing on them is used for analytics or advertising. You can also create a Keeplea account there.

What the assistant receives. Your account’s email address and whether it is verified (none, if you use Keeplea without an account). Then, when you ask about your things, what Keeplea knows about the items it looks up — their details, descriptions, the text read from your photos, your tags and notes — with links to their photos and original files that expire after an hour. An original file includes any location your device embedded in it; the location Keeplea derives is not shared. An assistant never receives deleted items, items Keeplea identifies as identity documents, medical records or passwords, or details Keeplea keeps hidden, such as a saved Wi-Fi password. When an assistant searches your library, we process its search text with Google’s Gemini API (Section 4) to find matches by meaning; we do not store it, and keep only short-lived counts to prevent abuse.

The assistant is your choice. OpenAI and Anthropic receive this data because you connected their assistant. They are not our service providers: they handle it under their own terms and privacy policies with you, and we do not control how they use or retain it. Please review their policies before you connect.

Disconnecting. You can disconnect an assistant at any time in the app (Settings → AI assistants) or at auth.keeplea.app/account. Its access ends within a minute, and we delete the approval and its tokens. Deleting your Keeplea account disconnects every assistant. Anything an assistant has already received stays with its provider under its terms.

Siri and Spotlight on iPhone. Siri and Spotlight can find your items and answer questions about them, with nothing to connect. When you say “Ask Keeplea” to Siri, your question is sent to us and answered from your best-matching items using Google’s Gemini API; we do not store the question or the answer, and keep only short-lived counts to prevent abuse. On iOS 27 and later, Keeplea also keeps your items’ details, tags, notes and a small copy of each photo in your iPhone’s own search index — built on your iPhone, not sent anywhere by us. Your iPhone’s search shows them from there, and Siri AI reads them from there to answer you; neither sends them to us. Keeplea empties the index when you sign out or turn on App Lock. Neither the index nor an answer from Ask Keeplea ever includes identity documents, medical records, passwords or other hidden details. What Siri shows, does and keeps in its history is handled by Apple under Apple’s terms.

6. Data Storage, Security, and Retention

Where your data is stored. Your data is stored using Google Firebase, primarily in data centers operated by Google. Some data may be processed in the United States or other regions where our service providers operate (see Section 7 on international transfers).

Security. We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest, role-based access controls, App Check, and authentication.

Retention. We retain your account and saved items for as long as your account remains active. When you delete your account — you can do this in the app under Settings, or by contacting us — we delete your personal data and saved items from our active systems within 30 days. Some information may remain in encrypted backups for up to 90 days before being permanently removed. Anonymized usage statistics, security logs, and aggregate metrics may be retained longer for product improvement and compliance purposes. An AI assistant’s approval is kept until you disconnect it or delete your account; connection codes and sign-in sessions expire within an hour, and the counts we keep to prevent abuse are deleted within a day.

7. International Data Transfers

Reciptix LLP is registered in the United Kingdom. Most of our service providers are based in the United States or operate global infrastructure. When your personal data is transferred outside the UK or the European Economic Area, we rely on appropriate safeguards to protect it, including:

• The UK International Data Transfer Agreement and the European Commission’s Standard Contractual Clauses (SCCs)

• The UK extension to the EU-US Data Privacy Framework, where applicable

• Other transfer mechanisms recognized by UK and EU data protection law

8. Data Access by Our Team

Your content is processed automatically by our systems. Our team does not proactively browse or read user data.

Access to individual user data by our team is limited to specific situations:

• Responding to a support request you’ve sent us

• Investigating a technical issue or bug you’ve reported

• Investigating suspected fraud, abuse, or a security incident

• Complying with a legal obligation

9. Your Data Protection Rights

Depending on where you live, you may have some or all of the following rights regarding your personal data:

• Right of access — to ask us what personal data we hold about you and to receive a copy

• Right to rectification — to ask us to correct inaccurate or incomplete data

• Right to erasure — to ask us to delete your data (“right to be forgotten”)

• Right to restriction — to ask us to limit how we use your data

• Right to data portability — to receive your data in a structured, machine-readable format and transmit it to another service

• Right to object — to object to processing based on legitimate interests, including for direct marketing

• Rights related to automated decision-making — we do not make decisions about you that have legal or similarly significant effects based solely on automated processing

• Right to withdraw consent — where we rely on consent, you can withdraw it at any time

• Right to lodge a complaint — you can complain to your local data protection authority.

To exercise any of these rights, contact us at support@keeplea.app. You can also delete your account directly in the app under Settings. We will respond within one month of receiving your request.

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights regarding your personal information.

Categories of personal information we collect. In the past 12 months, we have collected the following categories: identifiers (email, user ID, device identifiers); commercial information (subscription data); internet or other electronic activity (usage events, crash reports); geolocation data (the country/region inferred from IP address, and the approximate location attached to your captures, from photo metadata or a coarse camera-capture fix); and other information you provide (your captured photos and the items you save).

Your CCPA/CPRA rights:

• Right to know what personal information we collect, use, disclose, and share

• Right to delete personal information we have collected from you

• Right to correct inaccurate personal information

• Right to opt out of sale or sharing of personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

• Right to limit use of sensitive personal information

• Right to non-discrimination for exercising your rights

To exercise these rights, contact us at support@keeplea.app. We will verify your request by confirming your identity through the email address associated with your account.

11. Cookies and Tracking Technologies

In the app: the Keeplea mobile app does not use browser cookies. It does use device identifiers and similar technologies (Firebase Installation ID, App Check tokens, push tokens) as described in Section 1.

On our website: our website (keeplea.app) uses cookies for essential functionality and, with your consent where required, for analytics and advertising (Google Analytics 4, Google Ads, and the Meta Pixel). Visitors in the UK, EU, and Switzerland are asked to consent before any non-essential cookies are set, and can decline; you can change your mind by clearing the site’s stored preference.

In our emails: our transactional and lifecycle emails may include open tracking pixels so we can measure delivery and engagement at an aggregate level. If you would prefer not to be tracked in this way, most email clients allow you to disable image loading.

12. Children’s Privacy

Keeplea is not directed at children under 13. The Service is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and you believe your child under 13 has provided us with personal data, please contact us at support@keeplea.app and we will delete the account.

Where local law sets a higher minimum age for consenting to data processing (for example, 16 in some EU/EEA countries under the GDPR), that higher age applies.

For users in the United States: in compliance with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13.

13. Data Breach Notification

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (in the UK, the Information Commissioner’s Office) within 72 hours of becoming aware of the breach, where required by law. If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date below and, for significant changes, notify you by email or through the app. Your continued use of the Service after the changes take effect constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy, want to exercise your rights, or wish to make a complaint, please contact us at support@keeplea.app.

You can also read our Terms of Use.

Last Updated: October 27, 2026