Keepsake Privacy
Keepsake has no accounts, no ads and no tracking. What you write stays on your devices and in your own iCloud.
In short
- Your journal entries, photos and tags are stored on your device and, if you turn on iCloud sync, in your private iCloud database. We have no server that holds them and can't read them.
- Anonymous usage statistics are off until you turn them on. You can see every byte that is sent, and turn it off again at any time.
- Purchases go through the App Store. We never see your name or payment details.
- No advertising, no tracking, no data sold or shared for marketing.
Your content
Keepsake saves your journal entries, photos and settings on your device. If you have Keepsake Pro and turn on iCloud sync, they are also saved in your private iCloud database (CloudKit) and synced between your devices. That data belongs to your Apple Account; only you can read it, and Apple's iCloud terms apply. We do not receive it.
Exporting is always free and goes to a place you choose.
Summaries, moods and insights are created on your device by Apple Intelligence (Foundation Models). Your entries are not sent to us or to any server for this; the results are saved with the entry and sync through iCloud like the rest.
The journal PIN is never stored: the device keeps only a salted hash in the keychain, readable only on that device. Face ID is handled by iOS; the app never receives any biometric data.
Widgets read the same data on your device through an App Group, and the Apple Watch app receives a read-only copy from your iPhone, directly between the devices.
Usage statistics (optional)
Usage statistics are off by default. The app asks once, after your first saved entry, and you can change your mind in Settings → Usage Statistics. Nothing is sent before you agree. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25 TDDDG). Turning it off stops sending and deletes events that were still waiting.
What it is for: counting how many people use Keepsake (total, per day, per month), how often it crashes and which features are used, so we know what to improve. It is not about you.
What is sent (Settings → Usage Statistics → What We Send shows it word for word):
- the name of the event: first start after you agreed, active day, active month, a crash, a settings snapshot (only on/off flags such as iCloud sync, journal lock, Face ID), or a feature that was used (each at most once per day), including the purchase steps mentioned above;
- app version and OS version (major and minor only);
- device model (for example
iPhone18,1) and your language (code only, such asde); - whether it is a debug build;
- a random session number, shared by the events of one app session and kept only until they are sent.
Never sent: any journal entry content, titles, tags, photos, counts of them, a device, user or install ID, your region or time zone, or timestamps finer than a day. Events carry no free text by design.
Events go to Aptabase (EU cloud, eu.aptabase.com), an open-source analytics service that acts as our processor. Like any server, it sees your IP address when the request arrives. Aptabase does not store the IP address; it keeps a hash of IP address and user agent with a salt that changes daily, and the country and region derived from the IP address. We do not use that hash to count people: users are counted from the once-per-day and once-per-month events the app itself de-duplicates on your device.
Crashes: when sharing is on, a crash is counted as one event without details (no stack trace, no error type). Separately, if you allow iOS to share analytics with app developers (Settings → Privacy & Security → Analytics & Improvements), Apple gives us aggregated crash and usage numbers in App Store Connect and Xcode. We can't identify you from them.
Purchases
Keepsake is free. Keepsake Pro is a yearly subscription (with a free trial) or a one-time lifetime purchase, processed entirely by Apple. We don't see your name, payment method or Apple Account. The app checks your purchase on the device with StoreKit; there is no receipt server and no account of ours.
If you share anonymous statistics (below), the app counts purchase steps such as “free trial started” or “lifetime purchased” like any other event, without price, name or any ID.
What we don't do
No advertising and no advertising or tracking SDKs. No user accounts. No profiles. No cookies or trackers in the app. No selling or sharing of data for marketing. Nothing leaves your device that isn't described on this page.
Your rights
Under the GDPR you have the right to access, correction, deletion, restriction, objection and data portability, and you may withdraw consent at any time (with effect for the future). You may complain to a data protection supervisory authority.
Because the statistics carry no ID and we hold no account data, we usually can't tell which statistics belong to you. Your content lives in your own iCloud, where you manage and delete it yourself (see Support). For anything else, write to us.
Who is responsible
The controller for the Keepsake app is the provider named in the Impressum. Contact for data protection questions: contact@zngapps.com.