Privacy Policy
Last updated: 19 August 2026
The short version
There is no account, no analytics, no advertising and no third-party tracking. Unless you turn sharing on, nothing you enter leaves your phone.
If you do turn sharing on, records are encrypted on your phone before they are sent. Our server holds ciphertext it cannot open — nobody, the developer included, can read what is in it.
What is stored
Everything you enter in the app — the name and date of birth of the person you track, feeding, medication, sleep, measurement and output records, notes and your settings — is kept in a database file in your device’s own storage.
That data may be included in your iPhone’s own backups (iCloud Backup or a computer backup). That backup happens between you and Apple; Keeper has no access to it.
Who can see it
With sharing off: only people who can unlock your phone.
With sharing on: also the person you gave the joining code to. Anyone who has the code can join the record, so send it only to someone you trust.
The developer cannot reach your records in either case.
What exactly is sent when sharing is on
For two people to keep one log, rows have to travel between two phones. That happens through our own server (running on Cloudflare), which we deliberately built unable to read them:
- Encryption happens on the phone. Every row is encrypted with AES-GCM before it leaves your device. The key lives only on the phones that know the joining code, and is never sent to the server.
- What the server sees: a random room name, a meaningless per-row handle, and ciphertext. No name, amount, time or note is readable.
- What is never sent: your name, email, phone number, Apple ID, device identifier or location. There is no account to create.
- Retention: superseded versions of a row are deleted 30 days after a newer one arrives. “Stop sharing” detaches your device from the room.
- If you would rather no data sat on a server at all, even encrypted, simply never turn sharing on — the app works fully without it.
Export and deletion
You can export all of your data as a single JSON file from the Settings screen. Where you keep that file is your decision; once you share it, it is in your hands.
Deleting the app deletes every record on the device. Deleted data cannot be recovered, which is why regular backups are recommended.
Notifications
Reminders are scheduled locally on your device. No push notifications are used and no reminder content passes through any server.
Children’s data
The app may be used to record the care of an infant. Those records, like all others, remain on the device and are never transmitted. Keeper does not collect data from children.
This website
The app collects nothing; this website counts how often it is visited. The counter runs on our own server (no third-party analytics) and records only the name of the page viewed and its language. No cookies are used, no IP addresses are stored, visitors are not distinguished from one another, and nothing is sent to any advertising network.
This counting applies to the website only. There is no counter, analytics or tracking of any kind inside the app.
Third parties
Keeper contains no third-party analytics, advertising, crash-reporting or tracking software.
Changes
If this policy changes, this page is updated and the date above is revised.