Privacy Policy

Who is responsible

Keep is operated by Ironclad Enterprises LTD, 1 Beckwith Head Road, Cardale Park, Harrogate, HG3 1RY, United Kingdom. We are responsible for the personal information described in this policy. Contact rebecca.hayes@aformely.com for privacy questions or requests.

Our separate Consumer Health Data Privacy Policy explains how we handle information about fitness, nutrition and health, including rights under applicable US state health privacy laws.

Information we collect and where it comes from

• Account: your account identifier, sign-in provider and the name or email you supply. Guest use also creates an identifier. Verification and security records help protect account access.
• Setup and records: answers you provide about age, goals, height, weight, experience, schedule, equipment, joint limitations and nutrition safety; your plans, sets, workouts, measurements, meals, recipes, targets and check-ins. Calculated plans, trends and estimates are derived from these records.
• Photos: images and meal descriptions you choose to submit for analysis, returned estimates and your corrections. Permission to select a photo does not upload your entire photo library.
• Purchases: product, transaction, subscription and entitlement information from Apple, Google and RevenueCat. Keep does not collect full payment-card details through its subscription screens.
• Support: the contact details, messages and optional diagnostic information you submit. Avoid sending passwords, verification codes or unrelated sensitive information.
• Technical information: device/app version, connection information such as IP address, error and security logs, and selected app-usage events when the relevant measurement service is enabled.
• Optional health connections: records you allow Apple Health or Android Health Connect to provide, as explained below.

How and why we use information

We use information to provide the features you request: personalize plans and targets, save and synchronize records, show progress, identify foods, manage account access and subscriptions, deliver service messages, answer support requests and process data exports or deletion. Technical data also helps us prevent abuse, diagnose failures and improve reliability.

Where UK or European data-protection law applies, our grounds include performing our contract with you, complying with legal obligations, and legitimate interests in securing and operating the service where these do not override your rights. Optional processing relies on consent where required. Health information requires an additional lawful condition, including explicit consent where applicable. You can withdraw consent by stopping the optional feature, changing permissions or contacting us; withdrawal does not invalidate earlier lawful processing. This policy itself is not a consent request.

Local records and cloud services

Keep stores supported records on your device for offline use. When cloud services are enabled, supported records synchronize to the account through Google Firebase. Unsynchronized records may exist only on that device. A cloud export may not contain those unsynchronized records. Signing out, uninstalling the app and deleting your cloud account are different actions.

Firebase provides authentication, cloud processing, database, file storage and website hosting. Access to private account records is restricted by authenticated account identity. We use encrypted transport and access controls, but no storage or communication system can guarantee absolute security.

Food photos, AI and food databases

When you request photo analysis, the selected photo and optional description are sent through our backend to OpenAI to identify food and estimate nutrition. Food search terms go to USDA FoodData Central; barcode searches use Open Food Facts. These food database lookups do not send your photo to those databases. Review food identity, portions and nutrition before saving. Manual logging is available without sending a photo for AI analysis.

Keep does not use your submitted photos to train its own AI model. Provider processing and security retention can still apply; we do not promise zero retention. See OpenAI’s business data information. Avoid including faces, documents or unrelated private information in food photos.

Access to a retained meal photo expires after 30 days. Individual private viewing links last up to 10 minutes. Expiry prevents access through Keep; it is not a guarantee that every stored or provider copy is erased at that instant. Saved meal entries have a separate lifecycle. Deleting a Keep copy does not delete the original in your phone’s library.

Optional Apple Health and Health Connect

If you connect a supported health service and grant permissions, Keep can read steps, body weight, body fat, active energy and workout records, and write completed workouts and active energy. Imported samples are stored locally by the current integration and are not uploaded by the account sync or food-analysis features. These samples are not used for advertising. Review or revoke each permission in your device’s health settings. Revoking access stops future access; you may also need to delete previously imported records.

Providers and sharing

• Google Firebase: account and record storage, authentication, hosting, processing and security.
• OpenAI, USDA FoodData Central and Open Food Facts: the food-analysis and lookup processing described above.
• RevenueCat, Apple and Google: subscription status, purchase validation and restoration. Stores handle your payment and apply their own privacy terms.
• Resend and our support email service: delivery of verification, export and support emails. An export email contains a private download link. Support messages may contain health information if you include it.
• PostHog, when configured: selected usage events and an installation identifier. Filters exclude raw questionnaire answers, photos and explicit weight/nutrition values, but event names and exercise activity can still reveal fitness interests. These events are not described as anonymous.
• Sentry, when configured: error diagnostics and technical context. Meta, when configured: registration and trial attribution events, with device tracking subject to applicable device permission controls. Imported health samples are not supplied to these services.

The public policy pages contain no advertising pixels or analytics scripts. Hosting providers can process connection/security logs. We do not sell your health records or meal photos or provide them to data brokers. We share necessary information with service providers to deliver the features described here, and may disclose information when legally required or to protect security and legal rights. We do not make account records public. If a business transfer affects your data, applicable notice and privacy obligations continue.

How long information is kept

We retain account and saved records while needed to provide your account and requested features, unless you delete them or request account deletion. Retention depends on whether the record is needed for an active service, an unresolved support or security issue, a legal obligation or a legal claim; it is not an unconditional promise to erase every record after a fixed interval.

• Questionnaire drafts have a seven-day resume period. Saved setup and plans are separate records.
• Food-photo access expires after 30 days as described above. Generated export links expire after 24 hours; expiry and physical file cleanup are separate operations.
• Email verification codes are short-lived and single use. Security and abuse-prevention records may outlast the code itself.
• Support correspondence is kept as needed to resolve and document the request. Purchase/accounting records may need to be retained for tax, fraud prevention or consumer-law obligations, including by the store.
• Account deletion runs as a background process. Limited deletion markers can remain to prevent old devices or payment events from recreating a deleted account. Where retention is legally required, the retained information is limited to that purpose.
• Local copies, provider logs and any backups can have separate lifecycles. Contact us about removal of those copies; an expired link alone is not proof that every copy has been deleted.

Your choices and privacy rights

Use Account settings to export data or delete your account, and available editing controls to correct records. Manage camera, photos, notifications and health permissions through device settings. For other requests, email rebecca.hayes@aformely.com, including if you cannot access Keep. We may verify account ownership using information proportionate to the request; never send us a verification code or password.

Depending on applicable law, you may have rights to access, correct, delete or receive a portable copy of information, restrict or object to processing, withdraw consent, and opt out of sale, targeted advertising or legally defined sharing. You may use an authorized agent where the law permits. We do not discriminate against people for exercising privacy rights. We respond within the applicable legal time limits and explain any permitted extension or refusal.

California residents can request access to the categories, sources, purposes and recipients described in this policy, correction and deletion, and applicable limits on sensitive-information use or sale/sharing. Contact us to exercise these rights. US consumer-health rights and the appeal process are described in the separate health privacy policy.

You can ask us to reconsider a refusal by replying with “Privacy appeal”. You may also complain to your local regulator. UK residents can contact the Information Commissioner’s Office; EEA residents may contact their local supervisory authority.

International processing

Keep is operated from the United Kingdom and uses US-hosted Firebase backend services. Providers and their subprocessors may process information in the United States, the United Kingdom and other countries where they operate. These countries may have different privacy laws. Where legally required, international transfers must use an applicable adequacy decision or contractual safeguards, including approved standard contractual clauses and UK transfer provisions. Contact us for information about the safeguards relevant to your data. We do not promise that all provider processing stays in a single country.

Adults, updates and contact

Keep is intended for adults aged 18 or older. Contact rebecca.hayes@aformely.com if you believe a child has submitted information. We update this page with a new effective date when practices change; material changes requiring additional notice or consent will be handled as required by applicable law. Please contact us if you need a copy in another accessible format.