Privacy Policy

Last updated November 6, 2026

This policy explains what keepr keeps about you, why, who else sees it, how long it stays, and what you can do about it.

keepr is run by KEEPR, LLC, an Oregon limited liability company ("keepr", "we", "us"). Our address is 555 Grandover Ave SE, Salem, OR 97306. Write to us about privacy at privacy@keepr.cloud.

If you keep health information in keepr, also read our Consumer Health Data Privacy Policy. It adds to this policy.

The short version

What you put in keepr is yours. We keep it so we can show it to you and to the people you share it with.
We don't sell your data. We don't use advertising or analytics trackers.
keepr doesn't send your data to any AI service. If you connect your own assistant, it sees what you let it see.
You can export your data and delete your account at any time.

What keepr keeps

Your account

Your email address, first name and last name.
Your password, stored only as a one-way hash. We can't read it.
Two-step sign-in, if you turn it on: its secret and hashed recovery codes.
Your date of birth, if you gave it to us.
That you confirmed you're 16 or older when you signed up, and when.
Your avatar, if you add one.
The IP address and browser you signed up from, and when.
When you last signed in and were last active.
Your preferences: theme, time zone, currency, units, email settings and the like.

What you keep

Your collections, cards and items, and the files you attach.
History. keepr records every change to an item, card or setting: what it was before, what it is now, who changed it, when, and from what IP address and browser. History is how keepr lets you see and undo changes.
Your filters, charts, dashboards, quick adds, forms, automations, tags, pins and follows.
"Me too" confirmations you add on items.
Your consent when you install a health package: which version of the words you agreed to, when, and what you installed. See the Consumer Health Data Privacy Policy.
API keys you create (stored as a hash) and the assistants you connect.

Security and delivery logs

Sign-in log. Sign-ins, failed sign-ins, password resets, key and assistant connections, with the IP address and browser.
Email log. Every email keepr sends you: the address, subject, body (with sign-in and private links removed) and whether it was delivered. The subject and body are removed after 30 days; the rest of the record stays for the 12 months below.
File download log. Each download of an attached file, with the IP address and browser.
Edge firewall logs. Our firewall (AWS WAF) logs requests to the API, including IP addresses. These are kept for 90 days.
Server logs. Each request's IP address, path, result and account id, kept for about a month at most. The server's error logs are kept by number of files rather than by date, so an entry can stay for months, with no fixed limit yet. They record what went wrong, which can include what a failed change contained.

People who use a public form

You can fill in a public form without an account. keepr keeps what you send, the IP address and browser you sent it from, and any photos you attach. Answers the form marks as private go only to the people who manage that collection.

Assistants, the connector and keepr's own tools

keepr itself calls no AI provider. You can connect your own assistant, such as Claude or ChatGPT, in one of three ways. Each of them talks only to keepr.

The connector (mcp.keepr.cloud). You sign in to keepr and choose which collections the assistant can reach and whether it can change things. keepr keeps that connection: which assistant, what it may reach, when you made it and when it was last used. The assistant's requests reach keepr through the connector, and what keepr answers goes back to the assistant. keepr keeps those requests only as it keeps any other: in the server and firewall logs above, and in History when something changes.
The keepr plugin's local server, which runs on your own computer. It reads only the files and folders you or your assistant name, and sends them to keepr to attach to items. Its sign-in is kept on your computer, in your home folder (.config/keepr/credentials), and keepr shows it under your connected assistants with your computer's name.
keepr.py, a script on your own computer that a coding assistant runs. It sends the requests you or your assistant make to keepr's API. Its sign-in, or an API key you stored, is kept in the same file on your computer, readable only by you, and keepr shows it under your connected assistants with your computer's name. It also asks keepr whether a newer version of itself is available.

What an assistant reads goes to that assistant's company under that company's terms, not ours. You can disconnect any of them at any time from your account settings. No assistant or API key can read the private answers sent through a public form.

How keepr uses it

To run keepr: show your items, apply your sharing, run your automations and send the emails you set up.
To keep keepr safe: stop fake sign-ups and abuse, lock out password guessing, scan uploaded files for malware, and investigate problems.
To support you, when you ask.
To tell you about your account and changes to these terms.
To meet legal duties.

keepr doesn't use what you keep for advertising, and doesn't build profiles of you. keepr doesn't train AI models on your data.

Who can see your data

You decide who sees a collection, and at what access level. A public link lets anyone who has it read what it points at, without signing in, until it expires (90 days at most) or you turn it off. A published collection can be read by everyone signed in to keepr.

keepr's administrators

keepr's administrators can open any item when they need to: to answer a support request, to deal with abuse or a security problem, or when the law requires it.

Service providers

These companies run parts of keepr for us. They handle your data only to do that.

Provider	What it does for keepr	What it handles
Amazon Web Services	Servers, load balancer, firewall (WAF), file storage (S3), email sending (SES), message queues (SQS, SNS), monitoring (CloudWatch), malware scanning (GuardDuty). Region: us-west-2 (Oregon)	Everything keepr keeps
MongoDB Atlas	The database, on AWS in us-west-2	Everything except file contents
Google Firebase Hosting	Serves the keepr web app	Your IP address and browser when you load the app
Google Fonts	Serves the typeface the web app uses	Your IP address and browser
Cloudflare Turnstile	The bot check on sign-up, password reset, sign-in after failed tries, and public forms	Your IP address and browser signals
Google Workspace	Our support, privacy and security mailboxes	What you write to us

Maps: when keepr shows a map, its tiles come from keepr's own storage on AWS, so no other company sees where you look. When you choose to open a location in Google Maps, Google sees that location.

When the law requires it

We share data when a valid legal order requires it. Where we're allowed to, we tell you first.

If keepr changes hands

If keepr is sold or merged, your data moves with it. This policy keeps applying until you're told otherwise and given the chance to delete your account.

What we never do

We don't sell your data. We don't share it for advertising.

Cookies and browser storage

keepr doesn't use advertising or analytics cookies.

The web app keeps a few things in your browser's local storage:

your sign-in token, so you stay signed in (up to four weeks, or until you sign out);
your display preferences: theme, layout, list views, recent filters and units;
drafts of items you haven't saved yet.

Clearing your browser's site data removes them. Cloudflare Turnstile, the bot check, is Cloudflare's own code: what it stores in your browser to tell people from bots is set by Cloudflare, not by keepr.

How long keepr keeps data

While your account is open, keepr keeps what you keep, until you delete it.
What you delete can be restored for 30 days. Then it's deleted for good, and within 60 days of the delete it's gone from our backups too. See "Deleting your data" below.
Sign-in, email and file download logs: 12 months, backups included.
The subject and body of emails keepr sent: 30 days.
Edge firewall logs: 90 days.
Server logs: about a month for the request log; the error logs have no fixed limit yet (above).
History of an item lasts as long as the item. Once the item is deleted, its History goes with it after 30 days.
The record of what keepr's administrators did: kept for security, with no end date.
Unconfirmed accounts nobody ever signed in to are closed after 7 days and deleted 30 days later, unless someone has shared a collection with them or written into theirs.

Deleting your data

Gone within 60 days, backups included

When you delete an item, a file or a collection, keepr keeps it for 30 days so it can be restored, then deletes it for good. When you delete your account, the account goes at once and the collections you own get the same 30 days. Within 60 days of the delete, it's gone from keepr and from our backups, except for what's listed under "What stays" below.

The database keeps daily backups for about 8 days, so something deleted for good on day 30 is out of the last backup by day 40.
File storage keeps a deleted file's old copy for 7 days, so a file's contents are gone by about day 41.

Things deleted before 12 November 2026. This schedule starts on 12 November 2026. Items, collections and purged element values deleted before that day, including what's in Recently deleted, can be restored until 12 December 2026 and are deleted for good on that day, with their History; they're out of our backups by the end of December 2026. Files removed earlier keep their own 30 days from when they were removed. A deleted account's collections are deleted 30 days after the account was, and the record of an account deleted earlier is cut down on 12 December 2026.

Deleting your account

You can delete your account from your profile. You'll be asked for your password.

What happens:

At once: your account, keys, assistant connections, public links, preferences, drafts, follows and "me too" confirmations are deleted.
The collections you own are switched off at once and deleted for good 30 days later, with their items, files and History. Within those 30 days we can restore them, except your personal collection, if you ask. Your account itself can't be restored.
After 30 days, the record of your account is cut down to what shows it existed (below), your IP address and browser are removed from the changes you made, and your email address is removed from other people's export records.

Deleting items, files and collections

An item you delete leaves your lists at once. A manager of its collection can restore it from Recently deleted or History for 30 days. Then it's deleted for good, with its History.
A file you remove can be restored for 30 days, then it's deleted. Storage keeps its old copy 7 more days.
A collection you delete can be restored, with everything in it, for 30 days. Then it's deleted for good, with its items, files and History. A deleted collection with a sub-collection that was restored stays until that sub-collection is deleted too.
An element you remove from a card hides its values. They come back if you add the element again. To delete them for good, use the card's purge: the purged values can be brought back for 30 days, then they're gone from the items, though each item's History keeps its earlier values until the item is deleted.
A comment keeps each earlier version of its text while the item exists. One you delete is hidden, unless the card keeps a record of deleted comments, where the item's readers can still read it. Comments go 30 days after the item is deleted.

What stays

What you added to someone else's collection: items, files, comments and imports you put there, and requests you sent to link collections. They belong to that collection now. History stops naming you as the person who made a change, but your name stays wherever it was written into them, such as a title or a value. The same goes for copies a linked collection keeps, and for anything you published in Discover.
Sign-in, email and file download logs: 12 months from each entry, backups included.
Edge firewall logs for 90 days, and server error logs, which have no fixed limit yet.
A record that your account existed: its id, when it was created and deleted, how and why it was deleted, that you confirmed you're 16 or older, and whether you confirmed your email address. No name, email address or date of birth.
Your health package consents, while your account is open (even after you delete the collection) and for 4 years after it's deleted, as evidence of what you agreed to. See the Consumer Health Data Privacy Policy.
What keepr's administrators did about your account or address, an address or domain they blocked, for as long as they keep the block, and an assistant's registration with the IP address it registered from, until their cleanup removes it.
Do-not-mail records: an address that bounced or reported keepr's mail as spam, for as long as the block stands, so mail doesn't go to an address that refused it; and a hash (SHA-256) of your address if you asked to stop receiving someone's scheduled exports, so that request keeps working.
A public form's web address stays reserved, pointing at nothing, so it never leads somewhere new.
Locked records: on a card that locks its items as records, a file removed from an item stays with it.
Settings deleted while their collection or account still exists: cards, tags, rules and notifications, scheduled exports (with the addresses typed into them), filters, charts, dashboards, quick adds and forms, layouts, groups, sharing, public links and the sources a collection syncs from stay restorable until the collection itself is deleted, and a private tag you delete stays until your account is.
An item's own history: while an item exists, its History keeps its earlier values, its comments keep their earlier versions, and an element removed from its card keeps its values hidden on it. They go 30 days after the item is deleted.
Counts keepr runs on: usage numbers per account and per day, and words searched in Discover that found nothing. They hold no name or address.

You can ask us about anything on this list at privacy@keepr.cloud.

Your rights

Wherever you live, you can:

See your data. Everything you keep is in keepr for you to read.
Export it. See below.
Correct it. Edit your profile and your items at any time. History keeps the old values.
Delete it. See above.
Ask us. Write to privacy@keepr.cloud for anything you can't do yourself, such as a copy of your sign-in log. We answer within 45 days. We may need to confirm it's you.

How export works

Anything kept in keepr can leave:

One item: PDF or JSON, with its attachments listed or included.
A list: PDF, Excel or JSON, exactly the items your filter shows.
A collection: PDF or JSON, including its sub-collections; or Export everything, one zip of every item and file in it you can read.
Scheduled exports: a file emailed to you as a link, on a schedule you set.
Files: download any attachment.
Through the API or an assistant: read everything you have access to.

Export everything works one collection at a time. Your account details, your History and your logs come by request to privacy@keepr.cloud.

Security

All traffic to keepr is encrypted (HTTPS).
Passwords, API keys and recovery codes are stored only as hashes.
Two-step sign-in is available.
keepr limits sign-in attempts, checks for bots, and blocks known bad networks.
Uploaded files are scanned for malware.
The database and file storage are encrypted at rest by their providers.

No system is perfectly secure. If you think your account is at risk, change your password and write to security@keepr.cloud.

If something goes wrong

If a breach exposes your data, we'll tell you without unreasonable delay, and within the time the law sets. We'll say what happened, what data was involved and what you can do. We'll tell regulators where the law requires it.

Children

keepr is for people 16 and older. When you sign up, you confirm you're 16 or older. If we learn an account belongs to someone younger, we delete it.

You may keep records about your own children in your account.

Where your data is

keepr stores your data in the United States, in AWS's us-west-2 (Oregon) region. The web app is served from Google's network, which may be closer to you.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change matters, we'll email you or tell you in keepr at least 30 days before it takes effect.

Contact

KEEPR, LLC
555 Grandover Ave SE, Salem, OR 97306
privacy@keepr.cloud