Privacy Policy

Draft One LLC (“Company,” “we,” “us,” or “our”) operates Kept (“App” or “Service”), an app for keeping up with the people you care about. This Privacy Policy explains what we collect, how we use it, and what choices you have.

Kept is built around information about other people — your friends and family. We take that seriously. Most of what Kept stores is information you wrote about someone else, and that person did not sign up for anything. We keep that information private to you, we do not sell it, and we do not use it to build advertising profiles.

1. Information You Give Us

1.1 Your account

• Email address. Used to sign you in. Kept has no passwords — you sign in with a one-time code sent to your email, or with Sign in with Apple.
• Sign in with Apple. If you use it, Apple sends us an identifier and an email address. If you choose Apple's “Hide My Email,” we only ever see the private relay address Apple generates, not your real one.
• Your name, as you enter it.

1.2 Information about people you know

This is the heart of the app, and it is entirely typed in by you:

• Names, email addresses, phone numbers, and birthdays of contacts you add.
• Preferences and details you record — favorite things, sizes, love languages, and similar.
• Freeform notes and journal entries you write about a person or an occasion.
• Photos you add to a contact's profile.

We do not ask for financial, health, or location information about anyone. If you type such things into a freeform note, they are stored the same way as any other note.

1.3 Groups and gatherings

• Group names, membership, and who organizes them.
• Gathering details, invitations, RSVP responses, and date availability.
• Messages and replies posted to a gathering's board.

1.4 If someone invites you and you do not have Kept

When a Kept user invites you to a group or gathering, you can respond through a link in your browser without installing anything or creating an account. If you do, we store what you submit — typically your name, email address, RSVP, and any profile answers you choose to give, which may include a phone number — and share it with the person who invited you. Invitation links expire. You are never required to answer optional questions, and you can contact us at the address below to have your response deleted.

2. Information Collected Automatically

• Crash reports. When the app crashes or hits an error, we receive a technical report through Sentry: device model, operating system version, and where in our code the failure happened. It is deliberately configured not to attach your IP address or account identity, and we do not run performance tracing or session replay — we cannot watch you use the app.
• Server logs. Our infrastructure provider records standard technical information such as IP addresses and request times, used for security and to keep the service running.
• Email delivery records. We keep a log of the invitation and notification emails Kept has sent, so the app knows what was already delivered and does not send duplicates.
• Usage analytics. We use PostHog to understand whether Kept is working — events like creating an account, finishing onboarding, adding a contact, or planning a gathering, along with basic technical details such as device model, operating system version, and app version. These events are tied to your account identifier, not your name or email, and they never include what you actually wrote: no notes, no journal entries, and no names or details of the people you keep.

We do not use advertising SDKs. The usage analytics described above are the only product-tracking tool Kept contains, and we use them to improve the app, not to advertise to you.

3. Device Permissions

Kept asks for these only when you use the feature that needs them, and you can refuse or revoke any of them in your device settings. The rest of the app keeps working.

3.1 Microphone and speech recognition

So you can dictate a note instead of typing it. When you dictate, the recording is sent to Apple's speech recognition service to be turned into text, and is handled under Apple's privacy terms. We do not store the audio — only the text it produces, as part of your note. If you never use dictation, no audio is ever captured.

3.2 Camera and photo library

So you can put a face to a contact. Photos you add are uploaded to our storage and are visible only to you: the storage is private, and images are served through short-lived links that expire. We do not send your photos to any third party, and we do not scan or analyze them.

3.3 Calendar and reminders

So Kept can add a gathering to your calendar when you ask it to. Kept writes the event you requested and nothing else. It does not read your existing calendar events, and it never modifies your reminders.

3.4 Your address book

Kept does not access your device's contacts. Every person in Kept is one you added by hand. We never upload, scan, or import your address book.

4. What We Do Not Collect

We never ask for your phone number, and Kept does not use phone numbers to sign you in or send you text messages. You may choose to save a phone number for a contact, and someone answering an invitation may choose to share theirs; those are stored as ordinary contact details, described above.

• Passwords — there are none to steal, because Kept does not use them.
• Your device's address book.
• Precise location.
• Financial or payment information. Kept is free and has no payments.
• Health information.

5. How We Use and Share Information

We use your information to run Kept: to sign you in, to store and show you what you have written, to send invitations and notifications you have asked for, and to diagnose crashes.

We do not sell, rent, or trade your personal information, and we do not use it for advertising. We share it only in these cases:

• With people you choose. When you invite someone or share details with a group, the people you selected can see what you shared. RSVP responses and availability are visible to the organizer.
• With service providers who run the infrastructure. Supabase hosts our database, authentication, and photo storage. Resend delivers our email. Sentry receives crash reports. PostHog receives the usage analytics described in Section 2. Apple provides Sign in with Apple and speech transcription. Each handles only what its job requires.
• If the law requires it, or to protect someone's safety or our legal rights.
• If the business is sold or merged, information may transfer as part of that. We would tell you first.

6. Security, Retention, and Your Choices

6.1 How your data is protected

• Every database table enforces row-level access rules, so one account cannot read another account's data even if something else goes wrong.
• Data is encrypted in transit and at rest.
• Photo storage is private, size-limited, and restricted to image files; photos are reached only through links that expire.
• Invitation links expire and are limited to the specific invitation they were made for.

No system is perfectly secure, and we cannot promise absolute safety. Kept is a small, independent product; we would rather tell you plainly what we do than imply more.

6.2 Seeing, correcting, and deleting your data

• Access and correction. Everything you have entered is visible and editable in the app at any time.
• Deleting your account. You can delete your account in the app under Settings. Deletion is immediate and permanent — there is no recovery period. We remove your profile, your contacts, and everything you wrote about them, including notes, birthdays, journal entries, and photos you uploaded.
• What remains after deletion.Notes you posted to a gathering's board, and your response to someone else's invitation, stay where they are so the people still planning around them do not lose the details. Your name is removed from them.
• Contacts other people keep about you. If someone saved you as a contact, that record belongs to them and stays in their app, including anything they wrote about you and anything you shared with them through an invitation form. Deleting your account does not remove it. Contact that person directly, or write to us and we will help.
• Deleting a single response. If you answered an invitation without creating an account, contact us and we will remove it.
• A copy of your data. Ask us and we will send you one.

We keep your information for as long as your account exists. When you delete your account, removal is immediate — not queued for a later purge. Some records may be retained where the law requires it.

7. California Residents

If you live in California, the CCPA gives you the right to know what personal information we collect, to request its deletion, and not to be treated differently for exercising those rights. We do not sell personal information. To exercise these rights, contact us below.

8. Children

Kept is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it promptly.

9. Where Your Data Is Held

Kept is operated from the United States, and your information is stored and processed there. If you use Kept from elsewhere, you are consenting to that transfer, and the data protection laws where you live may differ from those in the United States.

10. Changes to This Policy

We may update this policy. If a change is material, we will tell you in the app or by email, and we will update the effective date above. This policy was substantially rewritten on August 8, 2026 to describe the app accurately.

11. Contact Us

Questions, requests, or concerns about your data — including deleting your account:

Draft One LLC
Email: hello@joinkept.app