Privacy Policy — Keepora

1. Summary

Keepora is a local-first application. The documents, photos, notes, dates and records you add live in an encrypted database on your own device. They are not uploaded to Keepora servers, and we have no technical means of reading them.

In short: we collect the minimum needed to deliver licences, updates and advertising to your device — a device identifier, your app version, your purchase entitlement, and anonymous feature-usage counts. Your actual records never leave your phone unless you choose to back them up to your own cloud account.

2. Who we are

Keepora is developed and operated by InnoxSofty ("we", "us"). We are the data controller for the limited information described in section 4. For anything stored inside the app on your device, you remain in sole control.

Privacy enquiries: privacy@keepora.app

3. Data that stays on your device

The following is stored only in Keepora’s encrypted local database and is never transmitted to us, under any circumstances:

Item titles, descriptions and personal notes
Documents, photographs and PDF attachments
Text extracted by OCR from your documents
Passport, insurance, vehicle and identity document details
Expiry, renewal and warranty dates belonging to your records
Reminder contents and schedules
Categories, tags and your personal search history
Encrypted .keepora backup and migration files

OCR runs entirely on your device. Your documents are never sent to a remote OCR, AI or document-processing service.

4. Data we do collect

Keepora communicates with our control service for licensing, updates and configuration. That service only ever receives product metadata:

What	Why	Linked to you?
Device identifier	Binds a Pro or Lifetime purchase to your installation and prevents licence abuse	Pseudonymous
Platform and app version	Update prompts, compatibility, and serving the right feature flags	Pseudonymous
Country or locale	Correct pricing, language and regionally appropriate configuration	Pseudonymous
Entitlement and purchase identifiers	Verifying a Google Play purchase and restoring it on a new device	Pseudonymous
Advertising identifier	Serving ads in the free tier through Google AdMob	Resettable by you in Android settings
Feature-usage events	Knowing that a feature was used, so we can improve it	Anonymous — never includes content
Push notification token	Delivering product announcements, if you allow notifications	Pseudonymous
Last active timestamp	Distinguishing active installs from abandoned ones	Pseudonymous

What an analytics event looks like

Our analytics records the name of a feature and nothing about what you put into it. A real event is as sparse as this:

event: "ocr_used"
appVersion: "1.2.0"
platform: "android"

The scanned text itself is never included. This is enforced in the product design, not left to policy.

5. Why we collect it

We process the limited data in section 4 to:

Verify and restore Pro and Lifetime purchases
Tell you when an app update is available
Deliver remote configuration, feature flags and product announcements
Serve advertising to free-tier users
Understand aggregate feature usage to prioritise development
Detect abuse and keep the service secure

Where applicable law requires a legal basis, we rely on performance of our contract with you (licensing and app delivery), your consent (notifications and personalised advertising, where required), and our legitimate interests (security and aggregate product improvement).

6. Third-party services

Keepora relies on a small number of third parties. Each has its own privacy policy.

Google Play Billing — processes purchases. We never see or store your payment card details.
Google AdMob — serves advertising to free-tier users and uses the Android advertising identifier. AdMob has no access to your documents or records. Removing ads with Pro or Lifetime stops these requests.
Google Firebase — provides app-level analytics and, where enabled, push delivery for product announcements. It receives app and device metadata only.
Your chosen cloud provider (Google Drive, OneDrive or Dropbox) — only if you turn on cloud backup. See section 7.

We do not sell your personal information, and we do not share your records with data brokers, advertisers or any other third party — because we do not hold them.

7. Cloud backups

Cloud backup is optional and off by default. If you enable it, Keepora encrypts your data into a .keepora file on your device and uploads that encrypted file directly to a cloud account you already own.

The file is encrypted before it leaves your phone.
It is uploaded straight to your provider — it does not pass through our servers.
We never store backup files, and we never hold your backup passphrase.
If you sign in to a cloud provider, that provider’s own privacy policy governs the stored file.

Important: because we hold neither your records nor your passphrase, we cannot recover your data if you lose both your device and your backup passphrase. That is the direct consequence of genuine local-first privacy.

8. Device permissions

Keepora asks only for permissions it needs, at the moment it needs them.

Camera — to photograph documents and run OCR. Images are stored locally.
Notifications — to deliver your reminders and, optionally, product announcements.
Biometrics — to unlock the app, if you enable App Lock. Biometric data stays in the Android keystore and is never readable by us.
Network — for licence checks, update notices, advertising and cloud backup.

Declining any of these leaves the rest of the app working.

9. Retention

Your records are retained on your device for as long as you keep them. Uninstalling Keepora removes the local database; export a backup first if you want to keep your data.
Entitlement and device records are retained while your installation remains active and for a limited period afterwards, so a reinstall can restore your purchase.
Analytics events are retained in aggregate form only.
Audit logs covering administrative access to our control service are retained for security purposes.

10. Your rights

You can access, correct, export or erase everything in the app at any time, directly on your device — no request to us is required, because we never had it.

For the limited control-plane data in section 4, you may ask us to access, correct or delete it, to object to or restrict processing, or to receive a copy. Write to privacy@keepora.app and we will respond within the period required by applicable law.

You can reset or limit your advertising identifier at any time in your Android privacy settings, and turn off notifications in your device settings.

11. Children

Keepora is intended for general audiences and is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with information, contact us and we will delete it.

12. Security

Your records are held in an encrypted SQLite database on the device.
The database key is stored in the platform’s secure keystore, not in the app bundle and not on our servers.
Backup and migration files are encrypted before they are written.
Optional App Lock adds a biometric or PIN gate in front of the app.
All communication with our control service uses HTTPS.

No system is perfect, but the strongest protection here is structural: the data we would otherwise have to protect is never sent to us.

13. Changes to this policy

If we change this policy we will update the date at the top of this page and, for material changes, notify you in the app. Continuing to use Keepora after a change means you accept the updated policy.

14. Contact

Questions about this policy, or a request about your data:
privacy@keepora.app
General support: support@keepora.app