Privacy Policy

Last updated October 2026

Keeps lets people capture a shared occasion on one collaborative disposable film. This policy explains what information the app collects, how we use it, and the choices you have. We keep data collection to what the app needs to work and to improve — no advertising, and no selling your data.

Information We Collect

Account and sign-in

Keeps needs an account — to host a film or to join one; there is no guest mode. Whether you use the app or the browser camera on keeps.film, you can sign in with Google, with an email address and password, or, on an Apple device, with Apple. From Google and Apple we receive the name and email address you let them share; with Apple you may use Hide My Email, and we then only ever see the relay address. The name is used only to suggest a display name, which you can change and which is what other people in a film see.

Content you create

When you create or join a film we store the film’s details (such as its title, cover image, dates, settings, and invite code), the guest list — each member’s display name and how many photos they have taken — and the photos you capture. Photos and your display name are visible to the other members of the same film; that sharing is the core purpose of the app. On a film whose gallery the host has made private, the host sees every photo and each guest sees only their own. Photos you take may show other people; please only add photos the people in them are comfortable sharing with everyone in that film.

Anyone who has a film’s invite link or code can see the film’s title, cover image, and how many people have joined before they join. Share invites only with the people you want in the film.

Purchases

Films for more than five people are paid. The store you installed Keeps from processes the payment — Apple on iPhone, Google Play on Android — and we never see your card or billing details. We store the store’s transaction identifier (on Android, the purchase token and order number) and what it granted, so a purchase is applied exactly once.

Device and usage data

On iPhone, like most apps, we automatically collect non-personally-identifiable information about your device and how you use the app: device type, operating system version, app version, approximate country or region, and in-app events such as which screens you view. See Analytics below. The Android app collects none of this.

Notifications

If you allow notifications, we use Firebase Cloud Messaging to store a device push token so we can send film-related updates — when a film is ready to view, or, if you are the host, when its guest list is full. You can turn notifications off at any time in your device settings, and signing out releases the token.

Analytics and Error Reporting

The iPhone app uses TelemetryDeck to understand general usage patterns and improve the app. TelemetryDeck is built to be anonymous: the app sends no account identifier, and each signal carries a one-way hashed value that cannot be traced back to you or to your device. It is operated in Germany under the GDPR.

Both apps use Sentry to receive reports when something in the app fails or crashes, so we can fix it. A report contains the technical error, the app version, the device model and system version, and where in the code it happened. It never carries your account identifier, your display name, film titles, or any photo, and never a picture of your screen. Sentry processes these reports on servers in the United States.

The Android app contains no analytics library: these error reports are the only diagnostics it sends. Neither app collects your name, email, or the contents of your photos for these purposes. We do not use advertising identifiers (no IDFA), do not track you across other apps or websites, and there is no Google or Firebase Analytics in either app.

Security and Abuse Prevention

We use Firebase App Check to verify that requests come from the genuine Keeps app and to protect the service from abuse — through Apple’s App Attest on iPhone, Google’s Play Integrity on Android, and Google’s reCAPTCHA Enterprise in the browser camera. This attestation is about the app, device, or browser’s integrity, not about identifying you. reCAPTCHA Enterprise looks at how a browser behaves on the page and is subject to Google’s Privacy Policy and Terms of Service.

How We Use the Information

The information we collect is used solely to:

• Provide the core service — create films, join, capture photos, and share them with a film’s members.
• Send film-related notifications you have opted into.
• Monitor and improve app performance, features, and reliability.
• Understand engagement and usage trends in aggregate.
• Keep the service secure and prevent abuse.

How Information Is Shared

We do not sell your personal information or share it with advertisers. Information is shared only:

• With other members of a film — your display name, your photo count, and the photos you add are visible to the people in that film who are allowed to see them, by design.
• With service providers who process data on our behalf — Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Messaging, App Check, and Cloud Functions; on Android also Google Play for purchases and Play Integrity for app verification; in the browser camera, reCAPTCHA Enterprise), Apple (App Store purchases and Sign in with Apple on iPhone), Google when you choose Google sign-in, Sentry (error reporting, both apps), and, for the iPhone app only, TelemetryDeck (analytics).
• When required by law — if we must comply with a valid legal request or protect our rights and users.

Why We Are Allowed to Process It

In the EEA and UK we rely on these legal bases: performance of a contract for your account, your films, and your photos — the app cannot work without them; your consent for push notifications, which you can withdraw at any time in your device settings; and our legitimate interests in keeping the service secure and working, which covers App Check, error reporting, and anonymous usage analytics. We keep purchase records to comply with a legal obligation (accounting) and to prevent a purchase being redeemed twice.

Where Your Data Is Processed

Your account, films, and photos are held on Google’s Firebase infrastructure in the United States, and the server functions that write them run there too. Sentry processes error reports in the United States as well. TelemetryDeck processes usage analytics in Germany. Where data leaves the EEA or UK, the transfer relies on the European Commission’s Standard Contractual Clauses.

Data Retention

We keep a film’s photos for up to about one year after the film ends — the same for free and paid films — after which they may be deleted. Each film records its own deletion date when it is created, so if we change this period later it applies to films created from then on; it never shortens the time we promised for a film you already have. If a host removes you from a film, we delete the photos you took in it right away and keep only an internal account identifier so that the same account cannot rejoin that film.

If you delete your account, we delete your profile, every film you host and all content in those films, every photo you added to films hosted by someone else, your device tokens, and any unfinished purchase drafts, apart from copies that may remain briefly in backups. We keep the record of a completed purchase — the store transaction identifier and what it granted — to meet accounting obligations and to stop the same purchase being redeemed twice; once your account is gone that record no longer identifies you, and neither does the removal record above. Anonymized analytics data is retained only as long as needed to support ongoing development and improvement.

Your Rights and Choices

• Delete your account — you can delete it yourself in the app, under Account. This permanently deletes every film you host and every photo you took, including photos you added to films hosted by other people, so it affects everyone in those films. It cannot be undone. If you signed in with Apple, the app asks you to confirm with Apple again and revokes the Sign in with Apple grant at the same time, so Keeps disappears from your Apple account’s sign-in list.
• Change your display name — in the app at any time.
• Notifications — control or revoke push notifications in your device settings; revoking withdraws your consent for them.
• Access and portability — you can ask us for a copy of your personal data, in a portable format. Email us and we will respond within one month.
• Correction, restriction, and objection — you can ask us to correct data that is wrong, to restrict how we use it, or to object to processing we base on our legitimate interests.
• Complain to a regulator — if you are in the EEA or UK you can lodge a complaint with your national data protection authority. We would appreciate the chance to address it first.

To exercise any of these, email robert.pinl.contact@gmail.com. There is no charge, and we will not treat you differently for asking.

This Website

The pages of keeps.film set no cookies and run no analytics. When you open an invite link, the page reads that film’s title, cover image, and guest count from our database to show you a preview. Our hosting provider keeps standard server request logs — such as the address your request came from and the page requested — for a short period, for security and troubleshooting.

The browser camera at keeps.film/app/camera is the one part of the site that works like the app: you sign in with the same kind of account, join a film, and shoot. It keeps your sign-in and the film you joined in your browser’s storage until you sign out, so you do not have to sign in for every photo, and it uses Google’s reCAPTCHA Enterprise (see Security above), which sets a cookie of its own. Photos you take there are stored and shared exactly like photos taken in the app.

Children’s Privacy

Keeps is not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us data, please contact us and we will remove it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. Updates will be posted within the app or on this website, with a revised “Last updated” date.

Contact Us

Keeps is responsible for the personal data described here (the “controller” under the GDPR). If you have any questions or concerns about this Privacy Policy, or want to exercise your rights, contact us at robert.pinl.contact@gmail.com.