Privacy Policy

Summary of key points

• What personal information do we process? Only your email address, plus basic technical data (IP address, browser type) that hosting and email services log automatically.
• Do we process sensitive personal information? No.
• Do we collect any information from third parties? No.
• How do we process your information? To send you the emails you signed up for, to understand aggregate website traffic, to comply with law.
• Who do we share it with? Only our service providers who need it to operate our service (Kit for email, Cloudflare for hosting). We do not sell your data.
• How do you exercise your privacy rights? Unsubscribe using the link in any email we send — that deletes your information. For any other question, email privacy@keptby.app.

Table of contents

• 1. What information do we collect?
• 2. How do we process your information?
• 3. What legal bases do we rely on?
• 4. Who do we share your information with?
• 5. How long do we keep your information?
• 6. Do we collect information from minors?
• 7. What are your privacy rights?
• 8. Do-Not-Track and Global Privacy Control
• 9. US residents' privacy rights
• 10. Updates to this notice
• 11. How to contact us
• 12. How to review, update, or delete your data

1. What information do we collect?

In short: your email address when you sign up. Basic technical data our hosting and email providers log automatically. Nothing else.

Information you provide

When you sign up for our email list or waiting list, you voluntarily give us:

• Your email address
• The date and time of your signup

That's it. We do not ask for your name, phone number, physical address, age, credit card, or any other information. We do not have user accounts, passwords, or login functionality — so we don't collect any of that either. When the Kept By iOS app launches, this notice will be updated to cover anything the app collects.

Information automatically collected

When you visit our website, our service providers automatically log:

• Your IP address (approximate location — city or region, not precise)
• Your browser type and version
• Your device type (e.g., phone, desktop)
• Pages on our site you visited
• The referring source that brought you to us (if any)

This is standard website operational data.

Sensitive information

We do not collect or process sensitive personal information. We do not collect racial or ethnic origins, religious or political views, health information, sexual orientation, biometric data, precise location, or any other sensitive category under GDPR, UK GDPR, CCPA, or PIPEDA.

Information from third parties

We do not collect personal information about you from third parties. We do not buy data from data brokers. We do not collect from social media platforms.

2. How do we process your information?

In short: we use your email to send you the messages you signed up for. We use technical data to run the website.

Specifically:

• To send you the emails you signed up for — welcome sequence, occasional updates about Kept By, and notice when the iOS app launches.
• To understand aggregate website traffic — which pages work, which don't.
• To fix technical problems — when errors happen, log data helps us debug.
• To comply with legal obligations — if legally required to respond to a lawful request.

We do not:

• Use your information for targeted advertising
• Share it with third parties for their marketing
• Train AI models on it
• Profile you for automated decision-making that affects your rights

3. What legal bases do we rely on?

In short: your consent, legitimate interest, and legal obligations — depending on where you live.

If you are in the EU, UK, or Switzerland

Under GDPR and UK GDPR, we rely on:

• Consent — you gave it by signing up for our list. You can withdraw it at any time by unsubscribing.
• Legitimate interest — for basic website operation, security, and aggregate analytics.
• Legal obligations — for compliance with applicable law.

If you are in Canada

Under PIPEDA, we rely on:

• Express consent — you gave it by signing up.
• Implied consent — for basic site operation and analytics.

You can withdraw consent at any time by unsubscribing.

4. Who do we share your information with?

In short: only our service providers. We do not sell, rent, or trade your data.

We share your personal information with:

• Kit — our email service provider. They store and deliver the emails you subscribed to. Kit's privacy policy.
• Cloudflare — our website hosting and email routing provider. Cloudflare's privacy policy.

When the iOS app launches, additional service providers may be used (e.g., cloud storage). This notice will be updated when that happens.

We may also disclose information:

• To legal authorities when legally compelled (subpoena, court order, lawful government request).
• In a business transfer (if Kept By is ever acquired, your information transfers to the acquirer; we'll update this notice and email affected subscribers).

We do not sell your information. We do not share it with third parties for their marketing. We do not share it for targeted advertising under any definition.

5. How long do we keep your information?

In short: for as long as you're subscribed. Unsubscribing removes your information from our active list.

• While you're subscribed: we retain your email address on our mailing list.
• After you unsubscribe: we remove you from our active list. Kit, our email service, retains your email on a suppression list solely to ensure you don't accidentally receive emails from us if you're re-imported. That suppression data is not used for any other purpose.
• For full deletion including removal from the suppression list, email privacy@keptby.app and we'll process it within 30 days.
• Technical log data is retained for up to 24 months by our hosting provider for security and operational purposes.

When there is no longer a legitimate reason to retain your information, we delete it or fully anonymize it.

6. Do we collect information from minors?

In short: no. Kept By is for users 18 and older.

Kept By is intended for people 18 years of age or older. We do not knowingly collect personal information from anyone under 18, and we do not market to minors. If you become aware that a minor has provided us with personal information, please email privacy@keptby.app and we will take steps to delete it.

7. What are your privacy rights?

In short: depending on where you live, you have rights to access, correct, and delete the information we hold about you. The simplest way to exercise most rights is to use our unsubscribe link — we hold so little data about you that unsubscribing effectively exercises your right to deletion in one click.

The simplest privacy tool — unsubscribe

Because Kept By holds only your email address, unsubscribing removes virtually everything we hold about you. The unsubscribe link is at the bottom of every email we send. One click and we're done. No form, no waiting period, no verification process.

Your statutory rights

Depending on your jurisdiction (EU, UK, Canada, or certain US states), you have some or all of these rights:

• Right to know whether we process your personal information.
• Right to access your personal information.
• Right to correct inaccurate information.
• Right to deletion of your personal information.
• Right to data portability — receive your information in a machine-readable format.
• Right to restrict or object to certain processing.
• Right to withdraw consent at any time.
• Right not to be subject to automated decision-making that produces legal or similarly significant effects.

How to exercise these rights

Email privacy@keptby.app. We respond to verified requests within 30 days (45 days in some US jurisdictions, 30 days under GDPR, extendable to 90 days for complex requests).

An honest note about what we'll be able to tell you: because we hold only your email address and the date you subscribed, most data requests will receive a simple answer: "We hold your email address ([your email]) on our mailing list, subscribed on [date]." There is no user account, no stored content, no profile, no behavioral tracking data. Most users find that unsubscribing gives them everything a formal request would achieve.

Complaints to authorities

• EU: your local EU data protection authority
• UK: the UK Information Commissioner's Office
• Switzerland: the Federal Data Protection and Information Commissioner
• Canada: the Office of the Privacy Commissioner of Canada
• United States: your state's attorney general office

8. Controls for Do-Not-Track and Global Privacy Control

Because there is no universal technology standard for Do-Not-Track signals, we do not currently respond to DNT browser signals.

We do honor Global Privacy Control (GPC) signals. If your browser or extension sends a GPC signal, we treat it as a valid opt-out of any sale or sharing of your personal information under applicable state privacy laws. For the record: Kept By does not sell or share personal information under any existing definition, so the GPC signal is redundant, but we respect it anyway. Learn more at globalprivacycontrol.org.

9. US residents' privacy rights

In short: residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have additional privacy rights under their state laws.

Categories of personal information we collect

Your rights under state law

Depending on your state, you may have any of these rights:

• Right to know whether we process your personal data
• Right to access your personal data
• Right to correct inaccuracies
• Right to delete your personal data
• Right to obtain a copy of your personal data
• Right to non-discrimination for exercising your rights
• Right to opt out of sale, sharing for targeted advertising, or profiling

We do not sell or share your personal information, so there is no list of third parties to whom we have sold data (the answer is: none).

How to exercise your rights

Email privacy@keptby.app. We verify identity by confirming the request from the email on file, and respond within 45 days.

Appeals

If we decline a request and you disagree, email privacy@keptby.app with "Privacy Appeal" in the subject line. We respond to appeals within 60 days.

10. Updates to this notice

We may update this notice from time to time. When we do:

• The "Last Updated" date at the top will change.
• For material changes, we'll notify you by email (if you're on our list) at least 30 days before they take effect.

11. How to contact us

For privacy questions, complaints, or formal requests:

• Email: privacy@keptby.app
• General inquiries: privacy@keptby.app

Post:
Kept By
7385 Park Village Dr.
Jacksonville, FL 32256
United States

We reply to most emails within 5 business days. Formal privacy rights requests are answered within legally required timeframes (typically 30–45 days).

12. How to review, update, or delete your data

The fastest path is to use the tools built into every email we send:

• To unsubscribe (and remove your data from our active list): click the "Unsubscribe" link at the bottom of any email we send.
• To update your email address: unsubscribe the old address, then sign up again with the new one.
• To request full deletion (including removal from Kit's suppression list): email privacy@keptby.app.

Because we only hold your email address, there is no elaborate process for reviewing your data — the answer to "what do you have on me?" is simply "your email address, which you provided to us." Unsubscribing deletes it.