Privacy Policy

Account information. Your name and email address, used to create and secure your account.

Mobile number (optional). You can add a mobile number to your account in Settings. It is never required, is not used to sign in, and you can remove it at any time. If you separately tick the box to receive occasional text updates about your family’s memories, we keep a record of that consent — when you gave it and the exact wording you agreed to — so we can honor it and prove it. Message and data rates may apply; reply STOP to any text to opt out. Removing your number also withdraws that consent.

Family content you add. Photos, videos, voice recordings, transcripts, stories, recipes, and answers to memory questions. This content is visible only to you and the family members you invite.

Photo locations. Photos taken on a phone often record where they were taken. When you upload one, we read that location and remove it from the stored photo, so the photos you download or share never carry it. We keep the location only if you turn on “Keep the location of my photos” in Settings → Privacy (off by default): we then store it with the photo, linked to your account, to name the place it was taken, and only a place name is ever shown to your family. Turn it off to stop saving new locations, or use “Remove saved locations” to erase them.

Payment information. If you subscribe, payments are processed by Stripe. We never see or store your card number.

Usage analytics (only with your consent). With your permission we use Google Analytics and Amplitude to understand how the product is used — pages visited, features used, general device and region information, and session recordings of how you interact with the app's interface (with typed text masked). See "Cookies & analytics" below.

Ad measurement (only with your consent). We advertise KeepSaiQ on Facebook and Instagram. With your permission, the Meta Pixel and Meta's Conversions API tell Meta which pages you visited and whether you created an account, saved a first memory, or sent or accepted a family invitation, so we can see which ads work. Meta receives a hashed email address and hashed account ID, your IP address and browser type — never your photos, recordings, memory text, or your family members' details. Meta uses this only to measure and deliver our ads.

Starting with version 1.1 of the KeepSaiQ iPhone and iPad app, the same choice — the usage-analytics prompt, which you can change anytime in Settings → Privacy — lets Meta's app SDK report two things: that the app was opened, and that you created an account. With them Meta receives an app-specific anonymous ID, your IP address, and basic device information such as model, operating system and app version, language, and mobile carrier. The app never reads your device's advertising identifier and never asks to track you across other companies' apps. Without your yes, the SDK does not start; if you later say no, the app stops reporting to Meta and the SDK does not start again.

We also advertise the app on Google. Under the same choice, the app uses Google's Firebase Analytics SDK to tell Google that the app was opened (and how long it was used), that you created an account, and that you bought a subscription in the app, so we can see which Google ads work. With them Google receives an app-specific anonymous ID, your IP address, and basic device information such as model, operating system and app version, and language. To match an ad to your sign-up, Google's code on your device compares a scrambled (hashed) form of your email address with its own records on the device itself; your email address is not sent to Google. The app never reads your device's advertising identifier and Google uses this only to measure our ads, never to build advertising audiences from you. Without your yes, Firebase does not start; if you later say no or sign out, the app switches it off at once.

To run KeepSaiQ: storing and organizing your family's memories, powering search, and delivering the features you use.

AI features. Some features process your content with AI services inside our cloud infrastructure (Amazon Web Services): photo analysis to recognize faces and scenes, voice-to-text transcription, and generated captions, questions, and insights. We do not use your family's content to train AI models, and these providers do not use it to train theirs. If that ever changes, we will ask you first.

People grouping. Grouping photos by person is off unless you turn it on. When it is on, we create and store a face signature — a numeric representation, not a picture — for faces in your family's photos. Signatures are held inside our AWS account, kept separately for each family, used only to group that family's own photos, and never sold, shared, or used to identify anyone outside your family. Turn people grouping off and we delete your family's signatures; they are also deleted when the family is deleted. Our full retention and destruction schedule is published in the Biometric Data Policy.

To improve the product, using aggregate analytics — never by reading your family's content.

Essential cookies keep you signed in and the service secure. They are always on because the product cannot work without them.

Analytics cookies (off by default). We ask before measuring. If you accept on the consent banner, Google Analytics sets cookies (such as _ga) to help us understand usage, and Amplitude measures feature usage and records interface sessions (text you type is masked in recordings). If you decline, no analytics cookies are set and Amplitude does not run; Google Analytics then receives only cookieless, aggregate pings that are not linked to you. Accepting also loads the Meta Pixel, which sets Meta's _fbp cookie (and _fbc if you arrived from a Meta ad) for ad measurement; declining or withdrawing consent removes them and stops all reporting to Meta. You can change your mind anytime by clearing this site's browsing data, after which the banner will ask again.

Campaign tags. If you arrive from one of our ads or links, we keep the campaign tags from that link (UTM parameters and ad click IDs) in your browser's local storage for up to 90 days so we can tell which campaigns bring people to KeepSaiQ. These tags describe the link you clicked, not you; they are not shared beyond the consent-based measurement described above and clearing this site's browsing data removes them.

Your family content is shared only with the family members you invite. We use service providers to operate KeepSaiQ — Amazon Web Services (hosting, storage, AI processing), Stripe (payments), Google Analytics and Amplitude (consent-based usage measurement), and Meta Platforms (consent-based measurement of our own Facebook and Instagram ads) — each only to provide their service to us. The complete list of providers, what each receives, and where they operate is published on our Subprocessors page.

We do not sell your personal information. We do not show ads. We may disclose information if required by law, or to protect the safety of our users.

Your data is stored in the United States on Amazon Web Services and encrypted in transit and at rest. Access is restricted to your family through per-family access controls enforced on every request.

We keep your content for as long as your account exists. When you delete content or your account, it is removed from the product; residual copies in backups are purged on a rolling basis.

When a member dies. Death is not deletion. When we verify that a member has died, their account is memorialized: locked from sign-in, with their content preserved and still attributed to them by name. Content shared into a family stays with the family. The legacy contact they named, or their estate where none was named, may request an export of what that member created, but not deletion of the family's copy. The death certificate or other proof we receive is kept separately, encrypted, and is never included in an export.

Voice recordings and transcripts. A recording is kept for as long as your account exists — keeping it is the point of the product. When you delete a recording, it disappears from the app immediately and the audio file itself is queued for erasure straight away, normally leaving our storage within minutes. It is not held for a recovery window, so deleting a recording is not reversible. Its transcript is deleted with it. Deleting your account runs the same erasure across every recording in it. (Photos work differently: a deleted photo is recoverable for 30 days before the file is erased.)

AI processing logs. As a safeguard, we keep a record of the requests our AI features make inside our AWS infrastructure — it is how we can verify exactly what those systems were asked to do. These logs can include the content that was processed, are encrypted and tightly access-restricted, and are automatically deleted after at most 90 days. Because deletion of these logs is time-based, content you delete (including on account deletion) may persist in them for up to 90 days before it is permanently erased.

You can access, correct, download, or delete your content in the app, and you can decline analytics entirely. Depending on where you live (including the EU, UK, and California), you may also have legal rights to access, delete, port, or restrict processing of your personal information — contact us and we will honor them.

KeepSaiQ accounts are for adults (18+). Photos and stories about children are added and controlled by the adult family members who manage the family space.

If we change this policy, we will update this page and the effective date, and for material changes we will tell you in the product. Questions or requests: hello@keepsaiq.com.