Security & privacy
What we protect, and what we refuse to claim
Families hand this product the least replaceable material they own. The least we owe them is an accurate description of what happens to it — including the parts where the truthful answer is less impressive than the marketing one.
Encrypted in transit and at rest
TLS on the wire; storage and database encrypted under keys we manage in our own cloud account.
No public surface at all
No feed, no profiles, no followers, no discovery. Content is visible only to invited family members.
Not used to train AI
Your content is not used to train AI models, and our providers do not use it to train theirs.
Deletion that is real
Voice recordings purge within minutes with their transcripts. Account deletion runs the same erasure.
What we will not claim
KeepSaiQ is not end-to-end encrypted, and we will not say that it is. End-to-end encryption means the service cannot read your content. Ours can, and does — that is how a recording gets transcribed, how a photo gets analysed, and how search works at all. A product that offers those features and also advertises end-to-end encryption is either confused about the term or relying on you not knowing it.
This matters beyond wording. A family that believes their archive is unreadable by anyone will make different decisions about what to put in it. Giving them a false model of the system is a worse outcome than giving them a less impressive but accurate one.
So the claim we make is the one that is true and verified: encrypted in transit and at rest, with content that is not used to train AI models. We keep a test in the codebase that fails the build if the overclaim ever reappears.
Where the data lives and how it is protected
Family content is stored in our own cloud infrastructure. Traffic is encrypted in transit, and object storage, the database, and the cache are all encrypted at rest under customer-managed keys.
AI processing — transcription, photo analysis, generated captions and insights — happens through services inside that same cloud account rather than by shipping your family's material to a third-party consumer AI product.
Payments are handled by Stripe, and we never see or store your card number.
Face signatures are opt-in and destructible
Grouping photographs by person is off unless you turn it on. When it is on, a face signature — a numeric representation, not a picture — is created for faces in your family's photos, stored inside our cloud account, kept separately for each family, and used only to group that family's own photos. It is never used to identify anyone outside your family, and we do not build a cross-family face database.
Turning people grouping off deletes your family's signatures. They are also destroyed when the photo they came from is deleted, when the family or account is deleted, and after three years without activity. That schedule is published in full on the Biometric Data Policy page rather than merely summarised here.
There are no voice biometrics: we do not create voiceprints or any voice-derived identifier.
Deletion, and why audio behaves differently
When you delete a voice recording it is purged within minutes rather than held for a recovery window, and the transcript is deleted with it — a transcript is a verbatim record of the same conversation, so erasing one without the other would defeat the deletion. This is not reversible, and it is worth knowing before you act, because photos do go through a recovery window.
Deleting your account runs the same erasure across everything you added. It is not a deactivation and not a hidden archive kept in case you return.
Analytics are off until you say otherwise
Essential cookies keep you signed in and the service secure. Analytics are off by default and we ask before measuring anything; if you decline, no analytics cookies are set. None of that involves reading your family's content — product analytics measure how the interface is used, not what is in your archive.
Reporting a security issue
If you believe you have found a vulnerability, contact us through the support page and describe what you found and how to reproduce it. We would much rather hear about a problem from you than not hear about it.
Common questions
- Is KeepSaiQ end-to-end encrypted?
- No. Content is encrypted in transit and at rest, but our systems read it in order to transcribe recordings, analyse photos, and generate captions and insights. A service that processes your content cannot honestly claim end-to-end encryption, so we do not.
- Can KeepSaiQ employees read our family's memories?
- Content is not browsed as a matter of course, is not shared outside your family, and is not used to train AI models. Because the platform processes content to provide transcription and search, it is technically readable by the systems that run it — which is the honest answer and the reason we decline the end-to-end claim.
- Where is our data stored?
- In our own cloud infrastructure, encrypted at rest under keys we manage. AI processing happens inside that same account rather than by sending your family's material to a third-party consumer AI product.
- Do you use our photos or recordings to train AI?
- No. Your family's content is not used to train AI models, and the providers that process it do not use it to train theirs. If that ever changes, we will ask you first.
- Is there any voice biometric identification?
- No. We do not create voiceprints or any voice-derived identifier. Recordings are transcribed; they are not used to recognise who is speaking.
- What happens to face signatures if I turn people grouping off?
- They are deleted. They are also destroyed when the photo they came from is deleted, when the family or account is deleted, and after three years without activity. The full schedule is published on the Biometric Data Policy page.
Related
Start your family's living memory
Free to start. Your first memory takes twenty seconds, and it stays private to your family.
Create your free account
Free · iOS 17+ · Android 9+