Your memory should come with clear boundaries.

1. What this policy covers

This policy applies to the Kepnote mobile app, the website at kepnote.com, and Kepnote's optional account, sync, storage, search, and AI services. “Kepnote,” “we,” and “us” refer to the provider of those services.

A third-party website, AI provider, app store, or service has its own privacy practices. Their policies apply when you use them directly or ask Kepnote to connect to them.

2. Information we handle

Your on-device library

Notes, links, files, photos, recordings, titles, reminders, and other library data are stored in Kepnote's app storage on your device by default. Local capture does not require a Kepnote account. Kepnote does not automatically upload this library just because you install or open the app.

Account information

If you create an account, we handle information such as your email address, display name, account timestamps, and either a protected credential hash or a Google account identifier, depending on how you sign in. We do not store your plain-text password.

Information you choose to send online

Depending on the feature you use, this can include:

• URLs sent to Kepnote's security-filtered metadata relay, which connects to the original website to retrieve titles and descriptions without exposing your device to private-network redirects;
• a question and selected, limited memory excerpts sent to an AI provider you configure with your own API key;
• memories, attachments, summaries, extracted people, places, dates, reminders, and sync history when you enable Premium cloud services; and
• search queries and relevant memory content needed to provide managed semantic search or cloud answers.

Technical and support information

Kepnote's application logs record a request identifier, request method and path, response status, and an error message when a request fails. We do not intentionally log request or response bodies, passwords, API keys, authorization tokens, or memory contents. Infrastructure providers may separately process ordinary connection data, such as IP address and user agent, to deliver and secure the service. If you contact support, we receive the message and any files or details you choose to provide.

Subscription and purchase information

If you use Kepnote Premium billing, Apple or Google processes the payment and RevenueCat helps us validate and manage the subscription entitlement. We may handle your Kepnote account UUID, app and store identifiers, product and purchase identifiers, subscription status and dates, renewal state, store environment, and entitlement lifecycle. We do not receive or store your full payment-card number.

Website data

We do not currently use third-party analytics or advertising trackers on this website. The hosting infrastructure may still process ordinary request data, such as IP address, browser details, requested page, and time, to deliver and secure the site.

3. Why we use information

We use information only as needed to:

• provide capture, organization, search, sync, reminders, export, and AI-assisted recall;
• create and secure accounts, authenticate requests, and apply service entitlements;
• operate, troubleshoot, protect, and improve Kepnote;
• answer support, privacy, and account requests; and
• meet legal obligations and enforce our Terms.

Where applicable law requires a legal basis, we rely on performing our agreement with you, our legitimate interests in operating and securing Kepnote, your consent where requested, and compliance with legal obligations.

4. When information is shared

We do not sell personal information. We may disclose it in these limited situations:

• Service providers. Infrastructure and feature providers process information for us under appropriate instructions. Depending on what you use, these categories include Google sign-in, Apple App Store and Google Play billing, RevenueCat subscription management, S3-compatible file storage, Supermemory semantic search, and a configured OpenAI-compatible language model provider.
• Your chosen AI provider. With bring-your-own-key AI, your device sends the question and selected memory excerpts directly to the provider you configure. Their terms and privacy policy apply.
• Legal and safety reasons. We may disclose information when reasonably necessary to comply with law, protect people, investigate abuse, or defend rights.
• Business changes. Information may be transferred as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to this policy and applicable law.

We do not use your personal library to build advertising profiles or serve targeted ads.

5. Storage and retention

Local library data remains on your device until you delete it, clear the app's data, or uninstall the app. Your device or operating-system backup settings may keep separate copies that Kepnote does not control.

Account and cloud information is kept while your account or requested cloud feature is active and as needed to provide the service. Deleting a synced memory removes it from your active Kepnote library and synchronizes that deletion to your devices. It does not currently guarantee erasure of related storage objects or processor records; contact us using the Data Deletion instructions if you need verified removal of all covered cloud copies. When we complete a verified privacy or account-deletion request, limited records may still be retained for backups, security, fraud prevention, legal compliance, and resolving disputes. Backup copies are isolated and expire through their normal lifecycle rather than being used as active data.

Exported archives are plain files under your control. Deleting Kepnote data does not delete copies you exported or shared elsewhere.

Billing and entitlement records may be retained for subscription operation, fraud prevention, support, accounting, dispute resolution, and legal compliance. Deleting a Kepnote account does not cancel the separate store subscription; cancel it through Apple or Google. RevenueCat's own retention and deletion practices are described in its Privacy Policy.

6. Security

We use safeguards designed for the sensitivity of personal memory, including authenticated, user-scoped service access; short-lived upload links; protected credential storage; and secret redaction from application logs. Your bring-your-own-key credential is stored using the device's secure credential storage when available.

No system is perfectly secure. Kepnote's local database is protected by the device's app sandbox but is not currently encrypted with a separate database key. Cloud processing is not end-to-end encrypted because authorized processors must be able to read the selected content to provide those features.

7. Your choices and rights

• Use local text and link capture without creating an account.
• Choose whether to link an account and enable Premium sync or managed AI features.
• Restore eligible app-store purchases and manage or cancel an active subscription through the store account that made the purchase.
• Delete supported memory types in the app and remove configured AI credentials. The current text-note editor does not yet expose a delete action.
• Export your library as a portable archive. Exports can contain sensitive, unencrypted content, so store them securely.
• Request access, correction, deletion, restriction, objection, or portability where your local law provides those rights.

To close your account and delete associated cloud data, follow our Data Deletion instructions. We may need to verify that the request comes from the account owner.

8. International processing

Kepnote and its providers may process information in countries other than your own. Where required, we use appropriate safeguards for international transfers. Local data that never leaves your device is not transferred by Kepnote.

9. Children

Kepnote is not directed to children under 13, or a higher minimum age where local law requires it. We do not knowingly collect account information from children below the applicable age. A parent or guardian who believes a child provided account information should contact us so we can investigate and delete it.

10. Changes to this policy

We may update this policy as Kepnote changes. We will post the revised version here and change the “Last updated” date. If a change materially affects how we use information, we will provide additional notice when required.

11. Contact us