Privacy

First pass · 15 September 2026

This is written from how the app actually works, not from a template. Where something still needs a lawyer's eye it is marked TODO.

The short version

Kept runs on your iPhone. Your conversations, the profile it builds about you, and everything it learns stay on the device and, if you turn it on, in your own iCloud. When Kept needs something from the internet — a hotel, a fare, a table, a web result — it sends only generic search terms to a small server we run, with no name, no account and no identifier that points back to you. We sell nothing and we show no ads.

What stays on the phone

• Your asks and Kept's replies. The thread is stored in the app's local database.
• Your context: the facts Kept keeps about you — home airport, usual airline, the places you go back to, your sleep window, who you see, what you've told it directly. Every fact is visible in Context with the evidence behind it, and you can edit or delete any of it.
• Your rules and preferences — price ceilings, seat choice, cabin, exclusions. These are applied to results on the device and are never sent anywhere.
• Any credentials for a connected account, which live only in the iPhone Keychain.

Most of Kept's thinking is done by Apple's on-device model. Some larger steps run on Apple's Private Cloud Compute, which Apple operates so that the data is not retained and is not readable by Apple. We never see any of it.

iCloud

If you turn on the iCloud mirror, the facts you have accepted or typed are copied to your own iCloud private database so a reinstall or a second device starts warm. That database is yours, under your Apple Account. We have no access to it. Turning the mirror off, or deleting the app's iCloud data from your Apple Account settings, removes it. Health figures are never mirrored; they stay on the one device.

Your account

The only sign-in is Sign in with Apple. We ask for your name and email so the app can address you; both are stored on the device. There is no password, no profile on a server of ours, and nothing to make up. You can sign out and delete the account and everything attached to it from Settings inside the app.

TODO — confirm the account-deletion wording meets App Store Guideline 5.1.1(v), and state a retention period for anything Apple returns to us at sign-in.

Searches: what leaves the phone, and how

Searching for hotels, flights, restaurant tables or the web is the one thing Kept cannot do on the device. Those requests go to a small server we run — "the worker".

• No account. The worker has no notion of who you are. It holds no email, no Apple ID, no name, no loyalty number. The app itself refuses to put them in a request: each kind of search has an allow-list of fields, and anything else is rejected before it is sent.
• Only generic fields. A search carries things like a city, dates, a number of guests, a party size, airport codes, a cuisine, a time window — the same words a stranger would type into a search box.
• Names are stripped on the phone before anything is sent. That includes your own name and the people in your contacts and calendar, removed from the text of a request as well as from its fields.
• Preferences travel without you. If a search is shaped by how you like to travel, what goes with it is codes, hours and numbers — airport codes, a departure window, a price ceiling, a cabin rule. Who you are travelling with does not.
• It knows the app, not you. Requests are authenticated with Apple's App Attest, which proves the request came from a genuine copy of Kept on a genuine iPhone without identifying the phone or the person. The resulting token is random and anonymous; we store only a hash of it, to count requests against the rate limits.
• Results come back sealed. The phone generates a one-time encryption key for each job and keeps it; the worker encrypts the result with that key. Anything holding a result in the meantime holds a job id and an encrypted blob, and nothing else. Stored jobs delete themselves 24 hours later.

Who the worker talks to

To answer a search the worker queries the same public travel sites and search engines you would use yourself, and passes them the search parameters and nothing else. They see the worker, not you: no name, no account, and an address belonging to the server rather than to your phone.

TODO — name the hosting provider and every search, travel and infrastructure subprocessor in a list here, link each one's privacy policy, and confirm which of them count as processors and which as independent controllers under GDPR/CCPA.

Research and planning conversations

When you hand a longer piece of planning or research to Kept, the back-and-forth runs on the worker rather than on the phone. That transcript holds the subject, not you: cities, dates, party sizes, the topic you asked about. It is trimmed as it goes and deleted 24 hours after the last message. It is not used to train any model.

Apple frameworks Kept can read

Only with your permission, only on the device, and each one can be declined or switched off later in iOS Settings: Calendar, Reminders, Contacts, Health, Location, and AlarmKit. Kept reads these to build your context — the flights on your calendar, a birthday, your sleep window, the places you return to. None of it is uploaded to us and none of it is ever put in a search request.

Kept cannot read Mail, Messages, Safari or Wallet, and does not try. It also cannot read documents or photographs you hold, and does no text recognition on images.

Booking

Kept does not book anything. It finds options and hands you a button to finish in the provider's own app or website — Expedia, Resy, OpenTable, the airline. Your payment details, your name and your loyalty accounts are given to them, by you, and never pass through Kept.

What we never do

• No advertising, and no ad identifiers.
• No sale or sharing of personal information.
• No analytics profile of you. TODO — state exactly which crash/diagnostic reporting ships in the released build, if any, and disclose it here and in the App Store nutrition label.
• No training of models on your data.

This website

The page you are reading is static HTML and CSS. It sets no cookies, runs no JavaScript, loads nothing from anyone else, and carries no analytics or trackers of any kind. Our host keeps ordinary web server logs; we don't build anything on top of them. It seemed like the least we could do.

Children

Kept is not intended for children under 13. TODO — set the final age rating and confirm the COPPA position.

Changes and contact

Kept is made by Ellington Ventures, LLC, a Delaware limited liability company, at 131 Continental Drive, Suite 305, Newark, DE 19713. If this policy changes in a way that matters, the app will say so before the change takes effect. Questions, or a request to see or delete what we hold, go to Support — jason.t.ellington@gmail.com.

TODO — confirm Ellington Ventures, LLC is the named data controller for GDPR, appoint an EU/UK representative if one is required, and add the CCPA rights and request process.