Privacy Policy

This policy explains what Kept collects, why, who it goes to, and your choices. Kept is run by Kenneth Lee Kang (“Kept”, “we”). Kept doesn’t sell your information, share it for advertising, or track you across other apps and websites.

What Kept collects

• Your account: your email address and password. The password is stored only in scrambled (hashed) form.
• Your profile: username, date of birth, state, and a profile photo if you add one.
• Your challenges: the habit (and language and level), length, stake, charity, way to pay (a label only, in this demo), your time zone, and when you signed.
• Your check-ins: photos taken with Kept’s camera (or screenshots, for habits that allow them) and when they arrived, notes you write, the book and pages you read, quiz questions and your answers, friends’ approvals and notes, the AI’s decisions, and appeals.
• Your free trackers: each habit’s name, its goal and shields, and the days you marked done. Only you see them.
• Friends, pledges and gifts: your friend requests and friendships, the pledges and gifts you make, and a record of what you gave to a charity (the amount, the charity and the habit it backed), which stays yours even if the challenger deletes their account.
• Your badges: the ones you choose to show on your profile. The badges themselves are worked out from your challenges and pledges, not stored.
• Notifications, if you allow them: your phone’s notification address (a push token) and which kinds you turned on. It’s deleted when you sign out or delete your account.
• If you join the waitlist on habitkept.com: your email address, and when you joined. Nothing else; the site has no cookies or analytics.
• On your phone only: your sign-in (kept in the iPhone’s Keychain), your appearance setting, whether you’ve seen the tutorial and the privacy note, and your pretend payment methods.

Kept doesn’t collect your location, contacts, health data or advertising ID, and has no analytics, ads or session recording.

How it’s used

• To run your account and your challenges.
• To show your challenges to your friends, and to check your days (friends, the AI, and appeals).
• To keep Kept safe: the age check, refusing passwords known from data breaches, and enforcing the Community Rules.
• To email you about your account, such as sign-in codes, and, if you joined the waitlist, to tell you when Kept launches. Every launch email has a link to leave the list and Kept’s postal address. Kept sends no other marketing email.

Who can see what

• Anyone on Kept: your username and profile photo.
• Your friends: your challenges, check-in photos and completion rate, and the missed days you bought a shield for, with its price.
• If you make a challenge public (it’s off unless you turn it on): people who aren’t your friends can find it and see its progress, meaning the habit, the day, shields left, the missed days you bought a shield for and its price, the charity and the pledge total. Never your username, photo, profile or completion rate.
• Backers show to everyone else as “Backer A”, “Backer B”, never by name.
• No one: your email address, date of birth and state are never shown to anyone.

Services that receive your information

• Supabase runs Kept’s database, sign-in, photo storage and server functions, on servers in the United States.
• Apple, if you sign in with Apple: Apple shares your email address, or a private relay address if you hide it. Kept keeps a token from Apple only so it can disconnect Kept from your Apple ID when you delete your account.
• Anthropic’s AI (Claude) checks a day when no friend has, if you allow it: Kept asks before your first check-in, and nothing goes to Anthropic unless you said yes. Kept sends it the check-in photo, your note, the book and pages, and quiz questions and answers. They’re used only to check the day, not to train AI models. You can stop it in Settings → Privacy & security.
• Have I Been Pwned: when you choose a password, the app sends the first 5 characters of a scrambled version of it, never the password itself, to check it hasn’t appeared in a data breach.
• Resend sends Kept’s email (sign-in and reset codes, and launch news to the waitlist), so it handles your email address and the message.
• GitHub hosts habitkept.com, so, like any web host, it sees the address of the device visiting the site.
• Expo’s push service and Apple deliver Kept’s notifications, so they handle your phone’s notification address and each notification’s text, such as “@ben backed you”.
• Apple distributes the app. Apple’s own privacy policy covers what Apple collects, such as crash reports you choose to share.

When real payments arrive, card payments go through a payment processor (Stripe) and crypto through your own wallet; this policy will be updated before then. We also share information if the law requires it or to protect someone’s safety, and if Kept moves to Ka Tech or another company, your information moves with it under this policy.

How long it’s kept

Check-in photos are deleted 30 days after their challenge ends. A waitlist email is deleted when you leave the list or ask us to remove it. Everything else stays while you have an account. Deleting your account removes your profile, photos, challenges, check-ins, friendships and pledges at once; copies in the database provider’s backups expire on its own schedule.

Your choices

• See and change your information in the app: username, state and password in Settings.
• Ask us to correct your email or date of birth, or for a copy of your information, at hello@habitkept.com.
• Delete your account at any time: Settings → Delete account.

We answer requests within 45 days, wherever you live in the United States, and using these choices never changes how Kept treats you.

People under 18

Kept is only for adults. The app asks for your date of birth and won’t save a profile for anyone under 18. If we learn that someone under 18 has an account, we delete it. If you think a child is using Kept, email hello@habitkept.com.

Security

Your sign-in stays in the iPhone’s Keychain, connections to Kept are encrypted, and database rules let each person read only what the app says they can. No system is perfect: if a breach affects your information, we’ll tell you as the law requires.

Found a security problem? Email hello@habitkept.com with what you found, and please don’t use it to reach anyone else’s information.

Changes

We’ll tell you in the app before changes to this policy take effect.

Contact

Kept is run by Kenneth Lee Kang, Portland, Oregon.

• Email: hello@habitkept.com
• Mail: Kenneth Lee Kang (Kept), 17852 NW Solano Ct, Portland, OR 97229