Privacy Policy
Privacy Policy
Effective Date: 12 March 2026 Last Updated: 12 March 2026
INVENTIVE OTTERS S.R.L. ("we", "us", "our") operates the Keepsy mobile application and companion web application (collectively, the "Service"). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Service.
We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Romanian data protection law.
1. Data Controller
INVENTIVE OTTERS S.R.L. Strada EROILOR, Nr. 180, C2, parter, Scara 2, Ap. 15 Floresti, Jud. Cluj, Romania Email: support@inotter.com
2. What Data We Collect
2.1 Account Data
Keepsy uses anonymous authentication. We do not require your name, email address, phone number, or any social login to create an account. When you first open the app, a unique guest identifier and authentication token are generated automatically. No personally identifiable information is required to use the app.
2.2 Profile Data
During onboarding, you provide:
- A display name (which may be your real name or any name you choose).
2.3 Journal Data
When you create a journal for a loved one, you provide:
- The name of the person you are creating the journal for.
- Your relationship to that person (e.g., "Parent", "Grandparent", "Friend").
- How long you have known that person.
- A contact method (email or WhatsApp) and the corresponding contact value (email address or phone number) for that person.
- A language preference for the questions sent to that person.
- Avatar customisation choices (hair style, hair colour, face style, skin colour, background colour, beard style).
2.4 User-Generated Content
- Text answers written in response to journal questions.
- Video answers recorded and uploaded in response to journal questions, along with automatically generated video thumbnails and video duration metadata.
- Photo attachments added alongside answers.
2.5 Technical Data
- Authentication tokens and session data necessary for the app to function.
- Device platform (iOS, Android, or Web), used only to select the correct subscription configuration.
2.6 Data We Do NOT Collect
- We do not collect your location.
- We do not access your device contacts, camera, or microphone without an explicit action.
- We do not use any analytics, tracking, or advertising SDKs.
- We do not use cookies in the companion web application.
- We do not collect device identifiers for advertising purposes.
3. How We Use Your Data
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Providing and operating the Service (creating journals, storing answers, delivering questions) | Performance of a contract (Art. 6(1)(b)) |
| Authenticating your session securely | Performance of a contract (Art. 6(1)(b)) |
| Enabling you to share a journal with a loved one via invite links | Performance of a contract (Art. 6(1)(b)) |
| Processing subscription purchases | Performance of a contract (Art. 6(1)(b)) |
| Responding to your support requests | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not use your data for profiling, automated decision-making, or targeted advertising.
4. How We Share Your Data
4.1 With Your Loved Ones
When you invite a loved one to answer questions through a journal, they will be able to see the questions you have selected for them and their own answers. They will not be able to see your journal entries, your profile information, or answers authored by you.
4.2 Third-Party Service Providers
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure hosting (servers and storage) | All data stored in the Service | European Union (Germany) |
| PocketBase | Backend database and file storage engine (self-hosted on Hetzner) | All data stored in the Service | Self-hosted in EU |
| Superwall, Inc. | Subscription and paywall management | Anonymous user identifier, subscription status | United States* |
*Superwall processes limited data (an anonymous user identifier) for the purpose of managing subscription access. No personal information such as names, email addresses, or content is shared with Superwall.
4.3 Payment Processors
Subscription payments are processed by Apple (App Store) or Google (Google Play), depending on your device. We do not receive or store your payment card details.
4.4 No Sale of Data
We do not sell, rent, or trade your personal data to any third party.
5. Data Storage and Security
All backend data is stored on servers operated by Hetzner Online GmbH in the European Union (Germany). All communications between the app and our servers are encrypted using HTTPS/TLS.
When you share a journal invite link, the companion's authentication credentials are encoded in the URL fragment (the part after the # symbol). URL fragments are not transmitted to the server in HTTP requests, which means these credentials are not recorded in server logs.
6. Data Retention
- Your data is retained for as long as your account exists and you continue to use the Service.
- If you delete a journal, the associated answers, invites, and companion accounts are removed.
- If you wish to have all of your data deleted, you may contact us at support@inotter.com and we will process your request within 30 days.
7. Your Rights Under the GDPR
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you. |
| Rectification (Art. 16) | Request correction of inaccurate personal data. |
| Erasure (Art. 17) | Request deletion of your personal data. |
| Restriction (Art. 18) | Request that we limit the processing of your data. |
| Data Portability (Art. 20) | Request your data in a structured, machine-readable format. |
| Objection (Art. 21) | Object to processing based on legitimate interests. |
| Withdraw Consent | Where processing is based on consent, withdraw it at any time. |
To exercise any of these rights, please contact us at support@inotter.com. We will respond within 30 days of receiving your request.
8. Children's Privacy
Keepsy is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16.
9. International Data Transfers
Your primary data is stored within the European Union. Where a limited amount of data is processed by a service provider outside the EU, such transfers are carried out in compliance with GDPR Chapter V, relying on appropriate safeguards such as Standard Contractual Clauses (SCCs).
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page.
11. Contact Us
INVENTIVE OTTERS S.R.L. Strada EROILOR, Nr. 180, C2, parter, Scara 2, Ap. 15 Floresti, Jud. Cluj, Romania Email: support@inotter.com