Keppet Privacy Policy

Effective 17 October 2026 · applies to the Keppet app (web, Android and iOS) and keppet.app

Who we are

Keppet is run by Cyguee Limited, company number 17139686, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Cyguee Limited decides how and why your personal data is used, which makes it the controller under UK data protection law. You can contact us at privacy@keppet.app.

Your financial data

Keppet stores your accounts, transactions, budgets and recurring rules as plain-text files in a private git repository (keppet-data) on your own GitHub, GitLab, Codeberg, or self-hosted account. Your device syncs with your git provider using your own sign-in. For GitHub the device talks to GitHub directly. For GitLab, Codeberg and self-hosted servers the requests pass through a relay on Keppet's servers that forwards them and stores nothing. Keppet does not keep a copy of your ledger. You can leave at any time. The files are plain JSON that you can read without Keppet.

If you instead choose to store your data in Google Drive or Microsoft OneDrive, the same plain-JSON files are written to a private folder named keppet-data in your own Google Drive or OneDrive account. Your device syncs directly with Google Drive or OneDrive using your own sign-in. Keppet holds no copy of your ledger on these backends either. Sign-in is Google or Microsoft OAuth (see "Sign-in" below). Your device also keeps a working copy of your ledger in your browser or app storage.

What Keppet's servers keep

• A sign-in record: a one-way hash of your sign-in provider and your account identifier (your username on a git host, your account ID on Google or Microsoft), the provider name, your first and last sign-in dates and a sign-in count, used to count users. This is your hashed ID. The record holds no email address, token or financial data. Keppet's operator can attach a label to a hash on the operator dashboard, for example to recognise a tester. The hash is a plain SHA-256 of those two values with no secret added, so someone holding a copy of the database could confirm that a known username has an account by computing the same hash.
• Keppet AI usage: the same hash with a count of free reads used, a count of requests per day (limit 50 a day, kept for about a week) and a subscription flag, used to apply those limits and to run the subscription. Nothing about the content of what you scanned or typed.
• Receipt images: every receipt you snap, attach or share is uploaded to a private Keppet storage bucket before the AI reads it, whether or not you have free reads left. Photos and PDFs are accepted. The stored file name contains your sign-in provider, your username and a code derived from the file. Only a request that carries a valid sign-in token for the same account can read an image. The app lets you delete an image only while no transaction uses it (Talk, Receipts waiting). Nothing deletes an image automatically. To delete an image that a transaction uses, email privacy@keppet.app. Export files contain no receipt images, and a Keppet backup holds only each image's storage reference.
• Bug reports and ideas you send: your message, up to four screenshots if you attach them, an optional contact detail, your sign-in provider and username, your hashed ID, the app version, the page you were on, your screen size, a description of your device and browser, the number of accounts, categories, transactions and budgets you have, the time, your sync status and up to 25 recent error messages. The app attaches no payees, amounts or notes. Reports are filed as issues in a private repository on GitHub. Screenshots are stored in a separate Keppet storage bucket under a random file name. Anyone who has a screenshot's web address can open it without signing in, and it may be cached for up to a year. Nothing deletes reports or screenshots automatically.
• An optional notification email: if you turn on "Email me when my free AI actions run out" in Settings, we store the address you give us, next to your usage record, until that one email is sent. The address is then deleted. Turn the option off any time in Settings to delete it sooner. We keep the date the email was sent, and the email is sent through Resend.
• Subscription records: if you subscribe, Keppet stores the payment provider's subscription reference, your plan (monthly or yearly), your price tier, the status and the renewal or expiry dates, linked to your hashed ID. For Google Play and App Store purchases the record also holds the purchase token or original transaction ID, the product, whether the subscription renews, and the country that the store reports for the purchase. The price tier is set from the country that Cloudflare detects for your connection when you open checkout.
• Access codes and operator actions: if you redeem a gift code, Keppet stores which hashed ID redeemed it and when. Keppet also logs, against your hashed ID, each time the operator grants, revokes or resets access.
• Daily totals: Keppet keeps daily totals with no identifier, such as the number of sign-ins and AI requests that day. Keppet stores daily totals of sign-in starts and failures for each provider, first transactions saved and active devices each week, with no identifier, no IP address and no ledger content attached.

There are no third-party analytics, no advertising SDKs, and no tracking of your financial activity.

Keppet AI

When you use Keppet AI (snapping a receipt or typing a purchase), your receipt image or text is sent over an encrypted connection to Keppet's server, which forwards it to a major cloud AI provider that processes it on Keppet's behalf. Under our paid-tier terms, this content is not used to train models. Keppet's servers process it in memory to return the transaction and do not store the text. The receipt image is stored separately, as described under "What Keppet's servers keep". The provider keeps it only in abuse-detection logs for up to 30 days, then deletes it. The provider's temporary cache is switched off. The resulting transaction is written to your ledger by your device with your credentials, never by our servers. Every account is limited to 50 AI requests a day.

Voice input is turned into text by your device's or browser's own speech service, such as Apple's or Google's, which may process the audio on its servers. Keppet's servers do not receive the audio.

Sign-in

You sign in with your git host, Google or Microsoft account using OAuth. Your sign-in token is stored on your device. When you sign in, your provider sends a one-time code to Keppet's server, which exchanges it for your token using Keppet's app credentials, reads your account name or ID from the provider, and passes the token to your browser or app. Keppet does not store the token. When you use a feature that needs to know who you are (receipt storage, Keppet AI, subscriptions), your device sends the token to Keppet, which checks it with your provider and remembers the result in memory for up to five minutes. Keppet does not store the token. Keppet holds no passwords and no server-side sessions.

Signing in with Google or Microsoft works the same way, and Keppet reads your account ID from the provider. When your token expires, your device sends the refresh token to Keppet's server, which relays the refresh request to your provider. Keppet's code does not write the token to a database or a log. Your browser or app stores your session and a working copy of your ledger. During sign-in a temporary cookie holds the sign-in state for up to ten minutes.

Payments

On keppet.app the Keppet AI subscription is sold through Stripe, which acts as merchant of record. Keppet does not see or store your card details. Keppet sends Stripe your hashed ID as a reference so the payment can be matched to your account. In the Android app the subscription is sold as an in-app purchase through Google Play, and in the iOS app through the App Store. The store processes the payment. Keppet does not see or store your card details, and receives the purchase token (Google) or original transaction ID (Apple), the product, status and dates from the store.

Who receives your data

Keppet uses these providers to run the service: Cloudflare (hosting, database and file storage), the AI provider described above, Stripe (web payments), Google (Play billing), Apple (App Store billing), Resend (email) and GitHub (the private tracker for bug reports). The sync provider you choose (GitHub, GitLab, Codeberg, Google or Microsoft) holds your ledger under its own privacy policy.

How long we keep it

Sign-in, usage, subscription and gift code records stay until you ask us to delete them. Nothing deletes them automatically. Daily request counts are deleted after about a week. Receipt images, bug reports and screenshots stay until you ask us to delete them, apart from the receipt images that the app lets you dismiss yourself.

Deleting your data

• Your ledger: delete the keppet-data repository on your git provider, or, if you use Google Drive or OneDrive, delete the keppet-data folder there. That is the master copy.
• On your device: Settings → “Clear all data”.
• Records on Keppet's servers (sign-in record, usage record, receipt images, subscription and purchase records, gift code records, notification email, bug reports and their screenshots): email privacy@keppet.app from the address you use for your account, naming your provider and username. We will ask you to confirm that you control the account before we delete anything, and we will delete the records within one month. This is also the deletion path referenced in the Google Play listing.
• Bug reports: tell us roughly when you sent the report. We will delete the issue and its screenshots.
• Payments: Stripe, Apple and Google keep their own records under their own rules. Deleting Keppet's records does not cancel a subscription. We may need to keep payment records that the law requires us to keep.

Your rights

Under UK data protection law you can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, and ask for it in a portable format. Where we rely on your consent you can withdraw it at any time. To use any of these rights, email privacy@keppet.app. We will reply within one month. Keppet's records are keyed to a hashed ID, so we will ask you to confirm that you control the account before we act on a request. You can complain to the Information Commissioner's Office at ico.org.uk.

Changes and contact

If this policy changes materially we will note it here with a new effective date. Questions: privacy@keppet.app. Cyguee Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.