Keepers: privacy

Keepers privacy
Effective 1 November 2026.
Provided by Moola. Support: https://project-moola-401d0.web.app/support

Keepers compares several photos of the same moment and suggests the one where the eyes are open. Your photos are read on your phone and are never uploaded, copied to our servers or shared with anyone. Eyes, sharpness and smiles are measured on the phone: on iPhone with Apple's Vision framework, on Android with Google's ML Kit face detection model, which ships inside the app and runs without a network connection. Keepers does not identify people, build face profiles or keep face measurements after a comparison.

You can try the practice burst without an account. It is drawn in the app and stays on your phone. Signing in creates a Keepers account. Account data includes your Firebase account identifier and the sign-in details you choose: with Sign in with Apple, an email address (which can be an Apple private relay address); with Google, your Google account email, name and profile photo link, which Firebase Authentication stores with the sign-in; or your mobile number if you sign in with a text-message code.

After you unlock Keepers, your choices are kept in your account so they survive a reinstall and follow you to another phone: for each burst you finish, opaque identifiers of the shots (derived from your photo library's own identifiers, not the photos), which shot you kept, which you set aside, the reason Keepers gave (eyes, expression or sharpness) and when you decided, plus your expression preference and burst window. No photo, thumbnail, file name, location or face measurement is stored in your account.

Photo access is optional. With access, Keepers looks at when your latest photos were taken and reads only photos taken close to another photo. Without access, you can still pick photos yourself in the system picker. If you ask Keepers to remove set-aside shots, your phone asks you to confirm: on iPhone they move to Recently Deleted, where Photos keeps them for 30 days; on Android the deletion is final once you confirm. Keepers never removes a photo without that system confirmation.

Google Firebase supplies authentication, Firestore, Cloud Functions, app attestation and hosting. We use these services to keep your account, recover it, verify purchases, prevent unauthorized access and process deletion. Firestore and Cloud Functions run in the Netherlands (Google Cloud europe-west4); other Google services may process data outside your country under the providers' terms and safeguards. Device and app integrity checks and service infrastructure may process technical identifiers, IP addresses and diagnostic request information. Apple and Google provide their sign-in services under their own policies, and Firebase Authentication sends phone sign-in codes by text message to the number you enter. Keepers has no advertising, analytics or crash-reporting service and no cloud vision or external AI.

Apple or Google processes purchases and payment details under its own policies. Keepers receives product, environment, transaction or purchase-reference information and an opaque account association to verify the one-time unlock, restore access, prevent duplicate ownership and handle refunds. We do not receive your full card details. Store test transactions do not grant normal purchase rights.

Your phone stores the practice choice, your preferences, a previous copy for recovery and, after you unlock, a copy of your account's choices. Android app backup follows your device settings.

Your choices remain until you remove them or delete your account. Deletion removes Keepers' live account records: your choices, purchase status, the billing-account mapping and your Keepers membership. Your shared Firebase sign-in is removed only if no other Moola app uses it. Completed deletion records and inactive membership markers are scheduled to expire after 30 days. Minimum detached store references may be retained for up to 90 days after deletion for refund and fraud reconciliation, then scheduled for removal. The original store keeps its own transaction records under its policies. A purchase linked to a deleted account needs support to recover; it is never silently transferred to a new account.

Our deletion completion confirms removal of the live application records. It does not claim instant erasure of provider infrastructure backups: Firebase describes authentication removal from live and backup systems within up to 180 days after its customer initiates deletion. We cannot remove exports, device backups or copies on phones that stay offline. Operational cloud logs are intended to keep only technical request and error information, not your choices or credentials, for the configured 30-day period.

You can export your record and delete your account in the app, all without paying. If you cannot use the app, request deletion from Moola support (https://project-moola-401d0.web.app/support) using the email address or mobile number linked to your account. We confirm ownership without asking for a password or sign-in code and aim to resolve such requests within 30 days. Support correspondence is kept for 12 months after the issue closes, unless an unresolved dispute or legal obligation requires longer. Request access, correction or removal the same way. Your statutory rights and complaint routes remain available. Keepers is not directed at children under 13.

Provider information: https://firebase.google.com/support/privacy, https://developers.google.com/ml-kit/terms, https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy. Changes to collection or purpose will be reflected here before the changed service is released.