Privacy

What we keep, and what we never store.

Last updated 8 October 2026

Who runs this

Keephouse is operated by Arami Studios LLC. Questions about this policy, or about anything we hold about you, go to hello@keephouse.app.

The short version

We never store your photographs. Each one is sent to Anthropic, the company whose AI model reads it, and Anthropic’s terms let it keep what it receives for up to 30 days — longer, up to two years, only if its systems flag the content as breaking its usage policy. More on that below.

We don’t sell your information, and we don’t share it with anyone for advertising. Keephouse has no ads, no tracking and no analytics, and this website sets no cookies.

We do keep what the app needs to work: your account, your home record, your briefings, and a few other things. Each one is named below.

What we keep

In a database run by Render, in Ohio:

Your account. Your email address, and if you sign in with Apple, the identifier Apple gives us for you and an Apple sign-in token, which we store encrypted. We ask Apple for your email address and nothing else — never your name. If you chose Hide My Email, the address we have is Apple’s relay address, not yours.
Your sign-ins. A one-way hash of each sign-in’s token, never the token itself. A sign-in expires after 30 days. We don’t record your IP address against it.
Your home. The address and postal code you give us, and your home record: what’s in the house, where each fact came from (you, a photo, or our own guess), and whether it’s confirmed.
Your calendar. What you’ve marked done, and the date you gave.
Your briefings. The text of each monthly briefing, and which AI model wrote it.
Answers you report. When you report an answer from the Ask, we keep that question, that answer, which model wrote it, your note if you add one, and the time. Nothing else from the conversation.
Notification tokens. If you allow notifications, the token Expo needs to reach each phone you’ve signed in on, and the receipt for the last notification sent to it. A phone’s token goes when you sign out on that phone, or delete your account.
A count of photo identifications. That one happened, when, and whether it worked. Not the photo, and not what it showed.
A billing ID. A random identifier that names your subscription record at RevenueCat. It isn’t your email address, and nothing about you can be read from it.

On your phone, the app keeps one thing: your sign-in token, in the iPhone’s Keychain, readable only while the phone is unlocked and never copied to another device.

What we don’t keep

Your photographs. A photo is read in memory, sent to Anthropic, and discarded. It is never written to our database, and it’s filtered out of our logs.
Your Ask conversations, unless you report an answer. The app holds a conversation in memory while you use it, and sends up to four earlier exchanges with each new question so the answer has context. We don’t save them.
Your name.
Your location. Your climate zone is worked out from your postal code against a table on our own server, with no outside lookup.
Your contacts, and advertising or device identifiers. The notification token above is the one exception, and it’s used for nothing but notifications.

Who else handles it

These companies do work for us. Each receives what its job needs, and nobody else receives anything.

Anthropic makes the AI models that read your photos, answer the Ask and write your monthly briefing. For a photo, it receives the photo. For the Ask, it receives your question, up to four earlier exchanges, your home record, your climate zone and the maintenance schedule. For a briefing, it receives your home record, your climate zone, what’s due and what you’ve marked done. It never receives the address, postal code or email address on your account. Under its terms, Anthropic deletes what it receives within 30 days, unless its automated systems flag the content as breaking its usage policy, in which case it can keep it for up to two years. It doesn’t train its models on it. Briefings are written in batches, and we ask Anthropic to delete each batch’s results as soon as we’ve collected them.
Render hosts our server, our database and this website. Its logs record the IP address of each request, and they’re kept for a limited period, on Render’s schedule. Our server keeps your photos, your address, your home record, your email address, your questions and answers, and your sign-in credentials out of the logs it writes. Render’s own request logs for this website can contain the address of a sign-in link, which stops working 15 minutes after it was sent.
Resend sends the sign-in email. It receives your email address, if there’s one on your account, and the sign-in link. The email comes from hello@keephouse.app.
Apple handles Sign in with Apple. We exchange your Apple sign-in token with Apple, and revoke it when you delete your account. Apple also takes the payment when you subscribe.
RevenueCat: when you subscribe, Apple handles the payment and RevenueCat keeps our record of your subscription. RevenueCat knows you by your billing ID, never your email address, and we’ve turned off its collection of device identifiers. It does receive your IP address and your App Store purchase receipt.
Expo delivers app updates and notifications. When the app checks for an update, Expo receives your IP address and your app and device version. If you allow notifications, Expo receives the token that reaches your phone and the text of each notification, which names the month and nothing about your house.
Formspark receives this website’s waitlist: the email address you enter, the page that linked you here, and the link’s query string. The website’s question about the name goes to a separate form and is anonymous.

Where it lives, and how it’s protected

Your information is processed and stored in the United States. The app talks to our server over HTTPS only. Sign-in tokens are stored as a one-way hash, the Apple sign-in token is encrypted, and your phone keeps its token in the Keychain.

Deleting it

Delete account, on the app’s Account screen, removes your account and everything listed under What we keep, immediately. It also revokes your Apple sign-in and deletes your record at RevenueCat. If either of those fails, your account is still deleted; we don’t hold it back waiting on them.

Deleting your account doesn’t cancel your subscription. Apple bills it. Cancel it in Settings → your name → Subscriptions.

Some copies outlive the deletion:

Render’s logs and database backups, until they age out, on Render’s schedule.
Resend’s record of the emails it delivered.
What Anthropic received, under the terms above.
Apple’s record of your purchases, which is Apple’s.
Your Apple sign-in, or RevenueCat’s record, if revoking or deleting it failed.
A record that a monthly briefing batch ran, which names only our internal id numbers.

The waitlist is separate from the app. Email hello@keephouse.app to come off it. The answers to the website’s question about the name are anonymous and can’t be matched to anyone, so there’s nothing of yours in them to find.

Your say over it

Wherever you live, you can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email hello@keephouse.app. Most of it you can see and change in the app, and Delete account removes it without asking us at all.

Children

Keephouse isn’t for anyone under 18, and we don’t knowingly hold information about anyone under 18. If you think we do, tell us and we’ll delete it.

Changes

The date at the top says when this policy last changed. If a change matters — something new kept, or a new company receiving it — we’ll say so in the app or by email before it takes effect.

If Keephouse moves to a company formed to run it, your information goes with it under this same policy, and you’ll hear from us first.