Version 1.0 · Last updated:
Data controller: [LEGAL ENTITY NAME], [REGISTERED ADDRESS], [COUNTRY]. Privacy contact: privacy@onekeep.app. EU representative (GDPR Art. 27): [NAME/ADDRESS]. ICO registration: [PENDING].
OneKeep helps your household keep track of life admin. Because we ask you to entrust us with sensitive information: your data is encrypted and stored in the EU; we never sell it and never use it — or your documents — to train AI; when you photograph a document for auto-fill we read the useful details and don't keep the image; documents and codes you save to the Vault are end-to-end encrypted (we can't read them); you can export or delete everything any time; and we are not a bank. We use GDPR as our global baseline.
| Category | Examples | Purpose | Lawful basis |
|---|---|---|---|
| Account | Email, auth identifier, sign-in provider | Create and secure your account | Contract |
| Household content | Tracked items, extracted fields, bills, budget, lists, chores, meals, recipes, contacts, calendar, inventory, upkeep, travel | Provide the service | Contract |
| Document images (transient) | Photos/PDFs you capture for auto-fill | Read dates/fields — not retained | Contract |
| Vault items you choose to store | Documents (incl. IDs if you add them) and secure codes — end-to-end encrypted | Keep them for you | Consent / explicit consent |
| Contacts (incl. third parties) | Names, numbers, notes | Household contacts in one place | Legitimate interests |
| Subscription | Purchase/entitlement, tier, seats | Manage your plan | Contract |
| Device & diagnostics | Push token, app/OS version, crash data | Deliver reminders, keep stable | Legitimate interests |
| Analytics (optional) | Feature usage (amounts stripped) | Improve the app | Consent |
We practise data minimisation — collecting only what a reminder or a household actually needs.
We do not sell or rent your data; do not use your data or documents to train AI (our extraction provider is contractually barred from retaining content or training on it); do not connect to your bank or hold bank credentials; do not show third-party ads; do not make decisions with legal or significant effect about you by solely automated means (AI only pre-fills fields you confirm); and do not put personal data in URLs or analytics.
When you photograph or upload a document for auto-fill, the image is sent over an encrypted connection to our extraction service (Anthropic Claude, under a zero-retention, no-training contract). We keep only the structured fields you confirm — we do not store the image. This is separate from the Vault (Section 6).
Members share data according to the per-section access the owner grants, enforced by the server. Owners can change access any time. An owner may also create a guest emergency card: a private, tokenised link that expires after 48 hours and shows only the contacts/notes the owner selected — never your codes, documents or finances. Data about other people (e.g. contacts) is processed on the basis of our legitimate interest in providing a household tool; anyone can ask us to remove their details.
Items you save to the Vault are encrypted on your device with a key derived from your passphrase before they reach us. We store only ciphertext and cannot read them, even if compelled; they never enter the extraction pipeline or our logs. If you lose your passphrase we cannot recover the contents.
We use vetted providers, each under a GDPR data-processing agreement: Supabase (database/auth/storage, EU); Anthropic (document extraction, US — under Standard Contractual Clauses, zero-retention); Knock (email/push); RevenueCat (subscriptions, US — SCCs); PostHog EU (optional analytics); Sentry (crash monitoring, no personal data); Resend/Twilio (invite email/SMS you send, US — SCCs); Apple/Google (sign-in, purchases). Where data is processed outside the EEA we rely on SCCs plus supplementary technical measures (encryption, zero-retention) and a transfer risk assessment.
Our service is not directed at children as independent users. The self-registration minimum age is 16 (the strictest EU digital-consent age). Younger members exist only as child accounts created by an account owner who confirms parental responsibility; such accounts collect minimal data, are deny-by-default for sensitive sections, are never profiled or marketed to, and follow age-appropriate design (ICO Children's Code).
Your data is stored in the EU and encrypted in transit and at rest, with access governed by row-level security tied to household membership; Vault contents are additionally end-to-end encrypted. See our security overview.
We keep your data while your account is active. On account deletion we purge your household data and encrypted backups cycle out within 30 days; see data deletion. Support messages: up to 24 months. Optional analytics: up to 14 months. Purchase/tax records: retained where the law requires (typically 6 years).
Optional product analytics and any marketing are off unless you opt in, and you can withdraw consent any time. The website uses only strictly necessary cookies unless you consent to more.
Under GDPR you can access, rectify, erase, restrict, object to, and port your data, and withdraw consent. OneKeep provides self-serve export and deletion in the app; for anything else contact privacy@onekeep.app (we respond within one month). You may complain to the ICO (ico.org.uk) or your local EU supervisory authority.
If a breach is likely to risk your rights and freedoms, we notify the competent supervisory authority within 72 hours of becoming aware, and affected users without undue delay.
We'll update this policy as OneKeep evolves and notify you of material changes in-app or by email.