Privacy Policy

Simena Digital LLC · privacy@kepttrading.app

Last updated: October 4, 2026

Kept is a personal trading-journal app made by Simena Digital LLC ("we," "us," or "our"), a Wyoming limited liability company based in the United States. This policy explains what data we collect, why, and how we protect it. The short version: your trades live on your phone and in your own iCloud Drive; our servers manage your account, subscription, AI consent and technical usage records. Optional AI requests pass through our backend to OpenAI; we do not keep a copy of your journal.

1. Information You Provide

• Account information: name and email address (via Sign in with Apple), used only to tie your subscription to your account so it can be restored on a new device, and to record your AI-extraction consent.
• Trades and notes: the trades you log — the sentence you typed or said, the symbol, prices, size, your reasons and how you felt — and every later edit. Stored only on your device (in a journaled local database) and in an encrypted backup to your own iCloud Drive that you control. We do not store a server-side copy of your journal. The text of a note leaves your phone only if you turn on AI trade extraction (see §3).
• App preferences: your theme, haptics and AI consent settings.

2. Information Collected Automatically

• Subscription state: whether your subscription is active, its expiry, and whether you have used the introductory offer — sent to us by RevenueCat and Apple so the app can unlock your purchase.
• Crash and error reports: if the app crashes, Sentry receives a technical report (device model, OS version, app version, the error). We avoid adding journal content to diagnostic reports. The mobile event filter removes email and IP-address fields and authentication headers, and masks text and images in error replays. Technical installation identifiers may accompany diagnostics.
• Request metadata: standard server logs (request id, route, timing, status) when the app talks to our backend. Never the content of a note.

We also receive IP addresses and user agents as ordinary HTTP request data, and session identifiers for authentication. Sentry receives sampled performance timings, diagnostic interactions and masked replays around some errors. Backend diagnostics may be linked to your internal account ID. RevenueCat receives Apple Search Ads attribution data, linked to subscription records, to measure our own App Store campaigns. Expo Updates receives technical device-platform and app-version information to deliver app updates.

3. AI Trade Extraction (optional)

Kept sends the text of your trade note — the symbol, prices and the words you typed or said — to OpenAI, which runs the AI model that corrects speech-recognition errors and fills in trade cards. OpenAI processes this data on our behalf, does not train on API data by default. Response storage is disabled; abuse-monitoring logs may be retained for up to 30 days, or longer when required for legal or safety reasons. Recordings stay on your device and are included in encrypted backups. Speech is converted to text on your device; only text is sent for AI extraction. You can turn this off any time in Settings › AI & Privacy, and log trades by hand without it.

Audio is retained locally until you delete its debrief and is included in encrypted backups; we do not create voiceprints or identify speakers.

Extraction runs only after you tap Enable on the consent sheet shown before your first extraction. Until then, and whenever the setting is off, the same trade card opens blank with your sentence in the note field and no text is sent anywhere.

With AI enabled, transcript text may also be sent through our backend to OpenAI to correct speech-recognition errors and extract trades from a debrief. We send text, not audio recordings. Turning AI off stops these AI requests; on-device transcription and manual entry remain available.

Kept requests microphone access only to record your debriefs. Recording begins when you start it and can continue in the background or while the phone is locked until you stop it. Apple’s on-device speech engine may need to download a language model before transcription is available. You are responsible for obtaining any permission required to record other people.

4. Data Retention and Deletion

Kept disables OpenAI response storage. OpenAI may retain abuse-monitoring logs for up to 30 days, or longer when required for legal or safety reasons. Kept's own servers do not store your note text beyond the request. Your trades are stored on your device and in your own iCloud Drive backup, which you control.

• Trades: removing a saved trade archives it from the journal; its underlying history remains in the local database and backups. Deleting a draft removes the draft. To erase the complete local journal, delete the app and separately remove its backup files. We hold no server-side journal copy.
• Account: Profile › Delete Account soft-deletes your account immediately and permanently deletes it after a 30-day grace period during which you can sign back in to restore it. Deletion revokes your Sign in with Apple token.
• Extraction records: we keep a per-request cost row (model, latency, token counts, timestamp) for billing and abuse control. It never contains the note text or the result.

Account deletion does not automatically erase your local journal, existing backups or Apple subscription. Remove local records and backup files separately, and cancel your subscription through Apple if desired. After permanent account deletion, we retain a hashed Apple identifier, prior introductory-offer status and deletion date indefinitely for abuse prevention and deletion auditing. This hash is a pseudonymous identifier, not anonymous data.

AI usage records contain an internal user identifier for quota and cost accounting. They are not automatically removed by account deletion and currently have no automatic expiry; contact us to request deletion of these records. Technical service logs and third-party diagnostic records follow the configured retention of the relevant service; contact us for an access or deletion request. If you email support, we process your email address and the information you choose to send to handle your request.

5. How We Use Your Information

• To operate the app: sign you in, unlock your subscription, and fill in a trade card when you ask it to.
• To keep the service reliable and honest: crash reports, request logs, and an abuse cap on extraction requests.
• We do not sell your personal data or display third-party advertising. With your permission, we measure our advertising across apps and websites.

Reminder and offer notifications are scheduled locally with your notification permission. Offer eligibility and reminder state are stored locally per account. Kept uses AppsFlyer to measure installs, onboarding completion and subscription activation. After the name step, iOS asks whether you allow tracking. If you allow it, device identifiers (including IDFA), subscription events and advertising interactions may be shared with our advertising measurement providers and configured advertising partners to measure our campaigns. If you decline or tracking is restricted, Kept does not collect IDFA and blocks AppsFlyer partner sharing; limited install and event measurement and Apple’s privacy-preserving attribution may continue. You can change your choice in iOS Settings › Privacy & Security › Tracking. We never send your name, email, trades, notes, transcripts or recordings to AppsFlyer. This website does not use analytics cookies or advertising scripts; our server processes ordinary request metadata to serve and protect it.

6. Third-Party Services

• Apple — Sign in with Apple, in-app purchases, on-device speech recognition, iCloud Drive (your own container).
• RevenueCat — subscription management, receipt validation and Apple Search Ads attribution. RevenueCat receives account identifiers, purchase history and Apple’s AdServices attribution token. Kept also links the AppsFlyer installation ID to RevenueCat so subscription events can be attributed without duplicate purchase reporting. IDFA is collected only when iOS tracking permission is granted; partner-sharing restrictions follow that permission.
• AppsFlyer — install, onboarding and subscription attribution using technical device information, installation identifiers and advertising data. Advertising-partner sharing is controlled by your tracking choice.
• OpenAI — the AI model behind trade extraction, acting as our data processor (see §3).
• Sentry — crash and error reporting, sampled performance diagnostics and masked error-session replays. Text, images and vectors are masked in replay; technical interactions, timings and device information help diagnose problems.

These providers process data under their applicable service and privacy terms. Apple stores encrypted backups in your iCloud Drive when available. OpenAI receives text for AI features you enable; RevenueCat handles subscription identifiers and purchases, and Sentry receives technical diagnostics. Our hosting provider, Hetzner, operates the infrastructure for our backend. Service providers may process data outside your country, including in the United States.

Expo Updates delivers app updates using technical platform and version information. Data held by third-party services, including Apple account data and RevenueCat purchase records, is subject to those services’ own retention policies.

7. Data Storage and Security

Your journal is stored on your device. Backups use AES-GCM encryption and go to your iCloud Drive when available, with a local fallback when it is not. The encryption key uses synchronizable Keychain storage; cross-device restoration depends on iCloud and Keychain availability. Automatic backups are scheduled by iOS and are not guaranteed to run every night. Our backend runs in the EU; connections use TLS; session tokens are stored in your device's Keychain.

8. Legal Basis and Your Rights (GDPR / UK GDPR)

We process account and subscription data to perform our contract with you (Art. 6(1)(b)), AI extraction on your consent (Art. 6(1)(a), withdrawable any time in Settings), and crash reports on our legitimate interest in a working app (Art. 6(1)(f)). You have the right to access, correct, export and erase your data and to object to or restrict processing. Trades are already on your device and exportable from the app at any time; for account data, email us.

You may withdraw consent at any time by disabling the relevant feature or contacting us. Microphone access and notifications require your permission. We rely on legitimate interests for security, fraud prevention, operational diagnostics and measuring our own Apple Search Ads campaigns. You may lodge a complaint with your local data protection authority if you believe your data has been mishandled.

9. Your Rights by Jurisdiction

California residents (CCPA/CPRA) may request access to, deletion of, and information about the categories of personal data we hold. We do not sell personal data and do not share it for cross-context behavioural advertising. Residents of other US states and the UK have equivalent rights under their laws. Email us to exercise any of them; we respond within 30 days.

10. Not Financial Advice

Kept is a personal record-keeping tool. It does not execute trades, hold funds, or give investment advice. Every statistic the app shows describes your own logged trades and nothing else.

11. Children's Privacy

Kept is not directed at children under 13 (or the age of digital consent in your country) and we do not knowingly collect their data.

12. Changes to This Policy

We will post any changes here and update the date above. Material changes to what we send to a third party will be presented in the app for your consent before they take effect.

13. Contact Us

Simena Digital LLC
1021 E Lincolnway, Suite 9026
Cheyenne, WY 82001, United States
Email: privacy@kepttrading.app