Security

Last updated: 30 September 2026

KeepSay is built so that what you say, and what your band measures, stays yours. This page says how, in brief; the Privacy Policy says it in full. It also says how to tell us about a security problem.

How KeepSay keeps what you say safe

• Your health readings stay yours. They never leave your phone in a form anyone but you can read, unless you send a page of them yourself, and KeepSay sends them to no server and no AI model. On your phone they are stored encrypted. If you turn on encrypted backup, each day is sealed on your phone first, under a key that only your passphrase or your recovery words unlock.
• Private shelves are encrypted. A recording on a private shelf is encrypted on your phone, its audio included, and in your account's copy, with a key of your account's own. It opens only behind your phone's own unlock, and is never sent for notes unless you choose that recording.
• Encrypted on the way and at rest. Everything sent between the app and our services is encrypted in transit, and the copy of your library in your account is encrypted at rest.
• Your audio is not kept, unless you back it up. Audio you send for notes is deleted as soon as your notes are written, and within 24 hours at the latest. Unless you turn on audio backup, a recording's audio is never kept in your account; if you do, each recording's audio is encrypted on your phone with your encrypted backup's key before it is uploaded, so we store it but cannot open it.
• Your questions are not kept. A question to your recordings, and the lines sent with it, are deleted once it is answered, and the answer within ten minutes.
• No password of ours to steal. You sign in with Google, or on iPhone with Apple, which use the OAuth 2.0 and OpenID Connect standards, so KeepSay never sees or keeps a password. You can add two-step sign-in with an authenticator app, and KeepSay on the web asks for it before it opens anything.
• Nothing sold, no adverts, no training. We do not sell your data, show you advertising, or use your recordings to train AI models. Our website sets no cookies and uses no analytics or advertising trackers.
• Your rights, wherever you live. From the app you can export your data, delete your encrypted backup, withdraw your consent to health readings, and delete your account and everything in it. These are the rights the GDPR gives, and we give them to everyone who uses KeepSay.
• Honest about the band. The band has no Bluetooth security of its own, so KeepSay removes each recording from the band once a verified copy is on your phone.

Reporting a security problem

If you think you have found a security problem in KeepSay — the app, our website, our notes service or the KeepSay band — please tell us, and we will work with you to fix it.

How to report

Email m.tufailkhan007@gmail.com with "Security" in the subject. Tell us what you found, how to reproduce it, and what it could affect. Please include no one's personal data beyond what is needed to show the problem.

What we do

• We reply within 7 days to say we have received your report.
• We tell you how the fix is going at least every 30 days until it is resolved.
• We tell you when it is fixed, and we thank you by name if you would like us to.

What we ask

• Test only with your own account and your own band.
• Do not access, change or delete other people's data, and do not disrupt the service for anyone.
• Give us reasonable time to fix a problem before you tell anyone else about it.

If you follow these rules and act in good faith, we treat your research as authorised and will not take legal action against you for it.

The KeepSay band

The band's firmware is made by its manufacturer. We pass reports about the band to them and tell you what they say. How long the band will receive security updates will be published on this page before the band goes on sale.