Keeper

Privacy policy

Last updated: 31 October 2026

This policy covers the Keeper desktop app, the Keeper Cloud service and this website. It says which personal data we process, why, with whom, and for how long.

Who is responsible

The controller is Philipp Hochmann, Benjowskigasse 44, 1220 Wien, Austria, philipp.highman@gmail.com (see the legal notice). Write to this address for anything about your data.

The desktop app without an account

You can use Keeper without an account. Then we receive nothing from you.

• Your vaults are folders of Markdown files on your computer. Keeper keeps its search index, trash, side chats and comments inside the vault folder. None of this is sent to us.
• Your own AI keys are stored in your system’s keychain, or, where there is none, in a file in Keeper’s settings folder that only your user account can read. When you use AI with such a key, Keeper sends the request straight from your computer to the provider you chose (for example OpenAI, Anthropic, OpenRouter, Google, Mistral or a model running on your computer). The request contains your prompt and the parts of your notes the AI needs, such as the open page, the selected text and pages it searches or reads. We don’t see your keys or these requests; the provider’s own privacy policy applies.
• Update checks: builds of Keeper that update themselves fetch a small file listing the newest version from a public Cloudflare R2 storage bucket, 10 seconds after start and then every 4 hours, and download a new version from there when there is one. The request contains no information about you or your notes, but Cloudflare sees your IP address, as with any web request.
• Web content in pages: when you add a bookmark or clip a web page, Keeper fetches that page. Bookmark cards, images from the web and HTML blocks in your pages load their content from the sites they come from. Those sites see your IP address.
• MCP server and agent integrations: keeper mcp lets AI agents on your computer, such as Claude Code or Codex, read and edit your vault. It runs locally and sends nothing to us. What an agent reads goes to that agent’s AI provider, under its terms.
• Keeper has no analytics, telemetry or crash reporting. While you are signed out of Keeper Cloud, the app doesn’t contact our server.

Keeper Cloud

Your account

Sign-in is provided by Clerk (Clerk, Inc., USA; privacy policy). You can sign up with an email address and password or with GitHub or Apple; signing in by email sends you a code. Clerk stores your email address, your name and profile picture if you give them or your GitHub or Apple account provides them, your password in hashed form, and which sign-in methods you use. To protect accounts, Clerk also processes your IP address, browser details and sign-in events, and sets cookies needed for sign-in on our sign-in pages.

Our own database keeps a copy of your email address, name and profile picture link, your workspaces and plan, and your project memberships and roles.

When you sign in from the app, it gets a device token for that computer. The token is stored in your system’s keychain; we only keep a hash of it, with a device name like “Keeper on my-laptop (macOS)” built from your computer’s name, and when it was created and last used. You can sign a device out in the app.

Cloud project content

A cloud project’s pages, their properties, the page tree, attachments and comments, including answers from Keeper AI in comment threads, are stored on our server. Pages are stored as Yjs documents, a format that also holds earlier states of the text. Your computer keeps a copy so you can work offline.

Everyone who is a member of a project sees its content and, while you are in it, your name, picture, cursor and which page you have open. When you invite someone, we store their email address and who invited them; the invite link is valid for 30 days. Side chats with AI are not synced; they stay on your computer.

We don’t look into project content. The admin panel we use to run Keeper Cloud shows accounts, workspaces, plans, project names, members, and the number and size of documents and files, but not what’s in them. We would only access content if you ask us to, for example for support, or if the law requires it.

Keeper AI

When you use Keeper AI, the app sends your request and the context it needs (the open page, selected text, pages the AI reads or searches) to our server, which forwards it to OpenRouter (OpenRouter, Inc., USA), which passes it to the provider of the model. The default model is from OpenAI (USA). We don’t store the text of prompts or answers. We store usage: the model, the number of tokens, the cost and the time, to count your monthly allowance.

OpenRouter and OpenAI process the requests under their own terms: see the OpenRouter privacy policy and OpenAI privacy policy. OpenRouter doesn’t store the text of requests by default and doesn’t use it to train models; it keeps metadata such as token counts. OpenAI doesn’t use data sent through its API to train models unless the customer opts in, which we haven’t; it may keep API requests for up to 30 days to detect abuse.

Operations data

To keep the service working we record request metrics (counts, durations and status codes per type of request), a sample of request traces, and error logs. Traces and error logs are linked to your user id. They contain no IP addresses, prompts, page content or tokens: routes are recorded as patterns, and error messages are cleaned of email addresses and tokens. We also note on which days an account and a project were active.

Our host Railway processes your IP address to deliver each request and keeps its own HTTP logs (IP address, browser, address requested) for a limited time. Railway stores these logs in the USA, also for servers in the EU.

Payments

Paid plans are not on sale yet. When they are, Paddle (Paddle.com Market Ltd, UK) will handle payments as merchant of record. Paddle sells the subscription to you and is responsible for the payment data it collects, under its own privacy policy; we will receive what we need to run your plan, such as your plan, status and country.

This website

This site sets no cookies and uses no analytics or third-party resources. Requests to it are handled by our server on Railway, as described above.

Where your data is stored

Keeper Cloud’s server and database run on Railway (Railway Corporation, USA) in its EU West region in Amsterdam, the Netherlands. Railway’s logs, Clerk, OpenRouter and OpenAI are in the USA.

For transfers to the USA we rely on the EU–US Data Privacy Framework where the provider is certified under it: Railway, Clerk and Cloudflare are. OpenRouter is not; our transfers to it, and its transfers to the model provider, rely on the European Commission’s standard contractual clauses. The UK has an adequacy decision of the European Commission.

Legal bases

• To provide Keeper Cloud to you: your account, devices, projects, invites, Keeper AI and your plan (GDPR Art. 6(1)(b), contract).
• To keep the service secure and working: operations data, sign-in protection, records of admin actions (Art. 6(1)(f), legitimate interests). You can object to this processing.
• Where we ask for your consent, on that consent (Art. 6(1)(a)); you can withdraw it at any time. We don’t currently ask for any.
• Where the law requires us to keep data, for example invoices, on that obligation (Art. 6(1)(c)).

How long we keep data

• Account data, devices and memberships: until your account is deleted. Signing a device out revokes its token at once.
• Project content: until the project is deleted. Deleting a project removes its pages, comments and files from our database at once. We haven’t set up scheduled backups at Railway; Railway may take a short-lived snapshot before its own maintenance of the database. Before larger maintenance we may take a one-off copy of the database ourselves, which we keep access-protected and delete within 30 days.
• Request metrics, traces and error occurrences: 14 days. Hourly summaries, error summaries and activity days: 13 months.
• Keeper AI usage: kept for our accounts; when your account is deleted, it is no longer linked to you.
• Records of admin actions, such as a plan change or a suspension, are kept so we can account for them.
• Data Clerk, OpenRouter, OpenAI and Railway keep on their side follows their own retention rules.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on legitimate interests. To use them, write to us. You can export any cloud project from the app at any time as a folder of Markdown files with its attachments. On request we also send you the data we hold about your account. To delete your account, write to us from its email address; we then delete your account at Clerk and your data with us.

You can complain to a data protection authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at, dsb.gv.at.

Minimum age

Keeper Cloud is for people aged 16 and over.

Changes to this policy

When we change this policy, we update the date at the top. We tell Keeper Cloud users about important changes by email or in the app before they take effect.