Privacy Policy

Last updated: May 15, 2026

This Privacy Notice for Thad Hull, doing business as Kept — Curated Collections ("Kept," "we," "us," or "our"), describes how we collect, use, store, and share information when you use the Kept iOS app, our website at https://kept-collections.com, or any related services (collectively, the "Services").

If you have questions, contact us at tj@kept-collections.com.

Summary of key points

This summary highlights what most users want to know. Full details follow below.

We collect very little. If you use Kept without signing in, all your scans and data stay on your device — we don't receive anything except the photos you submit for AI analysis (and those are not retained after processing).
If you sign in, we store your email, your scans, and your photos in our cloud database (Supabase) so you can access them across devices. Cloud sync is included free with any account — no subscription required.
Your photos are sent to OpenAI to identify and value your items. OpenAI does not retain these photos and does not use them to train AI models.
We do not sell your personal information, ever, and we do not show advertising in Kept.
You can delete your account at any time from within the app (Settings → Delete Account). This permanently removes your data from our systems.
You can contact us at tj@kept-collections.com about anything in this policy.

1. Who we are

Kept — Curated Collections is an iOS app that helps you scan, identify, and value collectibles using artificial intelligence. The app is operated as a sole proprietorship by Thad Hull, based in Columbus, Georgia, United States.

2. Information we collect

The data we collect depends on whether you use Kept signed in or signed out.

If you use Kept without signing in (anonymous mode)

Photos you submit for AI analysis. When you scan an item, we send the photo to our AI provider for identification and valuation. We do not store these photos on our servers.
Local app data on your device. Your scans, collections, item details, and photos are stored in your device's local database (SQLite). This data never leaves your device unless you sign in.
Anonymous usage counters. We track how many scans you've used in the current month locally on your device, to enforce the free-tier scan limit. This data is not sent to our servers.

If you sign in (with email or Apple Sign-In)

In addition to the above, we collect:

Account information: Your email address, and (if you use Apple Sign-In) optionally your name. Apple Sign-In may also provide a private relay email address that forwards to your real email.
Authentication tokens: We store secure session tokens issued by our authentication provider so you stay signed in across app launches.
Your scans, collections, and photos. When you sign in, your data syncs to our cloud database (Supabase). This includes item identifications, AI-generated valuations, condition assessments, notes, locations you assign, photos, and timestamps. Cloud sync is included free with any account.
Subscription status. If you subscribe to Kept Pro or Pro Max, we receive your subscription state (active / inactive / which tier) from RevenueCat, which manages our subscription metadata. Actual payment information (credit card, Apple ID) is handled entirely by Apple and never reaches us.

Information collected automatically from all users

Crash and error reports. We use Sentry to collect anonymous crash reports and error events that help us fix bugs. These reports include your app version, iOS version, device model, the screen you were on, and a stack trace of the error. They do not include personal identifying information like your email or contact list.
Session metadata. Our backend services (Cloudflare Workers) log basic request metadata (timestamp, request type, anonymized IP) to enforce rate limits and prevent abuse.

Information from the Kept website

If you sign up for early-access emails on https://kept-collections.com, we collect your email address and store it in our database. We use this only to notify you about Kept's launch and product updates. You can request removal at any time by emailing tj@kept-collections.com.

Sensitive information

We do not knowingly collect sensitive personal information (such as health data, financial account numbers beyond what Apple handles for purchases, race, ethnicity, biometric data, or precise geolocation).

3. How we use your information

We use your information only to:

Provide the Services — identify and value items you scan, store your collections, and sync data across your devices.
Run our business — process subscriptions, send transactional emails (account confirmation, scan-limit warnings, subscription receipts), and maintain accounts.
Improve the app — fix bugs surfaced through crash reports, monitor service reliability, and refine the AI valuation pipeline.
Communicate with you — respond when you contact us, send important account or service announcements.

We do not use your information for advertising, profiling, or any commercial purpose beyond operating Kept.

4. Who processes your information

To operate Kept, we share certain information with the following third-party service providers ("processors"). Each processor handles only the data necessary for its function:

Processor	What they receive	Purpose	Their privacy policy
OpenAI	Photos you submit for analysis; text prompts describing the item	AI-powered identification and valuation. OpenAI does not retain submitted content after processing and does not use it for model training under our API terms.	https://openai.com/policies/privacy-policy
Supabase	Account email, scans, photos, collections (signed-in users only)	Authentication, database storage, photo storage	https://supabase.com/privacy
Apple	Apple ID identifier (Apple Sign-In), purchase events	Sign-In with Apple authentication; in-app purchases. Apple does not share your Apple ID directly with us; we receive a unique developer-scoped identifier.	https://www.apple.com/legal/privacy/
RevenueCat	Subscription state, anonymous purchase events	Manage subscription entitlements across iOS and web	https://www.revenuecat.com/privacy
Loops	Email address, basic engagement events	Send transactional emails (welcome, scan-limit notifications, account events)	https://loops.so/legal/privacy-policy
Cloudflare	Anonymized request metadata, IP address	Proxy AI requests, host our website, edge security, rate limiting	https://www.cloudflare.com/privacypolicy/
Sentry	Crash reports, error events, app + device version	Bug fixing and reliability monitoring. We do not include personal identifiers in error events.	https://sentry.io/privacy/

We do not sell or rent your personal information to any third party. We do not share it for marketing purposes. We may disclose information if required by law (e.g., subpoena, court order) or to protect our legal rights or the safety of users.

5. Where your information is stored

Data we store in the cloud (for signed-in users and website email signups) is hosted in the United States via Supabase. Our backend services run on Cloudflare's global edge network. If you access Kept from outside the United States, your information will be transferred to and processed in the U.S.

Local data on your device is stored on your device only and is subject to your device's security controls (passcode, Face ID, encrypted backups via iCloud if you enable them).

6. How long we keep your information

Anonymous local data: Retained on your device until you delete the app or clear data via Settings → Clear All Data.
Account data (signed in): Retained as long as your account is active. When you delete your account, all associated data — email, scans, collections, photos — is permanently removed from our systems within 30 days.
Crash reports (Sentry): Retained for 90 days, then automatically purged.
Email signup list (kept-collections.com): Retained until you request removal or we conclude pre-launch communications.
Apple and RevenueCat records: May retain payment and subscription history for the period required by their own policies and applicable tax/financial regulations.

7. Your privacy rights

Everyone (regardless of location)

You may:

Access the information we hold about you by contacting us.
Correct inaccurate information by editing it directly in the app, or by contacting us.
Delete your data at any time:
- Anonymous mode: Settings → Clear All Data.
- Signed-in users: Settings → Delete Account (permanently removes account and all associated data).
Withdraw consent for AI processing simply by not using the scan feature. Data you've already saved remains under your control.
Export your data as a CSV file (Settings → Export Collection) at any time.

California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

Right to know what personal information we collect, use, and share. The categories we collect are: identifiers (email, account ID), commercial information (subscription status), internet activity information (app usage), and visual information (photos you submit).
Right to delete your personal information (use Settings → Delete Account, or contact us).
Right to correct inaccurate information.
Right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information, so there is nothing to opt out of.
Right to limit use of sensitive personal information. We do not knowingly process sensitive personal information.
Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, email tj@kept-collections.com.

Residents of Virginia, Colorado, Connecticut, Utah, and other U.S. states with privacy laws

You have similar rights to access, correct, delete, and opt out of certain processing. We do not sell personal information, conduct targeted advertising, or perform profiling that produces legal effects. To exercise your rights, contact tj@kept-collections.com.

EU, UK, and Canadian residents

If you are in the European Economic Area, United Kingdom, or Canada, you have rights under the GDPR, UK GDPR, and PIPEDA respectively, including the rights to access, rectify, erase, restrict processing, data portability, and object to processing. Our legal basis for processing your information is (a) the contract to provide you the Services, (b) your consent (e.g., for email signups), and (c) our legitimate interest in operating and improving Kept. Contact tj@kept-collections.com to exercise these rights. You also have the right to lodge a complaint with your local data protection authority.

8. How to delete your account

Per Apple's App Store Guidelines (5.1.1(v)) and applicable privacy laws, you can delete your Kept account directly within the app:

Open Kept and go to Settings.
Scroll to Account → Delete Account.
Confirm the deletion.

Once confirmed, your account and all associated data — including your email, scans, collections, photos, and notes — will be permanently removed from our systems within 30 days. Note that Apple may retain a record of past subscription transactions for its own legal and financial compliance, and we may retain anonymized aggregate data that cannot identify you.

If you encounter any issue deleting your account in-app, contact tj@kept-collections.com and we will process your deletion manually.

9. Children's privacy

Kept is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you are under 18, you may use Kept only with the involvement of a parent or legal guardian. Per Apple's age-rating system, Kept is rated 4+ for content suitability, but our Terms of Service require users to be at least 18 years old (or the age of majority in your jurisdiction) to enter into a binding agreement with us.

If you become aware that a child under 13 has provided us with information, please contact us at tj@kept-collections.com so we can delete it.

10. Security

We take reasonable steps to protect your information:

All API requests use encrypted HTTPS (TLS).
Authentication tokens are issued and validated using industry-standard JWT / asymmetric keys.
Our backend services authenticate users before granting access to their data (Row Level Security on Supabase).
AI service credentials are stored server-side only (Cloudflare Worker secrets) and are never bundled into the iOS app.
Photo uploads are stored in a private Supabase Storage bucket accessible only by the owning user.

That said, no system is perfectly secure. If you believe your account has been compromised, contact us immediately at tj@kept-collections.com.

11. Cookies and tracking technologies

The Kept iOS app does not use cookies. Our website (kept-collections.com) may use minimal session cookies for authentication. We do not use third-party advertising trackers, analytics that profile individuals, or cross-site tracking.

12. Changes to this policy

We may update this Privacy Notice from time to time. The updated "Last updated" date at the top of this notice indicates when it was most recently revised. For material changes, we will notify users via email (if you have an account) or a notice within the app prior to the change taking effect.

13. Contact us

If you have questions, requests, or concerns about this Privacy Notice or our handling of your personal information, contact:

Thad Hull
Kept — Curated Collections
tj@kept-collections.com
https://kept-collections.com