Kepo

Privacy Policy

Last updated: 30 October 2026

Kepo saves places you see in social posts and later asks whether you went. It now has accounts, so a part of what you do in Kepo is held on a Kepo server. This page explains your record, public contributions, private conversations and event information.

Friends you choose can see your @handle and your Kepo; your shareable logged places and verdicts; the days you publish; and your reactions and comments. What your friends can read lists exactly what, and what never reaches them.

Your account

You make a Kepo account with Sign in with Apple. Kepo asks Apple for your name and nothing else. It does not ask for your email address and does not have it.

Apple gives Kepo an identifier for you that means nothing outside Kepo, and a token. Kepo keeps the token encrypted and uses it for one thing: to cut the link with Apple when you delete your account.

Your account can keep a name, an @handle and your Kepo, the little character that stands for you. Kepo identifies you to other people by your @handle and Kepo, not your personal name. Your stored account name stays private.

Friends

Friendship is mutual. Someone becomes your friend only when you both agree: one of you asks, and the other says yes.

Your invite link. Each account has one link, and it stays the same. It carries a scrambled code, not your name. Anyone who opens it sees your @handle and your Kepo, and can ask to be your friend. Nothing happens unless you say yes. Someone you have unfriended can still open the page, but can't use it to ask to be your friend.

Sharing a place. From a place you went to, SHARE THIS PLACE makes a picture: the place's name as your record shows it, EAT, DRINK or DO, your verdict, the stamp and its month if your phone noticed the visit, and your @handle and Kepo. Never a note, a map, a photo, the day or time you went, or anyone else. The picture is made on your phone and Kepo keeps no copy; you see it before it goes, and iOS's share sheet sends it wherever you choose. With it goes your invite link, the same permanent link as above, so a card you post publicly puts that link in public for good. For a place Apple Maps can identify, the link also carries Apple's identifier for that one place and nothing else about it. Kepo's server stores neither the place in a link nor who opened it. Only a place you said was WORTH IT or MEH offers SHARE. If you choose Save Image in the share sheet, iOS asks once whether Kepo may add pictures to your Photos; Kepo can add the card there and cannot see anything in your library.

Finding you. Anyone with a Kepo account who types your exact @handle can find your @handle and Kepo, unless you have unfriended them. Kepo does not search part of a handle and does not suggest people to you.

Unfriending is also a block. The other person is not told, though you will no longer be on their friends list. After it they cannot find you, send you a request, or see anything of yours. You can undo it by sending them a request, which they have to accept. Unfriending also deletes the reactions, comments and sends between the two of you, both ways, and every time either of you said you were somewhere with the other.

Reports. You can report someone. A report records who reported whom, one of four fixed reasons (spam, abuse, impersonation or other) and when. Nothing you type goes into it. The person you report is not told. Kepo's owner reads reports and can remove someone's name and @handle, and they then have to choose new ones. You can also report a comment: the report names which comment, never copies its words, and Kepo's owner reads a comment only when it has been reported, and can delete it. For a report about a comment or a post, the server also keeps which comment or post you reported. The report stores its identifier, not a copy of its words.

What Kepo's server holds

For each person, the server holds:

Who you are to Apple: the identifier and the encrypted token above.
Your profile: the name, the @handle and the Kepo you chose.
When your account was made, and a one-time signal from Apple that the account is likely a real person.
Your verdicts. For each place you gave a verdict on: which place, the verdict, whether your phone noticed the visit or you told it yourself, the week, and the order you gave your answers in.
A scrambled record of each sign-in, so your phone stays signed in. The server cannot turn it back into the key your phone holds.
Your notification tokens: for each phone signed in to your account, the address Apple gives that phone for notifications, which kind of build it is, and when it last told Kepo. A phone's token goes when it logs out while online, when Apple says the address no longer works, when you stop using your Apple Account with Kepo, and when you delete your account.
Your friends: who they are, with no date, and, for a friendship made by accepting a request, which of you asked.
Whether your friends list is private, a yes or no.
Friend requests you have sent or received and not yet answered, with identifiers, private notification-read markers and notification-clear state. Kepo keeps recent request timing to enforce a 24-hour interval between new requests to the same person, including after a cancellation or decline. Resolved request timing is removed during cleanup after that interval; pending request metadata remains until the request is resolved. Clearing a notification hides it without accepting or declining the request.
Who you have unfriended, with no date.
Your invite link's code, so any phone you sign in on can share it. It goes when you delete your account.
Reports you made, and reports about you: who reported whom, the reason and when. For a report about a comment or a post, the server also keeps which comment or post you reported. The report stores its identifier, not a copy of its words.
Whether you have ever had a friend, a yes or no.
How many of your saves Apple Maps could not identify, as a bare number, so a new phone can tell you how many it could not bring back.
A count of your recent requests: for each kind of request, how many your account has made in the current window, which is a minute for most and a day for a few, and when that window began. It is there so that no one account can flood the server, and each new window overwrites the last.

The server also adds verdicts up into a count for each place. A count carries no names. A place's count is shown only once at least eight people have given it a verdict; below that, the server answers as if nobody had.

The crowd count only counts verdicts on places Apple Maps can identify. For those, the server stores Apple's identifier. Saved records and published places can also keep the place's city, as described below.

Finding a Maps match for a saved place. When you open Kepo, it may check a limited number of unmatched saves once that day using their saved names, cities and supplied addresses. These searches use Apple Maps. Kepo keeps a possible match's place identifier, your original supplied place details, your notification and decision, and the information needed to complete or recover a merge. A possible match does not prove a visit or redeem a ticket. You decide whether to merge; if both saves have different reviews or ratings, you choose which to keep. The merge keeps one active rating for you at that place. Recovery records can retain the earlier versions privately and are removed with your account. A match notification appears inside Kepo; these checks do not run periodically while the app remains closed.

Kepo's list of places. The first time anyone saves a place Apple Maps can identify, Kepo gives that place an identifier of its own and keeps Apple's identifier beside it, so that the same place is one place for everyone. Apple sometimes lists one place twice. When two different accounts have each said that two of Apple's identifiers are the same place, Kepo joins them, so one place keeps both identifiers and its count is added up as one. That list belongs to Kepo, not to any person. It holds identifiers and nothing else: no name, no address, no location, no date or time, and nothing about who saved the place or who said two were the same.

Cities for published places. When a published place needs a city, Kepo's server can look it up on Apple Maps using that place's exact Apple identifier. The lookup sends no account details, visit or ticket information, or device location. Kepo keeps the public place identifier, city when found, lookup status and check times separately from account records so published places can show their city and appear in the right city filter. A found city can be checked again after 24 hours; a confirmed missing place or city can be retried after five minutes. These are freshness and retry intervals, not deletion periods. This public place information can remain after an account is deleted; it contains no account, visit, ticket or device-location data.

Places you said are the same. When your phone finds that a place you saved is listed twice on Apple Maps, it tells the server the two identifiers. The server keeps that with your account: the two identifiers and how your phone found them, and nothing else, with no time. Nobody can read it; it only counts toward joining the two.

Reactions and likes. Kepo keeps who reacted, which place, day or post it belongs to, and the reaction chosen. Older reaction controls have six choices; newer Feed controls keep a like. Taking a reaction or like back removes it. Readers who are allowed to see the content can see its reactions, subject to the privacy rules below. New likes can also create an in-app notification, including an activity time, as described under Notifications.

Comments. Kepo keeps the author, words, parent content and order of each comment. A comment may also include a place you explicitly select from your Log, with or without text. That attachment shares a minimal place identity, category and any eligible typed name, city or personal pin with readers of the comment; it does not copy your Log note or grant access to your whole Log. Event places cannot be attached this way. If the source becomes unavailable, the attachment becomes unavailable too. New comment notifications keep an activity time. Authors and content owners can remove comments. Comments on a place are removed when its owner drops it; comments on a day or post are removed when that content is withdrawn. Planned-day comments expire with the plan.

Posts and answers. Kepo keeps a post’s author, words, kind, city where supplied, selected place pointer, audience and order. A post can be text, a question or about a place. An explicitly selected ordinary place can expose its minimal public place information to readers of that post without exposing the rest of its owner’s Log. A place post is removed with its comments and reactions when its source leaves the shelf. Answers and recommendations keep the author, question, selected place pointer and any recommendation text. Readers must have access to the question; place access is checked separately. A direct answer can grant the asker access to the eligible answered place. Other readers do not gain unrestricted access to the answerer’s Log. Private event venues remain subject to event access rules. New answer and mention notifications can keep an activity time.

Saved plans. Your saved itineraries are visible to you and your current mutual friends, regardless of your profile audience or earlier day visibility choices. Friends can see the title, travel mode and eligible places in order. Saving a plan does not automatically create a Feed post. A saved plan does not share its exact date or private planning messages.

A plan you attach to a post. You can explicitly attach a saved plan to a Friends post, with optional text. Sharing a plan to Community requires Kepo-verified redeemed tickets at every stop. Kepo keeps a snapshot of its title, travel mode and ordered place identifiers at the time you post. Later changes to your saved plan do not add or change the shared stops. Readers of that post can see the attachment without gaining access to your other plans or Log. Exact dates, personal notes and visit information are not included. Deleting the source plan makes the attachment unavailable; removing a source place or losing access to it removes that stop from a Friends attachment. A Community attachment becomes unavailable if any of its shared stops no longer has the required verified ticket. The post and its conversation remain until removed separately. Blocking and restricted-event protections still apply.

A place or a day you send. The server keeps who sent it, to which friend, which place or day, and its order, never a time. The legacy send record keeps no place name. Private Inbox read markers track which updates you have seen, using identifiers and ordering versions. When you send a place from a row you can see, the server keeps whose row it came from, so the person you sent it to can see it; they see it only if they could see that person's places themselves.

Who you were with. When you say you were somewhere with a friend, the server keeps whose visit it is, which of your places, whom you named, whether they have said yes, and its order, never a time, a location or a word. If they say no, the ask is deleted and nothing about it is kept. It is deleted too when you drop the place or clear your answer, when either of you unfriends the other, and when either of you deletes your account. For each day an ask was pushed between two people, the server keeps that it was, and deletes it once that day is over.

A day you send to friends. When you send a day you're planning, the server keeps its date, which of your saved places are on it, in order, which friends you sent it to, who is in, and which stops each of them joined. If a friend suggests a place, it keeps a pointer to their own save. It keeps that a notification about the day was sent, so the same one is not sent twice. It does not keep live location; explicit plan messages and event details are kept as described below. If a friend says no or leaves, their place on the day is deleted and the no is not kept. A place you drop comes off the day. When it shows that two of you went together, it keeps that as it does when you say so yourself, and notes that it did, so it is not shown twice. That you went together stays; everything else about the day is deleted two weeks after it. What is between you and one friend is deleted sooner if either of you unfriends the other, and all of it if you delete your account. If you unsend a day, the server keeps only a marker that it was unsent, with no places and no people, for two weeks.

Public reviews, Feed and Explore

Written reviews and their history are public to signed-in Kepo users. When you publish one, Kepo keeps your account, the shared Kepo place identifier, your Worth it or Meh verdict, your review text and its revision and order. Other signed-in people can read it with your @handle and Kepo, subject to blocking, even when your activity is set to Friends. This applies to reviews you already published too. Your anonymous Worth it or Meh contribution still counts toward the community metric regardless of this setting. You need a redeemed place ticket before submitting Worth it or Meh or a written place review. Ordinary comments on posts do not require a ticket. Publishing a review makes it available in the place’s Reviews tab to signed-in users, subject to blocking. New written reviews and reviews you edit after this update also appear in a went-to post. Written-review posts are eligible for Explore regardless of your activity privacy setting. This update does not create new automatic Feed posts for untouched older saves or reviews. Personal place notes and saved copies are removed from the server. The updated app removes its stored copies when opened and no longer stores or syncs them. A written review is separate from the anonymous community count described above; the eight-person minimum applies to that count, not to a review you choose to publish.

Joining a friend’s plan. You can say you are interested in a plan attached to a Friends post. Kepo stores your request and notifies its creator, who can approve or deny it. Approval makes you a member of that saved plan and shares a link to its current details in your one-to-one DM. Approved participants can see its current date, if any, ordered places, and the host’s and other approved participants’ Kepos and handles, subject to blocking protections. Later creator changes send updates to the approved participants’ conversations and use the existing plan-change notification delivery when allowed. The Feed post remains a snapshot. Approval does not choose a date automatically or expose the creator’s other plans. You can withdraw a request or leave an approved plan. Deleting the invitation post does not remove an approved membership, but source-plan deletion, blocking or ending the friendship revokes it; refriending does not restore it automatically. Denial does not send the requester a notification. Kepo retains ordering information so old retries cannot restore a withdrawn request or membership.

Your written review uses your rating for the place. Changing the rating on a published review requires your confirmation and an update note. The original review and its rating remain visible with the later rating updates and their notes, in order. Editing the current text does not rewrite those earlier snapshots. Kepo also keeps whether the visit requirement was verified when you published. A confirmed update waiting to be sent is kept on your device with its note.

You can edit or remove your written review. Removing it clears the written review and its rating history, while keeping your earned ticket and separate place rating. An identifier and revision marker remain to prevent an old device from restoring a removed review. Deleting your account removes that marker too.

Automatic save and went-to posts. When you add a shareable place, Kepo creates a save post for you and your mutual friends. Recording Worth it or Meh creates a separate went-to post for the same audience and still contributes to the anonymous community verdict. Adding written review text makes that went-to post public to signed-in users, subject to blocking. The save and went-to posts have separate likes and conversations. Kepo stores their identifiers and source-place links to keep retries and edits from creating duplicate posts. Comments and likes made while a went-to post was friends-only remain restricted to that audience if written text later makes the post public. Restricted event venues retain their existing access protections.

Your post audience follows the Feed tab you post from. A Friends post is limited to mutual friends and stays out of Explore; a Community post is public and eligible for Explore. Organizer events retain their own Everyone or Friends only choice. These audiences are separate from the account setting for your ordinary activity. Public organizer events are distinct from personal plans sent to friends. Explore can be filtered by city. Blocking and current content access are checked when content is read or opened.

Inbox and private planning

Direct messages are between current mutual friends. Kepo stores the sender, recipient, text, any selected content pointer, message identifier and ordering counter. It also keeps a fingerprint used to recognize a retry, and private read markers for people and individual items so your Inbox can show unread messages and updates. These markers contain identifiers and ordering versions, not copies of message text, and are not shared as read receipts. An attachment does not override the original content’s access rules: both people must be allowed to read it, and it becomes unavailable if that access goes away. “Delivered” means the server accepted the message; it does not mean the recipient read it or that Apple delivered a push.

Planning invitations and changes stay with the people they are sent to. Kepo keeps both participants, selected place pointers, optional date, time and message, proposal versions, who suggested or accepted a version, confirmation state, operation receipts and Inbox notices. A friend can suggest changes for confirmation; sending a proposal does not publish it to the Feed. Notification dispatch records prevent duplicate pushes for the same committed update.

Unfriending removes the direct messages, associated read markers and private proposals between the two accounts, including their versions and operation records. Deleting either account removes their conversations and proposals. Content another person has already copied outside Kepo cannot be recalled.

Notifications

Optional place suggestions. This separate notification setting is on by default unless you turn it off. It still requires your location and notification permissions. Kepo uses visits reported by your iPhone to look for nearby places through Apple Maps, sending the visit location to Apple for that lookup. These suggestions can arrive after a visit and may be inaccurate. Suggestions do not save places, redeem tickets or share visits. Your preference and suggested-place details stay in local storage for your account; Kepo does not send them to its server. Suggestion opening expires after seven days; place identifiers suppress repeats for thirty days. Expired records are pruned when this feature next runs. Turning the setting off clears these records and cancels pending and delivered suggestion notifications; signing out or deleting your account clears them too. Raw visit history used for ticket recovery follows the separate retention described below.

Optional Kepo reminders. Reminders are on by default when you have not chosen a preference; your existing choice is retained. You can change this in Account → Notifications, and Apple's notification permission still applies. Kepo uses the dates you last opened the app, saved a place or recorded a visit to suggest saving places and making plans. These dates, your reminder preference and a small reminder schedule are kept in local storage on your device; they are not sent to Kepo’s server for reminders. A reminder may name a place already in your Log and show your existing Kepo image. This feature does not add continuous location tracking. You can turn it off independently of social notifications; turning it off cancels pending Kepo reminders. Deleting your account clears its local reminder state.

The in-app bell shows friend requests and eligible likes, comments, answers, mentions, interest in Friends plans and shared-save suggestions with friends. A new comment on your post, or on a post you previously commented on, can add a notice for you unless you wrote the new comment. Kepo stores pointers to the source content, actor, recipient, activity kind, order and time, plus private read markers and intentional-clear markers. Item-specific read markers keep identifiers and ordering versions so seeing one item need not clear another; they are not shared with other people. Reading or opening a notification does not remove it; it remains until you clear it. A friend-request notification also leaves when the request is accepted, declined or withdrawn. If another notification's source becomes unavailable, a history entry may remain without the inaccessible content. Deleting your account removes your notification history and removes your identity from retained entries belonging to other people. It groups likes on the same content and checks current access again when you open an item. The notification record does not copy the post, comment text or event address. Mentions are matched to the account holding that @handle when the message is published; changing a handle does not redirect an old mention. Removed or inaccessible content is not revealed by its notification.

Private messages, planning invitations and event request or approval updates appear in Inbox conversations. A public-event request can appear with its organizer even if you are not mutual friends; this does not grant permission to send ordinary DMs. A shared-save suggestion lets you choose places and a day, then explicitly send a private planning invitation to that friend. The suggestion itself does not send a push. The bell shows engagement activity in the app. New comments on your posts and posts you previously commented on can also send the Apple push messages described below.

Place tickets and visit recovery

A place ticket is separate from a rating or written review. Updated versions of Kepo require an actual current or retained recent location observation near a saved place before I WENT HERE can make its ticket ready. If several nearby businesses match, you choose which one you visited. Kepo records that choice as your confirmation, not as an automatically identified visit to that exact business. Automatic detection still requires an unambiguous location match, with no minimum stay duration. Some earlier versions accepted manual confirmation without a location check; other earlier versions required a location check or supported stay. You still choose to redeem the ticket; it does not automatically publish a rating or review. Rating and review actions stay locked while redemption is waiting for confirmation.

Kepo keeps the ticket holder, place and original saved-item identifiers, the evidence type and version, observed and qualification times, redemption time, and identifiers that make retries safe. For a visit you confirm yourself, the receipt records when you confirmed it, rather than an independently observed visit time. Ratings and reviews based on that confirmation remain self-reported, even when nearby location evidence supports your choice, and are not counted as GPS-verified contributions. An optional place name and city let your own ticket collection work after you remove the place from your Log. This receipt does not contain the raw coordinates or accuracy readings from your recovery history. Older earned tickets retain their original evidence and dates. New checks do not rewrite earlier receipts. The server checks the account, place and receipt relationship, but phone-reported evidence is not independent proof of physical presence.

Removing a saved place with a redeemed ticket gives you a choice. Keep ticket removes the place from your Log and keeps its ticket, rating and review. Delete both removes the place, ticket and associated rating and review. Re-adding a place whose ticket you kept reconnects that same ticket. You can add or edit a review from a retained ticket without adding the place back to your Log. Existing friends-only ticket and public written-review audiences still apply; keeping a ticket does not broaden access to your Log.

Kepo keeps a limited reward record linked to your account and place so the same place cannot earn tickets again. Deleting a saved place or its ticket keepsake does not reverse earned rewards or unlocked Kepos. Your ticket balance, lifetime redeemed total and unlocked Kepos remain with your account. Deleting your account deletes these rewards records under our account-deletion process.

Public review drafts and pending submissions stay on your device until sent or discarded. A submitted rating and optional review text are saved together. Changing the rating of an existing written review still requires confirmation and a separate update note. Pending actions keep only the information needed to finish or safely retry them for your account.

For this beta transition, earlier place ratings and written reviews, their rating histories and anonymous contributions are cleared. Earned tickets and unrelated saves are preserved. Ordinary comments keep their prior audience and can remain under an unavailable old review; a newly submitted opinion does not replace that old discussion. Updated devices clear obsolete local opinion state, and old submissions cannot restore the cleared reviews.

Events and tickets

An event can include its name, date, time, city, description, ticket link and a selected or directly entered venue. A saved-place venue must belong to the organizer; access to a friend’s Log does not authorize publishing their saved venue. Private-event address restrictions still apply. These details are stored to show the event and restore it. When you select an event venue from Apple Maps, the event can store its selected name, city and coordinates as well as its place identifier; a venue without an Apple place identifier can also be stored for the event. This event-specific venue record follows the address-access choice below. You choose Approval required or Open invite. With approval required, someone who is not already invited requests access before the organizer approves them to see the venue. With open invite, people allowed to view the event can see its venue and join. Approval or interest alone is not attendance and does not issue an attendee ticket; joining does. A personal event’s Feed share is restricted to mutual friends. A separately created organizer event can be posted to everyone or friends only.

The event-only venue projection, including Open invite access, does not grant general access to the organizer’s Log. People explicitly invited to a personal planned day can read its eligible shared stops under the existing planned-day rules; personal Log notes are not included. Kepo retains which saved places have been used for private events so ordinary shelf, profile or published-day sharing cannot bypass event access checks. The organizer can change or withdraw an event, and current access is checked again when it is read.

A Kepo event ticket is a keepsake, not a third-party admission credential. Creating and saving an event creates the organizer’s ticket; an attendee gets their own after joining. Kepo stores the ticket holder, event kind, organizer and event identifiers, name, day and issue time, and any personal verdict. If the phone detects an eligible visit on the event day and you give a verdict, it also stores the phone-reported visit time, time-zone offset and redemption time. This is not independent proof of attendance. A manually given verdict keeps the ticket whole.

Tickets and pending operations are cached for the signed-in account on the phone. New or retried operations recheck current event access. If venue access is withdrawn, a historical ticket may remain as a keepsake without the venue. Deleting the ticket holder’s account removes their tickets; deleting the organizer’s account also removes tickets linked to that organizer.

Your record, and what brings it back on a new phone

So that everything is still there when you get a new phone, Kepo's server also keeps your own record. Only you can read it. It holds, for each place you saved:

The place, as an Apple Maps identifier and its city when available, or, for a place you typed, the name and city in your words, with its category. The city helps organize and filter your saved places.
Your personal categories: the Eat, Drink or Do choices you apply to a saved place. They sync with your own record and are not shared with friends, public posts or plans.
Where it came from: the post's link, its creator's name, and what kind of share it was; or the friend you saved it from, with their @handle and Kepo. If that friend deletes their account, their @handle and Kepo come off your save.
When you saved it, when your phone noticed you there, and when you answered, to the second, with the deck's own dates.
Your verdict, including DROP, whether your phone noticed the visit, and your stamp's identifier.
The day and order you planned a place for.
Your days, published or not: the title, any personal message you added when sharing, the date, the places in order, whether you published it, and when you made it; and, for a day you saved from someone else, whether it came from a friend or Community, the friend's identity where applicable, and whether you edited your copy.
Your planning choices: saved itinerary order and travel mode, legacy outing-length values, plus manual visit information where you provide it. Your device also keeps which itinerary suggestions you added or dismissed and when another suggestion may appear, so the same outing is not repeatedly offered.
The order you changed things in, as a counter, never a time.

An ordinary saved place Apple Maps found but could not identify stays on your phone and does not come back on a new phone. An explicitly saved event venue is different: its selected name, city and coordinates can be stored as described above. Kepo tells you how many of those it could not bring back.

When you sign in on a new phone, Kepo brings this record back. The full backup is readable only by you. The limited saved-plan information described above is shown separately to your friends or in a post you explicitly share. No record of who read your backup is kept.

Who sees your activity. Your saved itineraries, older published days and their permitted reactions and comments are friends-only. Your ordinary logged places and visits are also friends-only regardless of your profile setting; authored written reviews are public under the rules above. From the build that brought the feed, every account is set to everyone; you can change it to friends in ACCOUNT at any time, and nothing is deleted either way. The Friends feed shows friends’ activity; Explore shows eligible public posts, automatic review posts and organizer events. Individual post and organizer-event audiences, and written reviews follow the rules above. Your friends list, who you were with, where a place came from by a friend, private planning details and what you send are never shown to anyone the lines below do not name. Someone you block never sees you, nor you them.

The same Log rules apply to every account. Shareable places and visits in your Log are visible only to you and your mutual friends, even when your profile is set to Everyone. Explicitly shared content follows its own access rules described above. The per-place Hidden and comments-off settings have been retired, including earlier choices. Previously hidden places that need information from your phone are shared when the updated app opens and syncs. This does not recreate comments or other interactions that were already deleted. Blocking, deleted places, ordinary places without a shareable identifier and restricted event venues keep their existing protections.

What your friends can read

The places you saved and the places you have been, with your verdict and the month, never the day. Personal place notes and kept copies are no longer stored or shared.
Where a place came from. For a place you saved from a TikTok or Instagram post, its address without the tracking your share link carried, and its creator's name. For a place you saved from a friend, that friend's @handle, seen only by friends of you both, and only while neither of you keeps your friends list private.
A new verdict or published day reaches your friends as soon as you give it; the month is kept, never the day or the time, and a pin you place yourself travels the next day. Reactions, comments and sends arrive at once.
Your saved itineraries, with their title, travel mode and eligible places in order, including plans with one place. Friends do not see the exact date through the saved-plan list. Older explicitly published day activity can include its month and personal message; it remains friends-only and requires at least two eligible places.
Your reactions. Anyone who can see the place, day or post sees your reaction and your name. If either of you has made your friends list private, only the two of you see it on a page kept to friends.
Who you were with. If you say you were somewhere with a friend, only that friend is asked; once they say yes, friends of you both can see the two of you went, each with your own verdict, unless either of you keeps your friends list private. If they say no, you get no message and nothing is kept; the ask just goes.
Your comments. Anyone who can see what they are on sees them, and your name. If either of you has made your friends list private, only the two of you see them on a page kept to friends.
A place or a day you send. When you send a place or a day privately to a friend, only that friend sees that you sent it. They can read it only if they could already read the source. A place or a day shows only how many times it has been sent, never by whom. Answers to asks work differently, as described above.
If you send a day you're planning, the friends you send it to see its date, places and any personal message you added. That message is shared with the people invited to that day; sending it does not also publish it to the Feed. Once you join a friend's day, everyone they sent it to sees that you're coming and to which stops, even people you're not friends with; someone you've blocked never sees you, nor you them. The friend who planned it is told when you join. If Kepo noticed you and a friend at a stop you both joined, it shows you went together. Kepo deletes a sent day two weeks after it.
Events. Friends see the event information you explicitly share with them. Venue visibility follows Approval required or Open invite as described above. Interest requests are shown to the organizer; actual invitations, approvals and joining are kept separately. Personal-event plans and participation expire under the planned-day retention rules, while event provenance and eligible historical tickets can remain. Reminders stay on your phone.
Where you are right now and the day or time of an ordinary place visit never go to a friend. Event dates are intentionally shared with authorized event readers.
A pin you place yourself can travel with a place you explicitly share. An ordinary identified Apple Maps place is represented by its identifier and its city when available; recipients look up its other map information themselves. An explicitly selected event venue can include the selected map name, city and coordinates, as described above.
The anonymous verdict count carries no names.
Your friendships with their other friends. If a friend of yours is also friends with someone you are friends with, that friend can see that the two of you are friends, with your names, @handles and Kepos. Nobody else can. If you or the other person has made your friends list private, only the two of you see it.

What the server does not hold

Your email address, unless you left it on getkepo.com to hear when Kepo is out (below).
The captions of posts you saved from, except the temporary AI-sharing processing described below.
Apple Maps search results are not stored as a general map database. Kepo does store eligible place pointers and cities, the public city lookups described above, explicitly entered names and cities, personal pins, and event details or selected venue names, cities and coordinates you save or publish.
An ordinary saved Apple Maps result without a place identifier. Explicit event venues are the exception described above.
The pictures of the screenshots you saved from.
Your location at any time other than a visit your phone noticed to a place you had saved, or a place you pinned where you stood.
Who looked at whose profile or record, or when.
Who you sent an invite link to. (Sending a place or a day to a friend is different: it names that friend, because the server has to deliver it.)
A continuous history of your movements. Activity notification times and event-ticket visit times are stored as described above.
A general history of every content page you open. Inbox and notification read counters are stored for unread state; they are not a history of profile browsing.
Which places anyone looked up to see how people rated them.

Everything Kepo holds is on your iPhone, in a database shared only between the Kepo app and its share extension, and, for your own restore, for what your friends can read and for Kepo's list of places, on Kepo's server.

When you share a supported public post, the share sheet uses your sign-in to submit a background save request to your account. Other saves and explicit sends from the share sheet also use your sign-in. The confirmation page can also request the place’s community verdict count.

An event you make in the share sheet is kept on your phone and queued for the app to publish when you next open it.

Where the server is

Kepo's server is api.getkepo.com, and it runs on Cloudflare. Like any host, Cloudflare sees your phone's internet address while a request is passing through. Kepo does not keep access logs containing request URLs or internet addresses, and Kepo stores no internet address anywhere.

Invite links (getkepo.com/i/…) and the sign-up form on getkepo.com are answered by the same server, with the same access logging turned off.

Limited server diagnostics. To find failures and unusually slow work, Kepo keeps the time, coarse operation name, HTTP status or a fixed error category, elapsed time and server version for up to seven days, with expired records removed by the next hourly cleanup. These records do not contain account or job identifiers, shared links, request headers or bodies, private text, coordinates, internet addresses, or AI prompts and responses. Repeated events are combined or skipped and collection is capped, so this is not a complete request history. Authorized maintenance tools, including automated agent reviews, can read these limited summaries and existing private share-processing status. A review can use a limited case reference to investigate a failed share through its existing private job; that reference is linkable, not anonymous. Routine reviews do not copy the submitted link, caption or transcript into diagnostic logs, and do not replay paid AI requests. Submitted links and private processing content follow the retention and removal rules in AI sharing.

What else leaves your phone, and when

Apart from your account, Kepo makes network requests only to these places, and only for these reasons:

When you share a post into Kepo, it fetches that post's public page to read its caption and, for TikTok, the venue the poster tagged. For TikTok and Instagram this uses those services' own public preview endpoints (www.tiktok.com and graph.facebook.com). For any other link you share, Kepo requests the page you shared. It sends no account information and uses no login; it sees only what a logged-out browser would see. Public Instagram and TikTok posts can use the AI-sharing process described below after you allow it. Other supported on-device reading uses Apple's model on an iPhone with Apple Intelligence turned on. That on-device reading does not send its text to Apple or an AI service.
When a shared post's place is still unclear, Kepo may fetch one public preview image from the image host named by that page and read its text on your phone. The image host or its content-delivery network receives your internet address as part of that request. The image is temporary reading input, not a saved thumbnail. The image is not uploaded to an AI service or Kepo's server. This on-device reading does not upload the caption. Place names and addresses found in the text may be sent to Apple Maps to find the place, as described below.
When you pick a place to save, or open one you saved, Kepo asks its own server how many people said that place was worth it. It sends Apple's identifier for the place and nothing else: no account, no sign-in, no name and no location, so the question cannot be tied to you. It goes through Cloudflare, which sees your phone's internet address as it passes, like every request to Kepo's server. The server keeps no record of what was asked. A place you typed yourself is never asked about. The answers are kept on the phone, in a file that lists each place it looked up and when, so the same place is not asked about again for six hours. LOG OUT deletes that file. From Kepo 0.3 (19), deleting your account deletes it too. Older versions offered a choice to retain local saves and this cache.
When a friend request comes in or is accepted, when a friend has been to a place you saved, when a friend sends you a place or a day, when a friend sends you a day they're planning, joins a day you sent, changes a day you're on, suggests a stop for it, or says they're interested in your event; when someone answers your ask with a place; or when a friend says you were somewhere together, so you can say yes or no, Kepo's server sends your phone a notification through Apple's push service, if you allowed notifications. It carries the other person's @handle and Kepo, and your account's identifier so that your phone can tell which account it is for, and routing identifiers needed to open the relevant invitation or update; one about a send says whether it is a place or a day. It never names the place. The one about a place comes at most once a day, and as soon as they go. To keep to that, the server remembers the last day it sent you one, and keeps a single counter of how far it has looked, which names nobody. The one about being somewhere together comes at most once a day from each friend; to keep to that, the server remembers the day it last sent one between the two of you, and forgets it once that day is over. The ones about a planned day come at most once for each friend and day, or once a day when a day changes or a friend suggests stops. A phone registers for these only while it is signed in and notifications are allowed. Private proposal and event-approval updates can also send a push with routing identifiers, never the place or address. Likes, comments and mentions can appear in the in-app bell. A new comment on your post or a post you previously commented on can also send an Apple push with the commenter’s @handle, Kepo and a notification identifier for opening the post, never the comment body or post content. The server records each recipient’s comment notification once and attempts delivery at most once to each eligible registered device. Retrying the comment does not send it again.
When Kepo looks up a place or a city, the name or address you are searching for is sent to Apple Maps so it can be matched to a real location. This is Apple's standard mapping service and is covered by Apple's privacy policy. When you pin a place where you're standing, Kepo also sends that spot to Apple Maps to find its street, which it shows you once and does not keep.
Once on each phone you sign in on, for the places you saved before this version, Kepo looks each one up on Apple Maps by its identifier and by its name and city, a few seconds apart, to find a place Apple lists twice. Apple's answers are used for that and not kept.

That is the complete list. The Kepo app contains no analytics, no advertising, no tracking of any kind, and no third-party code libraries. (Visits to the website are counted, as below.)

AI sharing. On the account-creation screen, Kepo explains that creating an account allows it to send shared links, post details and text you add to Anthropic AI to find places and events, with links to the Terms of Service and this policy. After you accept that disclosure when creating a new account, supported shared posts use AI automatically without a separate permission popup when sharing. Kepo records the accepted disclosure version and permission with your account. Existing accounts continue under their accepted account terms without another agreement screen, with AI sharing on by default unless permission was explicitly declined or withdrawn. Kepo separately records when this existing-account setting was applied; that record is not a new signup action. You can find places manually without AI permission. You can withdraw AI permission from Account. Withdrawal stops new processing once the server receives it, cancels unfinished work and clears its private processing content. If you withdraw while offline, this device stops immediately and retries the server update when connected; other devices may continue until the server receives it. A request already sent to a provider cannot be recalled, but a result from withdrawn work is not adopted. Completed saves and messages already sent remain until removed under their normal controls. Kepo sends the shared link, the public post’s text, available author, account-tag and location information, text supplied alongside the link when you share it, and relevant place-search or public website results through Kepo’s server to Anthropic’s Haiku model to identify the place or event. Accompanying shared text is private processing input for your account and is not included in interpretations reused for other people. Shared-link processing does not send your current device location or photo, video or audio files. Public pages may be requested by your device, Kepo’s server, or Anthropic’s browsing service; the website receives the requesting service’s or device’s internet address. When the share screen confirms “LINK SAVED”, your link has been accepted for background processing. Kepo’s server can identify a place using Apple Maps, or identify an event from supported source details, and save it to your account after you close the share screen or app. A supported event is saved to your private Plan with its date, available time and venue details; an address without a confirmed Maps match stays unpinned. A ready notification is sent only after the save is complete. If Kepo cannot identify the place confidently, the link remains in your private Log as needing your help, and Kepo can notify you to finish finding it manually. Notifications depend on your device permissions and delivery availability; Log also shows the outcome. Your intentionally submitted link and its processing status remain until you remove them or delete your account. On Kepo’s server, acquired caption and accompanying shared text for manual recovery are kept privately for up to seven days, then cleared; an unresolved item remains available for manual place and city entry. On your device, accompanying shared text stays with the pending request until it is resolved, removed, or AI processing is withdrawn. Removing a pending item cancels further completion and clears its private processing content. A completed save may retain extracted place or event details and brief source evidence until you delete it; its recognition record does not keep the full acquired post text. At the next hourly cleanup, Kepo clears transient acquisition text and raw source URLs once they are an hour old, and full investigation transcripts after one hour of inactivity. The intentionally submitted link and the private caption copy used for manual recovery follow the retention periods above. Private AI response receipts and completed or unresolved results remain available to your account for up to seven days so interrupted work can resume without repeating a paid request. Account deletion removes these server-side private investigation records. When a request contains accompanying shared text, its interpretation is not reused for other accounts. For requests without accompanying shared text, Kepo may reuse a supported interpretation of a public post for other people sharing the same post for up to 24 hours. Events whose end date has passed are not reused. This shared interpretation includes public place details and source references, not your identity, private saves, edits or investigation transcript; deleting your account does not remove independently reusable public interpretations. Account-linked request fingerprints, processing status and spending records remain until account deletion; an anonymous total of spending remains afterwards. Background place saving follows the same account-record visibility rules as other saved places. Automatically saved events stay private with approval required for venue access. If you select friends on the share screen, Kepo keeps that selection with the request and sends them the saved place or invites them to the saved event, subject to current friendship and sharing permissions. Event invitations do not make anyone an attendee. Background saving does not publish a Feed post, redeem a ticket or prove a visit. Anthropic processes the information under its API service terms and API data-retention policy, which generally provides for deletion within 30 days, with stated safety, legal and contractual exceptions.

Selected screenshots. When you choose screenshots in Log and ask Kepo to analyze them, Kepo sends only those selected screenshots and any text recognized from them through Kepo’s server to Anthropic’s Haiku model to find places and events. Your AI permission and your choice to analyze the selected images are required. Kepo does not send the rest of your photo library or your current location. The selected images are re-encoded from upright pixels without their original photo metadata. Kepo’s server does not keep a stored copy of the screenshot files or the recognized text supplied for analysis. Private extracted place or event details and brief source evidence remain available for up to seven days. Account-linked image and request fingerprints, status and spending records remain until account deletion; an anonymous spending total remains afterwards. Anthropic’s API retention policy described above also applies to this processing.

On your device, the re-encoded screenshot copy and recognized text remain while analysis is pending and are cleared when extraction completes, you remove the screenshot, or you withdraw AI permission. Local import drafts and previews can remain after completion. They are cleared when you start another import, withdraw AI permission or delete your account, or when Kepo next reads an import that is more than seven days old. Removing an unsaved item clears its draft and source evidence. Removing a screenshot clears its local image copy, recognized text, preview and import drafts, retaining only the request identity and status needed to prevent a repeat request. Thumbnails and details already kept with a saved place or event follow the ordinary save-deletion rules. After you review the results and choose Save all, successful places enter your Log under its ordinary visibility rules; supported events enter your private Plan. Missing or ambiguous details need your help. Screenshot import does not send places or event invitations to friends or publish a Feed post.

Location

If you allow it, Kepo uses location to notice visits and help recover missed visits. Matching happens on your phone. Kepo keeps a small, capped set of location observations, including stops that do not yet match a saved place, for up to seven days. This can help recognize a visit that happened before you saved the place. The observations contain coordinates, accuracy and observation times, with no photos, videos or continuous route recording. The cap can remove older observations sooner. Expired observations are removed when Kepo next accesses the history; the app cannot perform cleanup while it never runs.

Raw recovery observations stay on this phone and are excluded from backups. They are not uploaded to Kepo's server. Signing out or deleting your account clears this history; an interrupted cleanup is retried. Once a visit has qualified a ticket, its minimal ticket evidence can remain after the raw observations expire, as described above.

In updated versions of Kepo, I WENT HERE first checks actual location observations retained on this phone for up to seven days. If those observations cannot qualify the selected place, it requests your current precise location while the app is open. A fresh accurate nearby observation can qualify without a minimum stay. Your explicit place choice can resolve multiple nearby businesses, but it cannot qualify a place without nearby location evidence. Kepo records this as your confirmation rather than automatic identification of that exact business. A new observation is kept under the same local seven-day limit. You can use this foreground check with When In Use access and Precise Location without Always access. The check stops when you leave it, background the app or lose the necessary permission. Some earlier versions accepted manual confirmation without checking location; others used Check Location or Check Visit and required an unambiguous match. Selected location boundaries can provide supporting signals but do not themselves qualify a place ticket. Kepo cannot recover observations it never received or that have expired.

When you tap PIN WHERE I AM for a place Apple Maps does not know, Kepo takes your current location as that place's pin. The pin is saved with the place in your record and can go to your friends with it. This deliberately saved place pin is separate from the private recovery history.

Your own record and place-ticket receipt can keep phone-reported visit times so they return on another phone. Those ordinary visit times are private to you; friends can see the eligible ticket and its month, not where you are right now or the exact day and time. Anonymous place verdicts keep a week and an evidence category, not the raw recovery history. Event tickets follow the separate event-day rules above.

Always location access lets iOS deliver eligible visits while Kepo is closed. Apple controls when observations arrive, so every stop may not be detected. Detecting a visit does not automatically rate a place or redeem its ticket.

You can refuse location access or withdraw it in Settings. You can still save places and use ordinary comments. Written place reviews, Worth it or Meh and sharing a plan to Community require the redeemed tickets described above.

Reporting abuse

When you report a comment or private message, Kepo keeps the reported text, its author and reporter, the reason, submission time and the identifiers needed to locate its context for moderation. This does not copy the whole conversation. Blocking someone does not erase a submitted report or this evidence. Reports and their evidence are removed under the account-deletion rules below.

Copyright and source restrictions. Copyright correspondence can include the work and material reported, contact information, a signature and information needed to review a notice or dispute. We keep it only as needed to handle the case, prevent repeated infringement and meet legal obligations. Formal notices or counter-notices may need to be shared with the other party, as explained in the copyright reporting procedure. A validated restriction can clear affected acquired source text and AI interpretations and prevent new processing of that source. Kepo can keep a minimal source identifier or URL fingerprint, case reference and restriction time while the restriction is needed. This restriction record contains no reporter contact details, private notes or conversation text. It is separate from a person's account and may remain after an account is deleted so another account cannot cause the restricted source to be processed again. Independently saved place facts and your own notes follow their ordinary deletion rules.

Deleting your account

You delete your account inside the app, from your account screen. Deleting it erases your account data from the server, apart from the limited retention described below: your profile, your verdicts, your record and everything in it — your saved places, your plans and your days — and the places and days your friends could read, your reactions and the reactions on your places and days, your comments and the comments on your places, the places and days you sent and those sent to you, who you said you were with and every time a friend said you were with them, what you said about places being the same, your friendships, friend requests, unfriends, invite links and reports (including any report about you), your sign-ins, your notification tokens, your request counts and the link with Apple. Your @handle becomes free for someone else. Nothing is kept in a deactivated state, and it cannot be undone.

Limited information can outlive the deletion. The first is Kepo's list of places, described above. Your saves, verdicts and claims about a place are erased; the place's identifiers stay, even if you were the only person who ever saved it, and so does any joining of two places your claim helped make. They do not say that you saved it, or when. The separately stored public city information described above can also remain, without identifying you or your saves.

The second is a safety copy. Kepo's database is hosted by Cloudflare, which keeps a rolling copy of it so it can be put back after a mistake. That copy is whole or nothing, so a deleted account could return with it. To stop that, Kepo keeps a scrambled token for 30 days that says only an account was deleted — not whose — and re-applies those deletions if the database is ever restored. After 30 days the token goes too. Kepo also keeps a hashed deletion acknowledgement for up to 30 days so a phone that missed the server response can confirm the result. This contains no raw sign-in token. A small recovery capability stays in the phone’s Keychain until the deletion is resolved or recovery is cleared; it cannot sign in or access an account. If an acknowledgement has expired, Kepo does not treat an unauthorised response as proof of deletion. Older safety copies may temporarily contain removed personal place notes; those notes are removed again before a restored copy is put into service.

The minimal source-restriction record described under Copyright and source restrictions can also remain while needed to prevent further processing of a restricted source. Support correspondence may remain where needed to resolve a rights dispute or meet a legal obligation. These are separate from your deleted saves, notes and conversations. Independently reusable public-post interpretations may remain for the short period described under AI sharing; they contain no account identity or privately supplied text.

From Kepo 0.3 (19), deleting your account also removes that account’s data from this phone. This includes its saves, verdicts, plans, tickets, cached messages and pending operations. Kepo then returns you to sign-in. There is no option to keep using that local data without an account, and a new account does not inherit it. Older versions offered a choice to keep local saves; those retained saves are not adopted by a new account in this version. If deletion cannot finish, Kepo shows a retry action. After the server confirms deletion, a local cleanup record lets Kepo finish removing that account’s phone data if the app is interrupted. Small local deletion and recovery records may remain to prevent deleted data from returning. Older exports, recovery files or sign-in records that cannot safely be linked to the deleted account are preserved rather than risking another account’s data; they are not transferred into a new account.

One detail. If Apple cannot be reached at the moment you delete, your deletion still goes through at once. Kepo keeps only the encrypted Apple token, with nothing beside it that says whose it was, tries again until Apple confirms, and discards it after 30 days at the latest.

Kepo does not offer a separate download of all server-held information. The app shows your available records and conversations; server delivery, retry and deletion markers are not all displayed on your phone.

Signing out, and Apple's side

LOG OUT, on your account screen, signs this phone out. First Kepo tries once to upload anything this phone has not sent yet. Then it removes this phone's notification token and this phone's sign-in from the server, and forgets the sign-in on the phone.

If the phone is offline, it still logs out, but the server is not told. Kepo does not try again later. The server then keeps this phone's sign-in and its notification token, so notifications for your account can still reach this phone, until you delete your account or stop using your Apple Account with Kepo (below). If someone else signs in on this phone, its notification token moves to their account. Your saves on the phone are not erased either way.

Your account and everything in it stay where they are. What you saved stays on this phone, out of sight, and comes back when you sign in again with the same Apple Account. Someone else signing in on this phone sees none of it, and none of it goes to their account. Sign in with the same Apple Account on any phone and you are back in the same Kepo account.

If you stop using your Apple Account with Kepo in your iPhone's Settings, Kepo signs you out on every phone, removes every notification token, and keeps your account until you delete it. If you delete your Apple Account itself, Apple tells Kepo, and Kepo erases your account.

Deleting things on your phone

Delete a saved place inside the app, or delete Kepo from your iPhone to remove everything stored on the phone. Deleting the app does not delete your account. Delete the account first, in the app, if you want both gone.

Signing up on getkepo.com

If you leave your email address on getkepo.com to hear when Kepo is on the App Store, Kepo's server keeps that address, the time you left it, and a random code for its unsubscribe link. Nothing else: not your internet address, your browser, or anything about a Kepo account. It is used to say thanks when you sign up, and to tell you Kepo is out; the list is deleted after that email goes. The emails come from hello@getkepo.com and are sent through Cloudflare.

Every email has an unsubscribe link. Unsubscribing deletes your address from the list at once; nothing about you is kept.

Visits to getkepo.com

The website counts its own visits, with a small script of Kepo's, not anyone else's. It records which parts of the home page were seen, what was tapped, how long the page was open, whether the email form was sent, the website that linked to it, and whether it was opened on a phone or a computer. A visit is a random number made when the page opens and forgotten when it closes: there are no cookies, nothing is stored on your device, and no internet address or email address is kept with these records. They are kept for 90 days, then deleted.

Age eligibility

Kepo is for people aged 18 or older. On supported devices, Kepo checks Apple’s regional age requirements. Where Apple requires age sharing, or a previously supplied range was below 18, Kepo asks Apple for an age range and uses it only to decide whether you can use Kepo. A reported age range below 18 does not permit access. Where Apple requires an age range, an unresolved check stays blocked and you can retry. When you create an account, the text below Continue with Apple explains that you confirm you are 18 or older. Kepo records that declaration with the new account and uses it where Apple does not require an age range; it does not ask you to repeat the same declaration in a separate Kepo popup when opening the app. A signup declaration does not override an Apple-required age check or a previously reported range below 18. Existing accounts continue under their existing agreement without another Kepo age-confirmation popup. Kepo records the application of that existing-account agreement separately from a new signup action, and preserves any recorded ineligible decision. Account deletion remains available. Kepo does not request or store your full birthday or identity documents. Kepo stores the eligibility decision, its source, policy version and check time with your account, and a session-bound copy on your device. These are removed with your account. A declared age range is not independent proof of identity.

Contact

Questions about this policy: support@getkepo.com.