Privacy Policy

Last updated: July 18, 2026

Overview

Keph (keph.me) respects your privacy. This policy describes what information we collect, how we use it, who processes it on our behalf, how long we keep it, and what choices you have. We aim to collect only what is reasonably necessary to operate the service, and to meet our legal and compliance obligations. This Privacy Policy is incorporated into and forms part of our Terms of Service.

What We Collect

Account information: When you register, we collect your email address and display name. If you sign in via Google or Microsoft (OAuth), we receive from those providers your name, email address, a unique account identifier, and, where available, your profile picture (avatar).

Authentication data: If you register with email and password, your password is stored only as a one-way cryptographic hash (using bcrypt). We never store your password in plain text and cannot recover it. We also process email verification tokens to confirm your address.

Conversation content: Your messages and the AI-generated responses are stored so we can provide your conversation history and operate, moderate, and secure the service. Signed-in conversations remain available in your account until you delete them. If you start chatting anonymously and then create or sign in to an account in the same browser session, your anonymous conversation is moved into that account so it is not lost.

The Covenant signature record: Before your first message with a registered account, you electronically execute The Covenant. We record that execution — including the name you type, the date and time of signature, your IP address at the moment of signing, your browser's user-agent string, and a cryptographic hash of the exact terms you accepted. This evidence bundle is cryptographically sealed to make the record tamper-evident, and is retained for legal, compliance, and record-keeping purposes. Unlike our analytics data, the signature IP is retained in full, as evidence of execution.

Payment information: Payments and subscriptions are processed entirely by PayPal. We do not collect, store, or have access to your card numbers or financial account details. We retain only a subscription identifier and status necessary to manage your Pro access.

Usage and analytics data: We collect limited technical and analytics data such as page views, message counts, your browser user agent, and a hashed (irreversible) form of your IP address. We hash IP addresses to reduce the identifiability of this data. We do not use third-party advertising or cross-site tracking tools.

Cookies: We use a single session cookie to keep you logged in and maintain your session. See "Cookies" below.

Anonymous usage: If you use Keph without an account, your messages are stored under a session identifier rather than your identity, and inactive anonymous conversations are automatically purged after approximately ninety (90) days.

Data stored on your device: Some preferences never leave your browser: your theme and sound settings, the record that you clicked the acknowledgment, and any inscriptions you keep in the Reliquary are held in your browser's local storage on your device. Clearing your browser data removes them.

How We Use Your Data

We use the information described above to:

• Provide, operate, and maintain the service;
• Authenticate your account and keep it secure;
• Store and retrieve your conversation history;
• Generate AI responses to your messages;
• Manage subscriptions and Pro access;
• Send transactional email, such as address verification;
• Maintain records of Covenant execution and enforce our Terms;
• Moderate content, prevent abuse, and meet legal, safety, and compliance obligations;
• Understand and improve the service based on aggregate usage patterns.

We do not sell or rent your personal information, and we do not share it with third parties for their own marketing purposes.

Third-Party Processors

To operate the service, we rely on the following categories of third-party providers, who process data on our behalf or as independent controllers under their own policies:

• AI model and infrastructure providers — receive the prompts and messages you submit in order to generate responses. We may select, combine, or change these providers at any time;
• PayPal — processes subscription payments;
• Hosting and database providers — provide the infrastructure and database where data is stored;
• Email delivery providers — deliver transactional and verification emails;
• Google / Microsoft OAuth — provide authentication if you choose social sign-in.

Cookies

We use a single session cookie to keep you logged in and to maintain your authenticated session. We do not use advertising, cross-site tracking, or third-party marketing cookies. You can disable cookies in your browser settings, though doing so may prevent you from signing in or using certain features.

Data Storage and Security

Your data is stored in a managed database on our hosting provider's infrastructure. Passwords are hashed using bcrypt and are never stored in plain text. We implement reasonable administrative and technical measures to protect your data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data Retention

We retain account data for as long as your account remains active or as needed to provide the service and comply with our legal obligations.

Conversations: Conversations tied to your account remain stored, and visible to you in the interface, until you delete them or delete your account. Deleting a conversation removes it and its messages from our active database. Anonymous conversations are stored under a session identifier and automatically purged after approximately ninety (90) days of inactivity — unless you sign in during the session, in which case the conversation moves into your account. Covenant signature records are retained for legal and compliance purposes even after account deletion where required or permitted by law.

Your Rights

Depending on your jurisdiction, you may have rights regarding your personal data. You may:

• Access, search, rename, and export your conversation history through the service interface;
• Delete individual conversations at any time from the interface;
• Request deletion of your account and associated account data — deletion removes your account data from our active systems, subject to records we are required or permitted to retain for legal, compliance, or safety reasons;
• Cancel your subscription at any time.

To request account deletion or a data request, contact us at the email below.

Age Restriction

Keph is intended solely for adults and is not directed to, or intended for use by, individuals under the age of 18 (or the age of majority in their jurisdiction). We do not knowingly collect personal information from minors. If we learn that a minor has provided us information, we will delete it. If you believe a minor is using the service, please contact us.

International Data Transfers

Keph and its third-party processors may store and process your data in countries other than the one in which you reside, including the United States. By using the service, you consent to the transfer, storage, and processing of your data in those locations, which may have different data-protection laws than your own.

Changes

We may update this policy from time to time. Changes take effect upon posting to this page. We encourage you to review this page periodically.

Contact

For privacy concerns or data requests, contact: kephmetheguardian@gmail.com