Privacy Policy

Who I am

Kept is an AI interactive-fiction app. I run it on my own: I'm Linda Chiara De Vecchi, the data controller, a sole proprietorship (trading name: VII Studio), VAT number 04282230368. For any question about this policy or your data, write to me at ciao@keptmine.com.

What data I collect

I only collect what's needed to make Kept work:

• Account: the email you sign up with (and your password, which I never see in plain text: it's handled securely by my authentication provider). If you sign in with Google, I receive the name, email, and profile photo Google shares with your consent.
• Identity: the optional details you write to describe who you are in the story (name, age, appearance, personality) and any image you choose to upload. You can leave all of this blank, it's always optional.
• Date of birth: the date you enter when you register. It's only used to verify you're at least 18, as required to use Kept.
• Acceptance of the terms: when you tick the box accepting the Terms of Service and the Privacy Policy, I keep the date and the version of the texts you accepted, so that I can show which conditions you agreed to.
• Your conversations with Dorian: the text you write and the replies you receive. These are necessary for the service to work, it's how the story remembers what's happened.
• Minimal technical data: IP address and browser information, collected automatically for security purposes (preventing abuse, understanding technical errors).
• Email for notices: if you leave your email in the "The apps are coming soon" box on the home page, or if, once your free replies are used up, you choose "Yes, notify me" (in that case I use your account email, and in return you get a few extra free replies), I save it only to write to you when Kept arrives on the App Store and Google Play or when the subscription becomes available.
• Welcome and news emails: once your account is active I send you a single welcome letter, with a few tips to get started. If you tick the news box when you sign up (or later, from the Account page), a week later I also write to you about what's coming to Kept, like new characters. For this I save whether you gave consent, when, the language to write to you in, and which of these emails I've already sent. You can withdraw consent at any time, from the Account page or from the link at the bottom of every email.
• Subscription and payments: if you subscribe from the apps (through the App Store or Google Play), Apple or Google handles the payment under its own terms, and I never see or keep your card or payment details. I only keep your subscription status, renewal date, and a purchase identifier that the store sends me.
• Requests and reports: if you write to me from the "Requests and reports" page (about a problem, an idea, a character to invent, or a Dorian reply that doesn't work), I keep the type of request and what you write. You can write to me even without an account. If you have an account, the request is linked to your account email; if you don't, the email is optional and I only use it to reply to you. For a bug I also save the page you're writing from, your language, and the browser you use; for a Dorian reply that doesn't work I only save that reply's identifier, not the rest of the conversation. In the message, just describe the problem: don't write data you don't want to share.

Why I use it

I use your data only to make Kept work for you: to let you sign in, generate Dorian's replies, remember your story, manage your subscription, send you the emails the service needs (account confirmation, password reset, the welcome letter), send you Kept news if you chose to receive it, reply to the requests you send me, and understand what to fix or improve.

Apart from the Kept news you choose to receive, I never use it for advertising, I don't sell it, and I don't share it with anyone for third-party marketing purposes.

The legal basis for processing your data

I process your account, identity, and conversations with Dorian because they're necessary to provide the service you asked for: without this data, Kept simply can't work. I process your date of birth for the same reason, and to meet my obligation to keep Kept limited to an adult audience. I process minimal technical data (IP, browser) for my legitimate interest in keeping the service secure and preventing abuse. I process subscription data (status, renewal date, and purchase identifier) to perform the contract you asked for and to meet my tax and accounting obligations. I process the email you leave for notices, and your account email for news emails, on the basis of your consent, which you can withdraw at any time. The welcome letter is part of the service you asked for. I process requests and reports to reply to what you asked me and for my legitimate interest in fixing errors and improving Kept.

Your conversations with Dorian can touch on personal and intimate topics. They're protected like any other data of yours: no one reads them, unless you report a technical problem yourself that needs fixing. If you report a Dorian reply that doesn't work, I only receive that reply's identifier: I may read that single reply to understand what's wrong, but not the rest of the conversation. Conversations are never used to train artificial intelligence models, neither mine nor Anthropic's (the provider that generates Dorian's replies), under Anthropic's standard policy for paid API customers.

Who processes data on my behalf

To run Kept I rely on a small number of providers, chosen because they're serious and genuinely needed for the service. Each one only sees the data it needs for its task:

• Supabase (database and authentication, servers in London, United Kingdom): stores accounts, identities, and conversations.
• Anthropic (United States): receives the conversation text to generate Dorian's replies. It's the only provider besides Supabase that sees the content of your stories, and it's necessary: it's how Dorian "thinks".
• Vercel (application hosting): runs the site.
• Resend (email delivery): sends account confirmation and password reset emails, the welcome letter and news emails, and the notification email I receive when you write me a request.
• Hostinger (domain and mail): manages the keptmine.com name and the ciao@keptmine.com mailbox, where the messages you write to me and the request notifications arrive.
• Apple (App Store) and Google (Google Play): when you subscribe from the apps, they collect the payment and handle payment data under their own privacy policies, as independent controllers. I only receive the subscription status, renewal date, and a purchase identifier, never your card number or any other payment data.
• Google: if you choose to sign in with "Continue with Google", to verify your identity; also, messages sent to ciao@keptmine.com are read by me in the Gmail mail service.

Data transfers outside the European Union

Some providers (Anthropic, Vercel, Resend, Google, Apple) are based or operate in the United States and may process data there. In these cases I rely on the legal safeguards for international personal data transfers (such as the European Commission's Standard Contractual Clauses) that these providers adopt. Supabase's database is located in the United Kingdom, a country the European Commission has recognised as providing an adequate level of protection (adequacy decision).

How long I keep data

I keep your data for as long as your account is active. If you delete your account (from the Account page in the app), I permanently delete your profile, identities, uploaded images, and all conversations: this cannot be undone. Deleting your account does not cancel a subscription bought on the App Store or Google Play: cancel it from your phone's settings, otherwise the store keeps charging it.

I keep subscription data and the related store payouts for as long as tax and accounting obligations require, even after your account is deleted, and only for that purpose. I keep the email you leave for notices until you ask me to delete it, by writing to ciao@keptmine.com. Your news consent and the record of welcome and news emails already sent are deleted together with your account.

I keep requests and reports for as long as they're needed to handle them and to improve Kept. Those linked to your account are deleted from the database together with the account. Copies that arrived by email in my mailbox, and requests written without an account, I delete if you ask: write to ciao@keptmine.com with the email you used and, if you can, a sentence from your message.

Your rights

As someone whose data I process, you have the right to: access your data, request a correction, request deletion, request a copy of your data in a readable format (portability), and object to processing. To exercise any of these rights, write to ciao@keptmine.com.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) if you believe my processing of your data isn't lawful.

Minimum age

Kept is intended for an adult audience: it contains romantic tension and suggested (never explicit) intimacy. You must be at least 18 years old to use Kept.

Security

I protect your data with reasonable technical measures: encrypted connections, data access limited to those who genuinely need it, and database-level rules that prevent one user from seeing another's data. Requests and reports are also unreadable by other users: they can only be written through my server.

Changes to this policy

If I make a substantial change to how I handle your data, I'll update this page and, if the change is significant, let you know by email as well.