Privacy Policy

Last updated: October 25, 2026

1. Who we are

Keen is operated by Eric Perley d/b/a Keen, a sole proprietor in Washington, United States ("Keen", "we", "us"). For privacy questions, contact us at [email protected].

2. Definitions

• Application / Service — the Keen desktop application, our marketing site at thekeen.app, and the optional managed-hosting service that runs your Keen backend on our infrastructure.
• User Content — notes, tasks, projects, knowledge items, chat history, attachments, and any other content you create or import into Keen.
• Local Data — User Content and application state that resides in the embedded PostgreSQL database, attachment storage, and configuration files on your own device.
• Integration Data — data Keen retrieves from third-party services you have connected (e.g., Google Calendar, Gmail, Contacts).
• Sub-processor — a third party that processes data on our behalf to provide a feature of the Service.

3. Where your data lives

3.1 On your device (default)

When you use Keen as a self-hosted desktop app — the default — the following all stay on your Mac:

• Your notes, tasks, projects, knowledge items, chat history, and attachments.
• The embedded PostgreSQL database that powers the app.
• The LanceDB vector index used for semantic search. The index itself is local, but the text being indexed is sent to OpenAI under your own API key to generate the vectors — this happens whichever AI provider you have chosen. See Section 6.
• Your Google OAuth refresh tokens and AI provider API keys, held in an AES-256-GCM-encrypted file in Keen's application data directory. The master key that decrypts that file is kept in your macOS Keychain and is never written to disk.
• Any data Keen retrieves from Google services on your behalf — these requests originate from your Mac and the responses are stored locally.

We do not have access to any of this data. We cannot read it, restore it, or recover it. We recommend you maintain your own backups.

3.2 Managed hosting (optional)

We offer an optional managed-hosting service that runs the Keen backend for you on our infrastructure (Fly.io). If you choose managed hosting, your User Content is processed and stored on Fly.io machines and database volumes that we operate. We treat this data as confidential, encrypt it in transit (TLS) and at rest, and do not access it except as required to deliver, secure, and support the Service.

You can export and delete your managed-hosting data at any time from the application; see Section 9.

3.3 What reaches Keen-operated infrastructure regardless of hosting choice

A small amount of operational data reaches Keen-operated infrastructure even when you self-host:

• OAuth proxy traffic (Cloudflare Workers): when you connect a Google account, our proxy at oauth.thekeen.app brokers the OAuth handshake. The proxy holds a Google-issued refresh token in encrypted KV storage for at most two minutes between the moment Google issues it and the moment your Keen backend claims it. After the claim, it is deleted. The proxy does not see Gmail, Calendar, or Contacts content — only the OAuth tokens themselves. See Section 6.
• Auto-update checks (GitHub Releases): the desktop app periodically checks for new versions. These requests reach GitHub's servers and contain the standard request metadata GitHub logs (IP, user-agent).
• Crash and error reports (Sentry, opt-in): if you opt in, the app sends error stack traces to Sentry. The structured context attached to a report is stripped of personally identifying fields client-side; the error message, stack trace, and breadcrumb trail of recent actions are sent as recorded. See Section 5.4.
• Marketing site analytics (thekeen.app): the marketing site is static and currently has no analytics or tracking.

3.4 Collaboration and sharing (optional)

Keen can share a single project with other people who run their own copy of Keen. Nothing is shared until you create an invite, and sharing is per-project.

The connection is between the two installations, not through us. A collaborator's Keen connects directly to the address your Keen publishes. There is no Keen-operated relay, sync server, or directory in this path. If you self-host — the default — shared content never passes through and is never stored on Keen-operated infrastructure, and we cannot see what you share, who you share it with, or that a share exists at all. If you use managed hosting, the machine your collaborators connect to is the backend we run for you, so that content lives on our infrastructure as described in Section 3.2.

What leaves your Mac. Your installation sends the collaborator a structural copy of the shared project — the project, its milestones, its tasks, and its comment threads. For everything except comments this copy is metadata only: title, status, importance, effort, due date, recurrence, archived flag, milestone target date, position in the hierarchy, and who last edited or is assigned to an item. The free-text body — a task's description and notes, a knowledge item's content — is deliberately excluded from that copy. Two narrower paths carry prose:

• Read-on-demand. When a collaborator opens a shared project, task, or milestone, its description and notes are fetched live from your machine at that moment rather than kept on theirs.
• Prose co-editing. If you grant a share the prose co-editing capability, task descriptions and notes are synchronized live with that collaborator so you can edit them together. This applies to tasks only.
• Comments. Comment text is copied to the collaborator's machine and kept there, because a discussion thread is meant to stay readable offline. Notifications about activity in the shared project — their title and message — are likewise copied into the collaborator's inbox.

Attachments are not transmitted to collaborators. Neither is anything outside the shared project: your other projects, your notes, your chat history, and your knowledge base — including knowledge items linked to the shared project — are not reachable over this connection. Knowledge items are not shared at all today.

What collaborators send back. A collaborator's Keen can send you only what their share grants: changes to a task's status, importance, effort, due date, and recurrence; task assignment; project and milestone edits permitted by their role; tasks and milestones they create, including the title, description, and notes they write on them; deletion of shared tasks and milestones; comments they write; and, where granted, co-edited task prose. They cannot rename, move, or re-parent items that already exist. Separately, and regardless of role, they send a self-asserted profile — a display name, an avatar colour, and optionally an email address — so you can tell collaborators apart. These are claims a person makes about themselves, not verified identity.

Email addresses stay with the project owner. A collaborator's asserted email address is disclosed only to the owner of the project they joined. It is withheld from every other collaborator and from connected tools, by field-level enforcement in the code rather than by convention.

Invite links. An invite carries a single-use claim secret in the link's fragment — the part after #, which browsers do not transmit to servers. Your Keen keeps only a SHA-256 hash of it and reveals the secret to you once. Redeeming it exchanges it for that collaborator's own access credential; it cannot be redeemed a second time. Unclaimed invites expire and can be revoked. You can copy an invite link and deliver it yourself, or, if you have connected a Google account, have Keen email it — in which case the message is sent through your own Gmail account, not by us. When someone claims an invite, your Keen records the address they claimed from (which falls back to their IP address) and afterwards keeps a last-active timestamp for the share.

Ending a share, and what that does not undo. Revoking a share ends the collaborator's access and stops further updates. It does not reach into their machine and erase what they already received. Withdrawn items are marked as withdrawn on their side rather than deleted: the item, anything they attached to it (their own tags, favourites, reminders, and links to their own knowledge), and any comment thread remain in place and readable. The one action that erases the mirrored copy is the collaborator choosing to unsubscribe, which deletes those items on their machine outright. Anything a collaborator authored themselves is unaffected either way. Treat sharing as you would sending someone a document: you can stop sending updates, but you cannot take back what has already been delivered.

Because the connection is direct, we are not a party to it: we do not receive, process, or store shared content, and we could not produce or delete a collaborator's copy if asked. Collaboration introduces no new sub-processor — no entry in Section 6 is involved in it.

4. Information you provide directly

If you sign up for managed hosting, a paid plan, or contact support, we collect the information you provide:

• Account information (managed hosting only): email address and a hashed password or OAuth identity.
• Billing information (paid plans): handled entirely by Stripe. We never see or store your full card number; we receive only Stripe's tokenized customer ID, the last four digits of the card, expiration, and country, for the purpose of managing your subscription. See Stripe's Privacy Policy.
• Support correspondence: the contents of any email you send us, retained as described in Section 7.

5. How we collect and use data

5.1 To provide the Service

We use Local Data, Integration Data, and (where applicable) managed-hosting data solely to deliver the features you have asked for: storing notes, retrieving and summarizing email, displaying calendar events, etc. We do not use this data for any other purpose.

Some AI processing happens automatically, not only when you ask for it. Because these features are always-on, it is worth being explicit about them:

• When you save or edit a knowledge item, its text (up to the first 8,000 characters) is sent to your AI provider so Keen can extract the people, organizations, and topics that populate your knowledge graph.
• Every semantic search sends the text you searched for to OpenAI to be turned into a vector, as does indexing the items being searched.
• Chat sessions have their titles and summaries generated from the transcript.

All of this runs under your own API keys and goes from your machine directly to the provider — we never see it. The deeper background analysis jobs, which look across your history to build a profile of how you work, are off unless you switch them on.

5.2 Google integrations (Calendar, Gmail, Contacts)

If you connect your Google account, Keen requests these scopes:

Where the data goes. Calendar events, contacts, and email messages are fetched on-demand from Google directly to your Mac (or, with managed hosting, to your dedicated backend on Fly.io). We do not copy this data into a multi-tenant database, do not aggregate it, and do not retain it beyond the immediate request unless you choose to save it as a note or task in Keen.

AI processing. When the assistant summarizes an email or drafts a reply, the relevant message content is sent to your configured AI provider (Anthropic or OpenAI) under your own API key ("BYOK" — bring your own key). The request goes from your machine directly to the provider; Keen-operated infrastructure does not see the prompt or the response. Your relationship with the AI provider is governed by your agreement with them.

5.3 Limited Use of Google data

Keen's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• Use Google user data only to provide or improve user-facing features that are prominent in the Keen application.
• Do not transfer Google user data to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with the user's explicit consent.
• Do not use Google user data for serving advertisements.
• Do not allow humans to read Google user data, except (a) with the user's affirmative consent for specific messages, (b) when necessary for security purposes (e.g., investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized for internal operations.
• Do not use Google user data, including derivatives, to develop, improve, or train generalized AI or machine-learning models.

5.4 Diagnostic and crash data

If you opt in to crash reporting in Settings, the desktop app sends error events to Sentry containing the error message, stack trace, app version, OS version, and timestamps. Before sending, we sanitize the structured context we attach to an event, dropping fields whose names suggest sensitive content — token, jwt, auth, password, secret, key, email, phone, name, address, body, request, and response. To be precise about the limits of that: it applies to the context bag only. The error message itself, the stack trace, the in-app address where the error occurred, and the breadcrumb trail of your recent actions are transmitted as recorded, and could incidentally contain content you had open. Sentry retains these events for 90 days.

5.5 What we do not do

• We do not sell, rent, or trade your personal data.
• We do not use your data to train any AI or machine-learning model.
• We do not serve ads.
• We do not send marketing email. The only emails we will send are transactional (account, security, OAuth notifications, billing receipts for managed hosting / paid plans).
• We do not share your data with affiliates, business partners, or third parties for their own use.

6. Sub-processors

We engage the following sub-processors. Each is bound by a data-processing agreement that limits their use of data to the purposes below.

We will update this list when sub-processors change.

7. How long we keep data

8. Sharing and disclosure

We disclose data only:

• To sub-processors listed in Section 6, for the purposes listed there.
• To comply with law — in response to a valid subpoena, court order, or other legal process, after reviewing the request for legality and scope.
• To prevent harm — where we have a good-faith belief disclosure is necessary to investigate fraud, protect against abuse, or protect the safety of any person.
• In a business transfer — if Keen is acquired or its assets are sold, we will notify you before your data is transferred and you will have the opportunity to delete your account before the transfer takes effect. Google user data will be transferred only with your explicit consent.

9. Your rights

Regardless of where you live, you may at any time:

• Access the data we hold about you (most of it lives on your device and is already accessible via the app).
• Correct inaccurate data.
• Delete your data — uninstall the app and delete its data directory; or, for managed hosting, use the "Delete account" option in Settings or email us.
• Export your data — Keen has built-in export to Markdown and JSON.
• Disconnect integrations — revoke Google access at any time from Settings → Integrations, and additionally revoke at myaccount.google.com/permissions.

When you delete a fact, belief or profile entry, Keen removes it from its memory. Your past chats are kept as they were, so anything said in a chat stays in that chat. To remove it there too, delete the chat; this permanently deletes everything said in it.

If you are in the European Economic Area, the UK, or Switzerland, the GDPR additionally gives you the rights to data portability, to restrict processing, to object to processing, and to lodge a complaint with your local supervisory authority.

If you are a California resident, the CCPA/CPRA additionally gives you the rights to know what categories of personal information we collect, to opt out of the "sale" or "sharing" of your personal information (we do neither), and to limit use of sensitive personal information. We will not discriminate against you for exercising these rights.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

10. Security

• Tokens and API keys are encrypted with AES-256-GCM in a file on your device; the master key that decrypts them is held in your macOS Keychain and never written to disk. Your backend access tokens, collaboration tokens, and licence key are themselves Keychain items.
• OAuth client secret lives only in our Cloudflare Worker — it never ships in any binary, container image, or environment variable on user machines.
• Transport is TLS 1.2+ for every connection to us and to third-party APIs. Invite links to a remote collaborator are required to be HTTPS.
• At rest for managed hosting, volumes are encrypted by the underlying provider.
• Nonce-bound OAuth flows with 10-minute flow windows and 2-minute claim windows; flow IDs are single-use and deleted on first claim.
• Crash reports have their structured context PII-stripped before leaving your device, within the limits described in Section 5.4.

No system is perfectly secure, and we make no guarantee against all conceivable threats. If we discover a breach affecting your data, we will notify you without undue delay and in any event within 72 hours of becoming aware of it.

11. International transfers

If you access the Service from outside the United States, your data will be transferred to and processed in the United States and other jurisdictions where our sub-processors operate. Where required (e.g., EEA → US), we rely on the EU Standard Contractual Clauses and additional safeguards offered by our sub-processors.

12. Children

Keen is not directed to children under 16 and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes

We may update this policy. The "Last updated" date at the top reflects the most recent revision. For material changes affecting how we handle data we have already collected, we will provide reasonable advance notice (in-app, by email if applicable, or on the marketing site).

14. Contact

Privacy questions, data-subject requests, and security reports: [email protected].