Keepsake Privacy Policy / Data Protection

Controller and contact

Controller: Elias Anderlohr, elch.cc, Heidestraße 23, 60316 Frankfurt am Main, Germany.

Privacy and data protection requests can be sent to contact@elch.cc. You can also call +49 156 79713762.

Local app data

Keepsake is local-first. Saved facts/cards, reminders, learned autocomplete suggestions, settings, imports, and attached photos are stored on your device unless you choose to export, share, delete, or upload something.

No account is required for the app. The app does not sync your saved cards to the Keepsake API.

Keepsake does not add app-level encryption to local app storage or local attachment files. Treat the app as a memory aid for everyday facts, not as a password manager or secure vault. Do not store passwords, recovery phrases, bank details, full identity document numbers, medical secrets, or other confidential data.

Voice API data

Voice capture is optional and creates a short-lived API session when you record.

The app uploads the audio file with minimal processing context. The API keeps the audio in memory while it is being processed and clears the audio buffer after processing or failure.

The API stores short-lived session and segment records containing status, transcript only when needed for review, retry, or explicitly enabled debugging, candidate cards, sensitive-data warnings, upload size, and timestamps. Candidate cards are returned to the app so you can review them before saving locally.

After the app finalizes a voice session and receives the merged candidate cards, the API immediately deletes the server-side session record, segment records, review transcripts, and parsed candidate-card records for that session. If a session is abandoned before finalization, the retention cleanup removes segment records after about 45 minutes.

AI processing

Keepsake currently uses Mistral AI SAS for voice transcription and text-to-card parsing: Mistral AI SAS, 15 rue des Halles, 75001 Paris, France.

Audio is sent for transcription. Redacted transcript, typed, file, pasted, or OCR text and a strict output schema may be sent to create proposed cards. Keepsake asks every model not to invent facts, but you must still review the result.

Raw AI provider responses are not stored by the Keepsake API. Operational logs record provider events and metadata, not transcript text or parsed card content.

Hosting and domain

The Keepsake API runs on European server infrastructure hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Server-side API processing and short-lived voice session data are handled on this German-hosted infrastructure.

The elch.cc domain used for the API is registered and managed through GoDaddy. Domain registration and DNS providers may process technical domain and DNS data; Keepsake API application data is hosted on STRATO.

The AI processor used for transcription and parsing is Mistral AI SAS in France. This means the current server and AI processing setup is European: the Keepsake API is hosted in Germany and AI processing is performed by a French provider.

Retention

• Uploaded audio is held only in memory while the segment is processed and is cleared immediately after transcription/parsing completes or fails.
• Parsed candidate-card records, review transcripts, and segment metadata are deleted immediately when the app finalizes the voice session and receives the merged result.
• Voice sessions expire after about 10 minutes.
• Upload tokens expire after about 30 minutes.
• If a voice session is abandoned before finalization, voice segment records are cleaned up after about 45 minutes.
• Operational logs record request and processing metadata such as request IDs, route paths, status codes, segment IDs, byte sizes, provider names, model names, and errors. They are used for security, debugging, abuse prevention, and service operation.

Security and minimization

• The API uses HTTPS in production, upload tokens, request size limits, rate limits, and short retention windows.
• Request logging records method, path, status, and request IDs. The API does not intentionally log transcript text, prompt text, or parsed candidate-card content.
• The API redacts common secret patterns from proposed cards and review transcripts where possible, but automated redaction is imperfect. Do not speak or upload secrets.

Legal bases and rights

Where the GDPR applies, processing is based on providing the requested service, protecting the service from abuse, and your decision to use optional voice capture. You may request access, correction, deletion, restriction, portability, or objection where applicable.

You may also complain to a competent data protection authority. Because the API stores voice processing data only briefly, deletion requests should be made as soon as possible after a voice session.