Neatkept Privacy Policy

Last updated: 10 November 2026

Neatkept is a home inventory: you photograph boxes and shelves, and the app remembers what is where. This policy explains what we keep, why, who helps us run the service, and how you can take your data with you or delete it. We don't show ads, we don't sell data, and the app has no third-party analytics or tracking (apart from the technical diagnostics of Google's on-device components on Android, and the ad measurement on Android that only people who came from a Google ad are asked to allow, both described below).

Who we are

Neatkept is run by Global Tech Distribution s.r.o., Voskovcova 1130/30, Hlubočepy, 152 00 Praha 5, Czech Republic ("we"). We are the controller of your personal data. Contact: the contact form, or write to the address above. The rules for using Neatkept are in the terms of use.

What we keep

Data	Why	Legal basis (GDPR)
Your email address, or the account ID Apple or Google gives us when you sign in with them; your name if you give one or your Google account shares it; your language	To sign you in, send sign-in links and show the app in your language	Contract (Art. 6(1)(b))
Your inventory: properties, rooms, boxes, things, their tags, quantities, optional values, and the log of moves	This is the service	Contract
Where a property is (its map coordinates), only if you set it. The phone uses its own location to tell which property you are at, and never sends it to us	To show the places of the property you are at first	Contract
Photos you take in the app, and the text the phone reads from packaging and labels	To recognise things in them and show them to you	Contract
What the AI models answered for each photo	So an old photo can be read again by a better model, and to measure and improve recognition	Legitimate interest (Art. 6(1)(f))
Whether you allowed the AI, and when you last changed your answer	To send your photos, packaging text, search queries, spoken phrases and names of things to the AI models only with your permission	Consent (Art. 6(1)(a)), which you can withdraw in the app
Barcodes you scan	To look up the product	Contract
Your IP address when you ask for a sign-in link	To stop abuse of sign-in emails	Legitimate interest
Sign-in sessions (refresh tokens)	To keep you signed in	Contract
When you were last active, your household’s main currency, and how much you keep (counts only, never what it is)	For a private overview only we see: how many people use Neatkept and where they get stuck	Legitimate interest
Android only: the shape of the app's install referrer (field names, source and medium), whether the app took it for an ad click, and your answer about ad measurement	To check that the ad-measurement question reaches the people it is meant for (see Advertising measurement)	Legitimate interest
API tokens you make: their name, access, expiry, when each was last used, and a fingerprint of the token (never the token itself)	To let your own scripts and tools reach your inventory	Contract
AI assistants you connect (MCP): which assistant, the household and access you chose, when it was connected and last used, and fingerprints of its sign-in tokens (never the tokens themselves). Each tool call is logged with the connection and the tool's name, never what was asked or answered. When an app registers itself to connect, the IP address it registers from	To let the assistants you choose reach your inventory, and to stop abuse of registration	Contract; legitimate interest for the IP address
In the web app: one cookie that keeps you signed in (no tracking cookies), and your language and theme in the browser’s storage (app.neatkept.com)	To keep you signed in and show the app the way you set it	Contract
If a household is paid for: the App Store subscription (Apple's transaction ID, the product, its status and dates, and Apple's signed record of it), or the Google Play one (Google's purchase token and order ID, the product, its status and dates, Google's record of it and its notifications about it). Apple or Google handles the payment; we never see your card or other payment details	To give the household its plan	Contract

Everyone you invite to a household sees everything in it, and sees your name, email and role there.

If you make an API token (Settings → API tokens in the web app), whoever holds it can read the household from their own scripts and tools, or change it too if the token can write: see the API for developers. Give a token only to people and services you trust. The tokens page shows when each was last used, and you can revoke one at any time. We pass nothing on through tokens ourselves: your data goes only where you send it.

If you connect an AI assistant such as Claude or ChatGPT to Neatkept (through our MCP server, mcp.neatkept.com), you choose the household and whether it may only read it or also change it, never more than your role there. What the assistant reads from Neatkept goes to the company behind it and is handled under that company's terms and privacy policy, not ours; we pass nothing else on. You can see and disconnect assistants at any time in Settings → Connected apps in the web app: see the page for developers.

Who helps us

DigitalOcean hosts the service: servers, database and photo storage are in its Frankfurt, Germany data centre (EU).
DigitalOcean Inference runs the AI models that read your photos and packaging text, turn names into search vectors and interpret search queries. DigitalOcean does not store what is sent to the models or what they answer, and does not use it to train models. Photos, packaging text, search queries, spoken phrases and duplicate checks go to OpenAI models through DigitalOcean, under OpenAI's zero data retention terms. We keep the answers ourselves, as described above. On an iPhone or iPad with Apple Intelligence, a spoken phrase is first read on the device by Apple's on-device model and leaves it only when the device can't find the things or the place you named. Nothing goes to the AI models until you allow it in the app: Neatkept asks the first time you scan, search or speak. You can change your answer at any time in Settings → AI. Without it the app works without AI: no photo scans, search by words, duplicates by barcode only. When you turn it off, nothing new is sent; the search vectors already made stay in our database, with no third party.
Hetzner hosts our own search-vector server in Falkenstein, Germany (EU). Names, descriptions and search queries are turned into search vectors there by a model we run ourselves; nothing is kept on that server. When it is unavailable, DigitalOcean Inference does the same work.
Postmark (ActiveCampaign, USA) sends sign-in emails. It receives your email address.
Apple, if you use Sign in with Apple, for subscriptions bought in the app, and for voice input: when you tap the microphone, Apple's speech recognition turns what you say into text — on your iPhone or iPad where the language allows it, otherwise on Apple's servers (Ukrainian, for now). We never receive the recording, and the text only when your device can't read it itself. We keep only the ID Apple gives us for our app, and the subscription records Apple signs.
Google, if you use Sign in with Google (on any device): Google tells us your Google account's ID, its email address and name. We keep the ID. When the sign-in creates your account, we also keep the name as your display name, and the email only if Google vouches for it (a Gmail address, or your organisation's own domain). We call no Google service with your data and keep no Google sign-in tokens.
Google, on Android only: for subscriptions bought in the app through Google Play, which handles the payment, receives the household's ID so the purchase goes to the right household, and tells us the purchase's status. Speech recognition, reading barcodes and packaging text, and the first reading of a spoken phrase (Gemini Nano, where the phone has it) run on your phone. Barcode and packaging-text reading are built into the app (Google ML Kit); speech recognition and Gemini Nano use Android's on-device services, whose language packs and model the phone downloads (usually from Google). Where the phone can't recognise your language itself (Ukrainian on some phones), Android's speech service, Google's on most phones, turns what you say into text on its servers when you tap the microphone; we never receive the recording. Apart from that, Google receives none of your voice, photos or text through them; the text of a spoken phrase and the text read from packaging reach us as described above. ML Kit sends Google technical diagnostics about how it runs, such as device model, app and library versions, an installation ID, performance and errors, never your content.
Product databases (Open Food Facts, Open Beauty Facts, Open Products Facts, EAN-DB, EAN-Search.org) receive a barcode you scan, and nothing about you. Answers are cached for everyone.

Where a provider is outside the EU, the transfer relies on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

Advertising measurement (Android)

We advertise the Android app with Google Ads. To see which ads bring people who really use Neatkept, the Android app can tell Google when someone who came from one of our ads signs up and saves their first thing. It does so only if you allow it.

Who is asked. Only people who installed the app from Google Play after tapping a Google ad. The app reads, once, the install referrer Google Play keeps for it; if it carries a Google Ads click (gclid or gbraid), the app asks you once, after you create your account. Everyone else is never asked, and Firebase never starts for them. The iPhone, iPad and web apps have none of this.
What is sent, only after a yes. To Google, through Firebase Analytics: that you signed up and that you saved your first thing (only that it happened, never what it is), and when and for how long you use the app (Firebase's automatic events, such as the first open and app sessions, which can't be turned off). With them go an app ID Firebase makes for this installation, the ad click from the install referrer, and basic device details: model, system version, language and app version. Google sees your IP address when the app sends them. Nothing about your things, places or photos is sent, nor your email, name or Neatkept account. The app doesn't use the advertising ID or the Android ID.
Why, and the legal basis. Only to measure our ads: Google Ads counts these events as conversions and spends our budget on the ads that bring them. Personalised advertising is off: nothing is used to build audiences or to show you ads. Legal basis: your consent (Art. 6(1)(a)).
Who receives it. Google (Google Ireland Limited, and Google LLC in the USA), through Firebase Analytics and Google Ads. How Google uses it: How Google uses information from sites or apps that use its services.
How long. Firebase Analytics keeps the events with the app ID for 2 months, the shortest it allows; after that only totals remain. The sign-ups that Google Ads counts as conversions of its ads are kept by Google under its own terms. None of it is stored on our servers.
Changing your mind. Settings → Ad measurement in the Android app turns it off at any time: the app stops sending and resets its Firebase app ID. What was already sent isn't undone. It also stops when you sign out: it runs only while the account that allowed it is signed in. Without it the app works just the same.
What our own server learns about the install. Separately from this question, and for everyone who signs in on the Android app, the app tells our server the shape of its install referrer: the names of its fields (such as utm_source or gclid), its source and medium (such as google-play / organic), whether the app took the install for an ad click, and your answer to the question. Never the ad click itself or any other value. We use it only to check that the question reaches the people it is meant for. Legal basis: our legitimate interest in making sure the app works as described here (Art. 6(1)(f)). It is kept with your account and erased when you delete it; none of it goes to Google.

How long we keep it

Your account and inventory: until you delete them.
Database backups, which our host makes every day: 7 days, after which deleted data is gone from them too.
Photos: originals for 5 years, after which only a small thumbnail stays.
Sign-in links and the IP address with them: 24 hours. The IP address an app registered from to connect an assistant: 24 hours.
Exports: the zip is deleted 7 days after it is made.
Ad measurement on Android, if you allowed it: 2 months in Firebase Analytics, conversions in Google Ads under Google's terms, nothing at ours.
After you delete your account: see below. Server logs, which hold no IP addresses and none of your content, are kept by our host for up to 90 days.

Your rights

You can get a copy of your data at any time: in the app, Settings → Your data → Export my data gives you a zip with everything in your households (as JSON) and your photos.

You can delete your account at any time: Settings → Your data → Delete account. You leave every household. A household you share stays with the others (if you were its only owner, another member becomes owner, an editor if there is one). A household nobody else is in is erased with its photos within an hour. Your email, Apple and Google account IDs and name are removed at once; what remains of your account is an anonymous ID so shared households keep working.

You also have the right to correct your data, to object to processing based on legitimate interest, and to restrict processing. Write to us through the contact form. You can complain to a data protection authority: ours is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), or the one where you live.

Children

Neatkept is not meant for children under 16, and we don't knowingly collect their data.

Changes

If we change this policy, we update the date above, and tell you in the app when the change matters.