The legal version is below. This is the version written to be read.
Keel does not host, link to, transmit, or classify any adult content. It cannot see what you looked at, and no part of the product is built to. What it records is how many times, when, and the line you set. If you add a note, it records that too.
That is not a position we could quietly reverse next year. It is the argument that keeps Keel on the app stores and on the payment rails.
The numbers you enter, the figures the app derives from them, an email address, and an account identifier.
If a field is not needed to draw the Band or to bill your account, it is not collected. There is no behavioural analytics package, no session replay, and no font loaded from anyone else’s server.
Keel is run by Vermilion Inc, a Florida company with an office in New York, and your data is processed in the United States. We treat everything in your account as sensitive data whether or not the law where you live requires it, including the parts that on their own would not be.
The site runs on Vercel and your data sits in Supabase, both in the United States. Some of it may be handled elsewhere, and where that happens the protections your country gives it may be weaker.
You pay Apple or Google, not us. We never see your card.
The charge comes from Apple or Google, so the wording on your statement is theirs and not ours. Neither names the category.
For as long as you have an account. Delete it and everything goes in one action, and we confirm by email.
Deletion takes 30 days to clear our live systems once we have checked it is you. After that we keep only what the law, tax, security or an open dispute obliges us to.
Backups are the honest exception. Deleted data can sit in encrypted backups for up to 90 more days before they are overwritten. We cannot reach into a backup to remove one account, and we are not going to claim otherwise.
Biometric lock is on by default, not something you have to find. You can change the app’s name and icon at first run. Notifications never name the category — the text is “Keel — your week is ready.”
Settings, then Delete everything. It cannot be undone, and we will not ask you why.
Your privacy is of the utmost importance to us. This Privacy Policy explains how Vermilion Inc (operating the Keel brand) and our subsidiaries and affiliates (together, "Keel," "we," "us," or "our") collect, use, disclose, and protect information about you when you access or use our websites (including keelapp.co), mobile applications, and other online products and services (collectively, the "Services"), and when you contact our customer support team, engage with us on social media, or otherwise interact with us.
Keel is a self-command instrument that allows adult users to set and track their own personal limits. We do not provide clinical diagnosis, treatment, or therapy. We do not host, link to, transmit, or process any adult content. Certain of our products or features may be subject to a separate privacy notice if they link to one.
Additional information for California residents and for individuals in the European Economic Area (EEA), United Kingdom, and Switzerland appears at the end of this Privacy Policy.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. In some cases we will provide additional notice (for example, by email or in-app notice). Your continued use of the Services after the effective date of any changes constitutes acceptance of the updated Policy.
We collect information you voluntarily provide when you:
This information may include:
We do not require or collect information about sexual orientation, religious beliefs, or medical diagnoses. We do not infer health-related characteristics from the data you provide.
When you use the Services we automatically collect:
We do not receive or process data from Apple HealthKit, Google Health Connect, or similar health platforms. We do not collect or store adult-content consumption data from external sources.
We use the information we collect for the following purposes and under the following legal bases (where required by applicable law):
We do not use your data to:
We disclose information only as described below and as otherwise permitted or required by law:
We do not sell personal information. We do not share personal information for cross-context behavioral advertising in a way that constitutes a "sale" or "share" under the CCPA/CPRA without providing opt-out rights. We do not disclose limit-adherence or deviation data to partners, family members, or third parties for monitoring or accountability purposes. Partner-visibility or accountability-partner features are permanently prohibited by our brand and product rules.
We may disclose aggregated or de-identified information that cannot reasonably identify you.
We may use third-party analytics and advertising partners. These partners may use cookies, device identifiers, and similar technologies to collect information about your use of the Services and other sites/apps for analytics and (where permitted) advertising.
Because of the nature of our product category, we apply heightened restrictions: we do not permit partners to use data derived from limit-setting, adherence, or deviation events for interest-based advertising of adult or recovery-related products. Cold acquisition creative never names the category in the first line, consistent with platform policies and our positioning.
You can control cookies and similar technologies through your browser settings, our cookie preference tools (where available), device-level advertising settings (iOS: Settings → Privacy & Security → Tracking; Android: Settings → Google → Ads), and industry opt-out tools (aboutads.info/choices or youronlinechoices.eu). We honor Global Privacy Control (GPC) signals where required.
Vermilion Inc is a Florida corporation with operations in the United States (including an office at 347 5th Ave Rm 1307, New York, NY 10016-5015). Information is processed in the United States and may be processed in other countries that may not provide the same level of data protection as your home jurisdiction. Where required by law (including for transfers from the EEA, UK, or Switzerland), we implement appropriate safeguards such as Standard Contractual Clauses or rely on adequacy decisions. You may request a copy of relevant safeguards by contacting support@keelapp.co.
We retain personal information only as long as necessary for the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce our agreements.
Active accounts: Personal information is retained for the life of the account.
Account deletion requests: When you request deletion of your account, we will delete or de-identify your personal information from our primary systems within thirty (30) days of verifying the request, except where we are required to retain specific data longer for legal, tax, accounting, security, fraud-prevention, or dispute-resolution purposes.
Backups: Deleted or de-identified data may remain in encrypted backups for up to ninety (90) days after deletion from primary systems. These backups are used solely for disaster recovery and are overwritten or destroyed in the ordinary course of business after that period. We do not restore deleted user data from backups except as required by law or to address a verified security incident.
You may request deletion as described in the “Exercising Your Rights” section below.
Subject to applicable law and certain limitations, you have the right to:
California residents also have the rights described in the California-specific section below.
EEA, UK, and Swiss residents have the additional rights described in the Europe-specific section below.
To exercise any of the rights above, email us at support@keelapp.co or use any in-app or website tools we provide. We will not discriminate against you for exercising your rights.
We may need to verify your identity before responding (for example, by confirming control of the email address associated with your account). You may designate an authorized agent; we may require proof of authorization and may still verify your identity directly.
If we deny your request you may appeal by emailing support@keelapp.co. California residents may also contact the California Attorney General or the California Privacy Protection Agency.
In the preceding 12 months we have collected the categories of personal information described in the "Collection of Information" section above (identifiers, commercial information, internet/electronic activity, approximate geolocation, and inferences drawn from the foregoing). We collect this information from you, your devices, and the third-party sources listed above.
We use this information for the business and commercial purposes described in the "Use of Information" section. We disclose it to the categories of service providers and other parties listed in the "Disclosures of Information" section.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising in a manner that requires a "Do Not Sell or Share My Personal Information" link beyond the opt-out mechanisms already described. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.
We retain personal information only as long as reasonably necessary for the purposes disclosed (see Section 6 for specific timelines). You have the rights listed in Section 7 and may exercise them as described in Section 8. We will not discriminate against you for exercising these rights.
Notice of Financial Incentives: We do not currently offer financial incentives that involve the collection of personal information in exchange for a financial benefit in a manner that requires additional notice under the CPRA. If that changes we will update this Policy.
If you are located in the EEA, Switzerland, or the United Kingdom, Vermilion Inc is the data controller for personal data processed under this Privacy Policy.
Legal bases are as described in the "Use of Information" section (primarily performance of contract, legitimate interests, and, where required, consent).
In addition to the rights listed in Section 7 you have the right to:
You may exercise these rights by contacting support@keelapp.co.
EEA supervisory authorities: https://edpb.europa.eu/about-edpb/board/members_en
Switzerland: Federal Data Protection and Information Commissioner — https://www.edoeb.admin.ch
The Services are intended solely for adults (18+ / age of majority in the relevant jurisdiction). We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child we will delete it. If you believe we have collected information from a child, contact support@keelapp.co immediately.
We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.
If you have questions about this Privacy Policy or our privacy practices, contact us at:
Email: support@keelapp.co
Postal:
Vermilion Inc
347 5th Ave Rm 1307
New York, NY 10016-5015
United States
For privacy-specific requests, please use the subject line "Privacy Request."
This Privacy Policy is designed to reflect Keel's actual product posture: user-set limits, measurement without verdict, a genuine off-ramp for users in crisis, zero adult-content handling, and a deliberate refusal to turn self-command data into shame or surveillance. It is written to be defensible under U.S. state privacy laws (including California), GDPR/UK GDPR, and platform requirements while remaining consistent with the brand's core positioning ("Command, not cure").