Everything stays on your device.
Kepto is a privacy-first warranty and receipt tracker. We built it so that nothing about you, your receipts, your documents, or your purchases is ever sent to us, on iPhone or on Android. Your data lives on your device and only goes where you send it: your own iCloud or Google account if you keep sync or backup on, or a file you choose to share.
- We collect nothing. Kepto has no analytics, ads, tracking, accounts or servers of ours.
- Your receipts, photos and documents stay on your device. Sync and backup go only to your own iCloud or Google account, and you can turn them off.
- Receipt scanning and AI parsing run entirely on your phone.
- Vault documents are encrypted on your device and never synced or backed up, so they can't be recovered if you lose the phone.
- Purchases are handled by Apple or Google. We never see your payment details.
A summary for convenience. The full text below is what applies.
Data we collect
On iPhoneNone. Kepto has no analytics, advertising, crash reporting, or tracking SDKs. We have no servers that receive data from the app, and there are no accounts; the app works without you identifying yourself.
On AndroidNone. The same applies. The Android app also requests no internet permission, so it cannot send anything off your device by itself.
Where your data is stored
On iPhone- Your receipts, photos, warranty records, subscriptions, and settings are stored on your device.
- iCloud Sync is on by default, so a reinstall or a new iPhone or iPad on the same Apple ID gets your receipts back. Your items, receipt photos, custom categories, subscriptions, and the labels of vault documents sync through your own private iCloud database. Turn it off any time in Settings, Sync & Backup, where Kepto also shows when it last synced.
- Apple's privacy terms apply to iCloud. Retriever Labs has no access to your iCloud data.
- Your data is stored on your device.
- Back up to Google is on by default. Kepto uses Android's Auto Backup to copy its data to your own Google account, so it comes back when you reinstall Kepto or set up a new phone. The backup holds your items, subscriptions, custom categories, settings, and as many receipt photos as fit Google's backup size limit, newest first. It is backup and restore, not continuous sync. Turn it off any time in Settings, Backup.
- Google's privacy terms apply to that backup. Retriever Labs has no access to it.
Manual backup files
You can export every receipt, every photo, every subscription, and every custom category to a single .json file from Settings. You choose where it goes: Files, iCloud Drive, Google Drive, email, AirDrop, or anywhere else your phone lets you share. Retriever Labs never sees the file. Restoring from a file merges by ID and never overwrites what is already on your device. Vault documents are not included in this file.
On-device AI receipt parsing
On iPhone- On iPhone 15 Pro and newer (and Apple silicon iPads), with Apple Intelligence turned on, Kepto uses Apple's on-device Foundation Models framework to read the fields on your receipt.
- The image, the recognised text, and the extracted fields are processed entirely on your device. Nothing is sent to Apple, to Retriever Labs, or to anyone else.
- If Apple Intelligence is off or unavailable, Kepto uses its own on-device parser instead.
- On supported devices (for example Pixel 8 Pro and newer, or Galaxy S24 and newer), Kepto uses Google AI Edge (AICore and Gemini Nano) to read your receipt on the device, with no network and no API key. Other devices use Kepto's own on-device parser.
- Either way, the image, the recognised text, and the extracted fields stay on your device.
On-device receipt text recognition
On iPhoneReceipt photos are read on your device by Apple's Vision framework. The image never leaves your phone.
On AndroidReceipt photos are read on your device by Google's ML Kit Text Recognition, using a model built into the app. The image never leaves your phone.
Document Vault
The optional Document Vault keeps scans of personal documents such as passports, driver licences, ID cards, and insurance or health cards inside Kepto, on iPhone and on Android.
- Encrypted on your device. Each page is encrypted on your device with AES-256. The key is created on the device and kept in the iOS Keychain for this device only (iPhone) or in the Android Keystore (Android). It never leaves the device and is not part of any backup.
- Locked when you open it. Opening the vault needs Face ID, Touch ID, or your device passcode on iPhone (or your App Lock, if you use it), and your fingerprint, face, or screen lock on Android.
- Scans never sync or back up. The scans are left out of iCloud, Android Auto Backup, and the manual backup file. A document's label, type, and expiry date can travel with your other data: through iCloud Sync on iPhone, and in your Google backup on Android. Another device can't open those documents, because the scans exist only on the device that made them, so Kepto hides them there (iPhone) or marks them as not on this device (Android).
- Never sent to us. Vault documents are never transmitted to Retriever Labs. We have no servers that could receive them.
- Not recoverable. Because the key lives only on your device, if you lose, reset, or replace your phone, or delete Kepto, the documents in your vault are gone, and neither you nor we can recover them. Keep your own separate copy of anything you cannot afford to lose.
- Exporting. You can export a document as a JPEG or PDF through the share sheet. That copy leaves Kepto's encryption and is handled by wherever you send it. On iPhone, Kepto deletes its own temporary copy once sharing finishes.
App Lock and biometrics
On iPhone- App Lock uses a PIN you set, with Face ID or Touch ID as a shortcut. The PIN is stored only as a salted hash in the iOS Keychain, never as plain text.
- After five wrong PINs in a row, PIN entry pauses for a while, longer after each further miss. Face ID, Touch ID, and your device passcode still work during a pause.
- App Lock and the vault unlock with your device's fingerprint, face, PIN, pattern, or password, handled entirely by Android.
On both platforms, biometrics are handled by the operating system. Kepto only receives a yes or no answer and never sees or stores your biometric data. If your device has no passcode or screen lock, App Lock and the vault stay locked until you set one.
Permissions we request
On iPhone- Camera: only when you scan a receipt or a vault document.
- Face ID: only to unlock App Lock and the vault.
- Add to Photos: only when you choose to save a receipt photo to your photo library. Picking a photo uses Apple's system picker, which gives Kepto only the photo you choose.
- Notifications: only with your permission, for warranty, service, subscription renewal, and free trial reminders.
- Camera: only when you scan a receipt or a vault document.
- Notifications (Android 13 and newer): optional, for warranty, service, subscription renewal, and free trial reminders.
- Biometrics: to unlock App Lock and the vault with your fingerprint or face.
- Photos: Kepto uses Android's system photo picker, so it receives only the images you choose and has no gallery or storage access.
- Kepto requests no internet permission.
In-app purchases
On iPhoneThe Kepto+ one-time unlock is handled by Apple's App Store (StoreKit). Apple tells Kepto only whether you own it, with a transaction ID. Retriever Labs never sees your Apple ID, payment method, or location.
On AndroidThe Kepto+ one-time unlock is handled by Google Play Billing. Google tells Kepto only whether you own it, with an order ID. Retriever Labs never sees your Google account, payment method, or location.
Apple and Google components
Kepto uses no third-party SDKs beyond the platform components below, and none of them sends your receipts, photos, or documents anywhere.
- iPhone: Apple's Vision, VisionKit (document scanner), Foundation Models, CryptoKit, Local Authentication, StoreKit, and CloudKit (for iCloud Sync, when it is on).
- Android: Google ML Kit Text Recognition (built into the app), the ML Kit document scanner (provided by Google Play services and run on your device), Google AI Edge (AICore), AndroidX Biometric, and Google Play Billing.
Android versions released before October 2026 also allowed Google's ML Kit to send anonymous usage metrics about text recognition to Google. These never included receipt images or text. Current versions request no internet permission, so this no longer happens.
Children
Kepto is not directed at children under 13 and does not knowingly collect data from anyone.
Changes to this policy
We will update this page if anything changes, and move the effective date at the top.
Contact
For questions or to exercise your data rights, contact us via kepto.com.au/support.
This document describes how Kepto handles your information. It is provided for transparency and is not legal advice.