Privacy policy

Version 1.0 · Effective [legal.effectiveDate pending]

This policy has two clearly separate parts. The app keeps your data on your own devices and sends nothing to us or to anyone else. The website, the checkout, the community site and our contact forms do handle some personal data, because we cannot sell you a product or answer a message without it. Both parts are explained below.

Who is responsible

Synonyms Solutions, Israel, is responsible for the personal data described here ("we", "us"). For anything about privacy, write to privacy@keeprhythm.app or use privacy requests.

The app: everything stays on your devices

KeepRhythm has no account, no sign-in, no analytics, no advertising and no tracking. The app does not send your habits, tasks, notes, settings or any other data to us or to anyone else. This applies to the desktop app (Windows, macOS) and the phone and tablet apps (iPhone, iPad, Android).

• Where your data lives. Only on your own devices, in the app's data folder: on Windows %APPDATA%\app.keeprhythm, on macOS ~/Library/Application Support/app.keeprhythm, and on phones and tablets in the app's private storage. The app keeps automatic backups in the same place, on the same device.
• Exports. When you export (JSON or Excel), the file is written to your Documents folder on a computer, to the app's folder in the Files app on iPhone and iPad, or handed to the Android share sheet. It goes only where you choose to send it.
• No internet access. The app's window is locked by a content security policy that allows connections only to the app itself (connect-src 'self' ipc: http://ipc.localhost). It cannot reach the internet. It has no update checker, crash reporter or "phone home" of any kind. You can confirm this yourself: disconnect from the internet, and it works exactly the same.
• Wi-Fi sync between your own devices. If you pair your devices (for example your phone and your computer), they sync your data directly with each other over your local Wi-Fi network. There is no server in between: nothing passes through us or any cloud service. Pairing needs an 8-digit code shown on one of your devices, and every connection between paired devices is encrypted end to end. Devices that are not paired receive no data.
• What your local network sees. So that your devices can find each other, the app announces itself on your local network (Bonjour/mDNS) while it is open, once it holds data: the app's name, a random device ID, the device name shown in Settings → Devices (you can change it), and whether it is waiting for a pairing code. Other devices on the same Wi-Fi can see these announcements, but not your data. Your phone or computer may ask once for permission to use the local network; if you refuse, sync is off and everything else works.
• Deleting your data. Uninstall the app and, on a computer, delete the data folder above. That removes everything on that device. Remove a paired device in Settings → Devices to stop syncing with it; data already synced stays on each device until you delete it there.
• We cannot see it. We cannot see, recover or delete your app data, because we never have it. Keep your own backups (see terms).

Your operating system and its built-in components (for example the Microsoft Edge WebView2 runtime on Windows, or Apple's Gatekeeper checks on macOS) may contact their makers for updates and security checks. That happens under Microsoft's or Apple's privacy terms, is not controlled by the app and does not include your KeepRhythm data.

If we ever add a feature that uses the network (for example an update check or an in-app template browser), we will update this policy before releasing it, and the feature will be described here.

The workbooks

The KeepRhythm workbooks are ordinary spreadsheet files. We do not put macros, trackers or links to outside data in them. What you type into them stays in the file. If you open them in Google Sheets, Microsoft 365 or another cloud service, that service's privacy policy applies to the copy you upload.

This website

The website is a set of static pages. It sets no cookies, uses no analytics or advertising trackers, and loads no third-party fonts. Like every website, our hosting provider receives technical data when you visit (IP address, browser type, the page requested and the time) to deliver the page and protect the service. These server logs are kept for up to 30 days.

Checkout script. When checkout is open, the pages with a buy button (the home and pricing pages) load a small script from Lemon Squeezy (assets.lemonsqueezy.com) that shows the secure checkout window over the page. No other page loads it. Loading it lets Lemon Squeezy receive the technical data any website receives (such as your IP address and browser type) and may set the cookies its checkout needs to work. Its own privacy policy applies to that. The checkout link tells Lemon Squeezy only that you came from this website, which page you started on and, if you used one, a discount code; it never carries your name, email or other personal data. After payment you return to a thank-you page on this website that collects nothing.

Your purchase

Lemon Squeezy sells KeepRhythm to you as our reseller and merchant of record. It collects and processes your name, email address, billing country and address, and payment details to take your payment, charge tax, prevent fraud, send your receipt, deliver your download links and issue your license key. We never see your full card or bank details.

From Lemon Squeezy we receive your name, email address, country, what you bought, the price and tax paid, your order number and your license key status. We use this to deliver your purchase, answer your questions about it, help with lost downloads and keys, keep accounting and tax records, and confirm that you are a buyer when you join the community site.

Legal basis (where GDPR applies): performing our contract with you, and our legal obligations for tax and accounting records.

The community site

The KeepRhythm Community at https://community.keeprhythm.app is a separate site for buyers. If you join, we store:

• your email address, used to sign you in with a one-time email link (we store no passwords);
• the result of a license key check with Lemon Squeezy, confirming that you bought KeepRhythm (the key itself is checked, not shown to anyone);
• your display name;
• what you post, upload, vote on or report, with the date.

Your display name, your posts and the templates you publish are public. Your email address is never shown. Do not put personal information in posts or templates; templates are checked and stripped of history and notes before publishing, but you are responsible for what you share.

The community site uses only the cookies it needs to keep you signed in. It does not use analytics or advertising trackers.

You can delete your posts and your account at any time from your profile, or by writing to privacy@keeprhythm.app. Templates you shared under the template license may remain in copies other buyers already downloaded.

Legal basis (where GDPR applies): performing our agreement with you (providing the community), and our legitimate interest in keeping it safe and free of spam.

Contact messages

When you write to us by email or through a contact form, we receive what you send: usually your name, email address and message, and, depending on the topic, your order number, operating system, app version, a link, or a template file. We use it only to answer you and to handle your request (for example, to put a suggestion on the community board as a draft or a template in the review queue, which you asked us to do).

To keep spam out without third-party CAPTCHA tracking, the forms include a hidden field that people leave empty and record when the form was opened. Our contact service also records your IP address to limit how many messages can be sent in a short time; these records are deleted after 30 days.

Legal basis (where GDPR applies): our legitimate interest in answering you, or taking steps you asked for before or under a contract.

How long we keep data

• Orders, invoices and tax records: 7 years after the end of the tax year of the order, as tax and accounting law requires.
• Contact messages: up to 24 months after the conversation ends, then deleted.
• Community account and posts: until you delete your account, or 24 months after your last sign-in. Moderation records about removed content may be kept for up to 24 months.
• Server and rate-limit logs: up to 30 days.

What we never do

• We do not sell or rent personal data, and we do not share it for advertising.
• We do not use advertising trackers, tracking pixels or analytics that follow you across sites.
• We do not use your data to train AI models or build profiles about you.

Who processes data for us

We use a small number of service providers. Each receives only what it needs for its task:

• Lemon Squeezy: Reseller and merchant of record: checkout, payment, tax, receipts, download links and license keys. Data: name, email, billing address and country, payment details, order and license records, IP address at checkout. Location: United States. Privacy policy.
• Cloudflare, Inc.: Website hosting. Data: IP address, browser type and pages requested, in short-lived server logs. Location: United States (global network). Privacy policy.
• [p.name pending]: Email forwarding and mailbox for our contact addresses. Data: the emails you send us and our replies.
• Cloudflare, Inc.: Community site and contact form hosting, database and file storage. Data: community accounts, posts, templates, contact form messages and rate-limit logs. Location: United States (global network). Privacy policy.

Some of these providers are located outside Israel and outside the European Economic Area, mainly in the United States. Where the law requires it, we rely on adequacy decisions or standard contractual clauses for these transfers. We may also disclose data where the law requires it.

Your rights

Under the Israeli Privacy Protection Law, 5741-1981, you may ask to see the personal data we hold about you and ask us to correct or delete it. If you are in the European Union or the United Kingdom, the GDPR (or UK GDPR) also gives you the rights to access, correct, delete, restrict or object to processing of your data, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

To use any of these rights, write to privacy@keeprhythm.app or use privacy requests. We answer within 30 days. We may ask you to confirm your identity, for example by writing from the email address you used to buy.

You can also complain to a data protection authority: in Israel, the Privacy Protection Authority; in the EU, the authority of your country; in the UK, the Information Commissioner's Office. We would appreciate the chance to sort it out with you first.

Security

We keep the data we hold to a minimum and protect it with encrypted connections (HTTPS), access limited to the owner of KeepRhythm, and providers that meet recognised security standards. No system is perfectly secure; if a breach affecting your data happens, we will tell you and the authorities where the law requires.

Children

KeepRhythm, this website and the community site are not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, write to privacy@keeprhythm.app and we will delete it.

Changes to this policy

We will update this policy when what we do with data changes, for example before any feature that uses the internet is added to the app. The version and effective date are shown at the top. If a change is significant, we will say so on this page and on the community site before it takes effect.

Contact

Privacy questions and requests: privacy@keeprhythm.app or privacy requests.