🔐 KeepHold Privacy Policy

Last updated: 8 November 2026 · Previous version: October 2026 · KeepHold is published as Kasam in Türkiye; this policy covers both names.

Update of 8 November 2026: data controller and contact details added; ad networks and their countries named; legal bases, transfers abroad, retention and your rights (KVKK / GDPR) added; Android document scanning, the private browser's default search engine and the problem report explained; the personalized-ad consent screen of the current app version described (section 5); the single support address is now support@mfatihicin.com. A separate KVKK Information Notice is available.

KeepHold is a private vault for photos, videos, documents, notes and passwords. It was designed so that your vault content never has to leave your device. This policy explains what the app does and does not do with your data.

Data controller: Mehmet Fatih İçin (natural person, independent app developer, Türkiye) · E-mail: support@mfatihicin.com · Website: mfatihicin.com. KeepHold is developed and published by one individual, not by a company.

1. No account and no server for your vault

KeepHold does not require an account and we do not operate any server that receives your data. Your files, notes, passwords, search index, intruder records and browser data are never sent to us; we cannot see them. The app contains no analytics or crash-reporting SDK of its own. The only third-party SDKs that process data are the ad SDK in the free version (section 5) and the purchase SDK (RevenueCat, section 6).

2. Where your data lives and how it is protected

• All files, notes and passwords are stored only on your device, in the app's private storage that other apps cannot read. On Android the app is excluded from the system's automatic cloud backup.
• Files are encrypted with AES-256-GCM. The encryption key is a random key stored in the device's secure store (iOS Keychain / Android Keystore) and never leaves the device. Notes, passwords, the search index (including text recognised in images) and browser bookmarks/history are encrypted the same way.
• Your PIN, password or pattern is stored in the device's secure store. Face ID, Touch ID and fingerprint are verified by the operating system; the app never receives biometric data.
• If you create an optional recovery key, it is shown to you once and is kept on your device only in wrapped (encrypted) form. We cannot recover your PIN, your recovery key or your data.
• Decoy vault and extra vaults have their own keys and files on the device.

3. Optional features that use the network

None of these sends data to a server operated by us:

• Backups: Backups are written to a folder you choose as files encrypted with a password you set. On iPhone the default location (since version 1.2.6) is Kasam's folder in your own iCloud Drive; on Android you pick a folder (for example Google Drive or local storage). The cloud provider only sees encrypted data and holds it under your own account with them. Restoring requires that password.
• Password breach check: Uses the Have I Been Pwned "Pwned Passwords" k‑anonymity API (api.pwnedpasswords.com). Only the first five characters of a SHA‑1 hash of a password are sent; the password and its full hash never leave the device. It runs only when you start the check. The service sees your IP address, as any website does.
• Phone‑to‑phone transfer: Works only on your local network, directly between your devices; the content is encrypted with a session key derived from the code shown on screen. No internet server is involved.
• Wi‑Fi transfer with a computer: The phone opens a temporary page on your local network that is protected by a 6‑digit code shown on the phone. Files go directly between your computer and your phone over your local network; no internet server is involved. Use it only on a network you trust.
• Private browser: Pages you open are loaded directly from the websites you visit; the default search engine is DuckDuckGo, which receives the searches you type. Cookies and cache are kept only for the session; bookmarks, history (up to 500 entries) and open tabs are stored encrypted in the vault on your device. With tracking protection on, known ad/tracker domains are blocked and third-party cookies are off. We do not see what you browse; the websites you visit process data under their own policies.
• Timed share: Creates a password‑protected, expiring file on your device that you share yourself (for example by e‑mail). We do not host or see it.
• Document scanning and text recognition: On iPhone, Apple's on-device VisionKit/Vision frameworks are used. On Android, Google ML Kit (text recognition and the document scanner provided through Google Play services) runs on the device; scanned documents and images are not sent to Google. Google Play services may process general usage or diagnostic data under Google's own policies.
• Report a problem: Settings › Help › "Report a problem" prepares an e-mail draft to support@mfatihicin.com with the app version, device model, language, vault counts, backup/autofill status and the last lines of an on-device diagnostic log. File names, file contents and notes are not included, and text that looks like an e-mail address or password is masked. Nothing is sent unless you send the e-mail yourself.

4. Permissions the app may ask for

• Photos / media: to import the items you select into the vault and, if you choose, to delete the originals or export items back to the gallery.
• Camera: to take photos, record videos, scan documents and, if you turn on the intruder report (off by default), to take a front-camera photo on a wrong unlock attempt.
• Microphone: to record audio notes and the sound of videos recorded into the vault.
• Location (while using the app): only if you turn on location in the intruder report (off by default); the location is stored on the device with the attempt.
• Notifications: local notifications such as backup reminders and intruder alerts. No push server is used.
• Local network: for Wi‑Fi and phone‑to‑phone transfer.
• Autofill (system credential provider): if you turn it on, your saved logins are offered in other apps and browsers through the operating system. The records are kept in the app's encrypted store on the device.
• Tracking (iOS) / advertising ID (Android): see section 5.

Every permission is optional and can be revoked in the system settings.

Other people's data: An intruder photo and its location may show another person who tried to open your phone. These records stay only on your device and you are responsible for using them lawfully. We never receive them.

5. Advertising in the free version

The free version shows ads: a banner on some vault screens, an occasional full‑screen ad, and an optional rewarded ad that unlocks a 72‑hour Pro trial. Ads are delivered by Unity LevelPlay (ironSource) and the ad networks it mediates. For this purpose the ad SDKs may process your device's advertising identifier (IDFA on iOS, only if you allow tracking; Google advertising ID and App Set ID on Android), the vendor identifier (IDFV), device information (model, OS version, language), your IP address and approximate location derived from it, ad interactions and diagnostic data. Nothing from your vault (files, notes, passwords, search index, browser data) is ever available to the ad SDKs.

Recipients:

• Unity Technologies — Unity LevelPlay / ironSource mediation (including its ad-quality component): USA, Israel and other countries
• Unity Ads (Unity Technologies): USA
• Liftoff Monetize (Vungle): USA
• Yandex Mobile Ads (including AppMetrica components): Yandex group of companies; depending on the processing company, the Russian Federation, the UAE or other countries
• BIGO Ads: Singapore — its adapter is included in the app, but no ads are currently requested from this network; if it is enabled it may process the same data

Ad networks may also process data such as approximate location derived from your IP address under their own privacy policies, to serve and measure ads and prevent fraud. For this processing they act as independent controllers.

• Your choices (current version): Before the ad SDK starts, a consent screen is shown once to every user who does not have Pro (existing users see it once after updating). In the EU/EEA, the UK and Switzerland it is the GDPR consent dialog; everywhere else, including Türkiye and the US, it is a KVKK explicit-consent screen with two equal buttons, "I accept" and "I don't accept", and a link to the KVKK notice. US users who decline also opt out of the "sale/sharing" of personal information. Ads are personalized only if you accept. On iOS the system tracking prompt is shown only after you accept, and the IDFA is shared only if you also allow tracking there; if you decline, the tracking prompt is never shown. Declining (or making no choice) sends a "no consent / do not sell" signal to LevelPlay on iOS and Android, so ads are not personalized; basic device data needed to show an ad (such as the IP address) is still processed.
• Changing your mind: You can change or withdraw your decision at any time under Settings › Privacy & legal › Ad choices, which shows your current choice. You can also delete or reset the advertising ID in your device settings (Android: Settings › Privacy (or Google) › Ads; iOS: Settings › Privacy & Security › Tracking). Older app versions did not show the consent screen outside the EU/EEA, UK and Switzerland; there, too, "non-personalized" can be chosen under Ad choices.
• No ads at all: KeepHold Pro (and the 72-hour trial) removes ads; while Pro is active the ad SDK is not initialized and neither the consent screen nor the tracking prompt is shown.
• Policies: Unity · Liftoff · Yandex · BIGO Ads

6. In‑app purchase

KeepHold Pro is a one‑time purchase processed by Apple App Store or Google Play. We do not receive or store payment details. Purchase entitlements are validated through RevenueCat, Inc. (USA), which receives an anonymous app user ID, the store receipt/purchase history, your IP address and basic device information; it never sees vault content. The purchase is tied to your store account and can be restored from the app. Apple and Google process your purchase as independent controllers under their own policies.

7. Purposes and legal bases

• Verifying and restoring your purchase, answering your support e-mails: performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Showing non-personalized ads that fund the free version, ad-fraud prevention, security: legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Personalized ads: your consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)), given on the in-app consent screen (and, on iOS, the system tracking permission) or later under Ad choices, and withdrawable at any time (see section 5).
• Keeping records of privacy requests, legal claims: legal obligation and establishing/defending rights (KVKK Art. 5/2-ç and 5/2-e).

Data that stays only on your device (your vault) is not processed by us. We do not sell your data and we do not make automated decisions about you.

8. Transfers abroad

Our service providers' servers are outside Türkiye, so transferring the data listed above to countries such as the USA, Israel, the Russian Federation/UAE and Singapore is technically necessary for the free version and purchases to work. The Turkish Personal Data Protection Board has not issued an adequacy decision for these countries. These transfers fall under Article 9 of Law No. 6698 (KVKK). As of today, no KVKK standard contract has been signed with these providers and notified to the Authority; for these transfers we rely on the data-protection commitments in the providers' own terms (data processing agreements and the technical and organisational security measures based on them). We are asking the providers to sign the standard contract published by the Board under Article 9; if one is signed, it will be notified to the Authority within 5 business days as the law requires, and this policy will be updated. We try to keep the transferred data to the minimum the service needs. For users in the EU/EEA, transfers rely on the safeguards offered by the providers, such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Pro users avoid the ad-related transfers entirely.

9. Retention

• Vault content, intruder records, browser data: on your device until you delete them or the app. Items in the trash are deleted automatically after 30 days.
• Backups: in the folder you chose, until you delete them; they are not deleted when you uninstall the app.
• E-mails you send us (support, problem reports, data requests): as long as needed to answer; privacy requests and our replies are kept for 3 years as proof.
• Ad networks, RevenueCat, Apple and Google: under their own retention policies. RevenueCat keeps the purchase record to restore your purchase.

10. Children's privacy

KeepHold is for a general audience; it is not directed to children under 13 and is not listed in the stores' children's categories ("Kids", "Families"); its target audience on Google Play is 18+. If you are under 18, please use the app with the knowledge and supervision of a parent or guardian; for purchases we recommend the stores' parental controls (Apple "Ask to Buy", Google Play parental controls). If we learn that we process data of a child under 13, we will delete it. Parents who believe their child has shared data can write to support@mfatihicin.com.

11. Data deletion

Because your vault is on your device, you control it completely: delete individual items, use "Delete all data" in Settings, or uninstall the app. Uninstalling removes the vault and its keys permanently. Backups you saved to your own cloud folder remain under your control. To reset the advertising ID, use your device settings (section 5). For anything we hold (e-mails) or the RevenueCat purchase record, write to us; because the RevenueCat ID is anonymous, we may need the store order number to find it.

12. Your rights

Under Article 11 of the KVKK you have the right to: learn whether your personal data is processed and, if so, request information about it; learn the purpose of processing and whether data is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; ask for incomplete or inaccurate data to be corrected, for data to be erased or destroyed under Article 7, and for these actions to be notified to the third parties it was transferred to; object to a result against you arising solely from automated analysis; and claim compensation if you suffer damage because of unlawful processing. Under the GDPR you also have the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent. California residents: if you choose non-personalized ads, we pass a "do not sell or share" signal to our ad partner.

• In the app: Settings › Privacy & legal › "Contact about my data" (in current app versions).
• E-mail: support@mfatihicin.com

We answer within 30 days, free of charge. If your request is refused, you find our answer insufficient or we do not answer in time, you may complain to the Turkish Personal Data Protection Board (KVKK Art. 14). People in the EU/EEA may also complain to their local data protection authority. Details: KVKK Information Notice.

13. Security incidents

We do not hold your vault, so a breach on our side cannot expose it. If we ever learn of a data breach affecting data we process, we will notify the Turkish Personal Data Protection Board within 72 hours and inform affected people as soon as reasonably possible.

14. Changes

If this policy changes, the new version will be published on this page with an updated date; significant changes will also be mentioned in the app.

15. Contact

Mehmet Fatih İçin · support@mfatihicin.com · Help Center