Privacy Policy

Last updated: 2026-11-02

What this site does

convokeep turns a chat export file into a PDF. Everything happens in your browser. Your chat file, the messages in it and the PDF are never uploaded to us or to anyone else. We have no accounts and no database of your content. We do not store your chats, and we do not use them to train any AI model.

Who is responsible

convokeep is run by the business named on the seller information page (trade name, representative and address; registration numbers are added there once the registration is complete). Contact for every privacy question and request: support@convokeep.com.

Privacy officer (Korea, PIPA art. 31): Leon Lee, support@convokeep.com.

EU/UK representative: none appointed. Brazil data protection contact (encarregado): the same email address.

Purchases and use are for people aged 18 or older. We do not knowingly collect data from anyone under 18.

What we collect

"Legitimate interest" means running and securing a small service; "contract" means giving you what you bought.

| Data | Why | Legal basis | Who handles it | |---|---|---|---| | IP address, browser type, page requested, time (every web request) | Deliver and protect the site | Legitimate interest | Cloudflare (Pages hosting). We keep no application logs; Cloudflare may keep technical request logs under its own policy | | Page, referrer, country, browser type, timings (no cookies, no query strings) | Count page views | Legitimate interest | Cloudflare Web Analytics, unsampled for about 7 days, then aggregated | | Usage events (listed below) with no profile | See which steps work | Legitimate interest | PostHog (US cloud, us.i.posthog.com) | | License key and a random browser install ID | Check your license and the device limit | Contract | Our function at /api/entitlement and Polar | | License records we keep (below) | Day Pass window, device limit, abuse limits | Contract; legitimate interest | Cloudflare D1 database (Asia-Pacific region) | | Email address and message of anyone who writes to us | Answer you | Consent (you wrote to us); legitimate interest | Cloudflare Email Routing, then our Google (Gmail) mailbox | | Product, amount and currency of each sale or refund | Tell the operator about a sale | Legitimate interest | Telegram (bot message to the operator); no buyer name, email or country | | Hugging Face model download (only if you turn on transcription or semantic search) | Get the model | Your request | Hugging Face and its CDN see your IP address; no chat text leaves your browser |

Usage events (all of them). We use PostHog in cookieless mode and send only these events, nothing else:

• page_view: no properties.
• file_loaded: messenger (for example whatsapp, kakaotalk) and source (drop, picker, paste or share).
• export_help_opened: messenger.
• time_to_preview: milliseconds (rounded down to whole seconds) and source.
• preview_rendered: no properties.
• preview_downloaded: mode (record, keepsake or bundle) and pages (a number from 2 to 4).
• checkout_started: plan (daypass or perpetual; perpetual is the code name of the Lifetime license).
• export_completed: mode (keepsake or record).
• pwa_installed: no properties (counted once when you install convokeep to your home screen).
• start_clicked, sample_tried, sample_to_start, demo_video_played, ai_interest_clicked, pin_added: no properties.
• wizard_step_viewed, wizard_step_completed, wizard_abandoned: step (a number from 1 to 4).
• purpose_selected: category only, and only one of three values: evidence, keepsake or skipped. The situation you pick (for example a custody, scam or workplace dispute) is never sent; every dispute-type choice is reported as "evidence". It is a button choice, never free text.
• suggested_search_used: category (evidence, keepsake or skipped) and chip_index (a number from 0 to 3).
• find_used: kind (keyword or semantic).
• bundle_exported: exhibits, a range only (1, 2-5, 6-10 or 11+).

These events carry no content and no free text: no message text, names, file names, file contents or anything you type. Our code passes only a fixed list of values. We do not identify visitors, record sessions or use autocapture. The PostHog project is set to discard visitor IP addresses (checked by the project owner on 2026-10-27); PostHog's servers still receive the IP address while handling each request. PostHog keeps its state in memory only, so it sets no cookies and stores nothing on your device. The offline version sends nothing.

License records we keep. For each activated key: a one-way (peppered SHA-256) hash of the key, the time of first activation and the number of devices. For abuse limits: a peppered hash of your IP address with hit counts, deleted once older than 24 hours, by the next new window or the weekly automatic job, so within 8 days at most. For duplicate suppression of payment webhooks we keep a webhook ID for up to 7 days. We do not keep your key in readable form on our servers, and we keep no chat content.

Hosting

The site is hosted on Cloudflare Pages. Like any web host, Cloudflare receives your IP address and request details when you load a page, and handles them under its own privacy policy. We also use Cloudflare Web Analytics, which Cloudflare adds to the site. It is cookieless and counts aggregate page views and basic technical data such as page, referrer, country and browser type. It sets no cookies, stores nothing on your device and sees no chat content. Cloudflare acts as our processor for this and handles the data under its own privacy policy.

Payments

Payments are handled by Polar, which acts as merchant of record and sells to you. Polar collects your payment details, email, billing and tax data, and keeps the license key and device activation records for the license check; we never see card data. See Polar's policy: https://polar.sh/legal/privacy

Payment notifications

A signed sale/refund webhook sends product, amount and currency to the operator through Telegram, never chat content, buyer names, email or country. For duplicate suppression, delivery identifiers may be retained for up to 7 days; webhook payloads are not stored. The function may also read order metadata from the payment provider API to calculate optional running totals.

Support email

Do not send chat files or message text to support. Emails reach us through Cloudflare Email Routing and are read in Google Gmail (US). We keep them for at most 24 months, except where we need them to handle a dispute.

License key

Activation sends only the license key and a random browser install ID (not a fingerprint) to /api/entitlement and our payment provider. The provider retains activation records to enforce the 3-device limit of the Lifetime license. Our function reads product and purchase dates and returns an Ed25519 signed token without storing the key or logging customer data. Your browser keeps a random install ID and the signed token (plan, dates, SHA-256 key hash). To let you manage licensed devices, it also keeps your license key and device activation ID (instanceId) in plaintext in localStorage (convokeep.license-device) until you remove the license in the License panel or clear browser data. Later verification works offline. Clearing browser data removes this record and creates a new install; contact support to move a device activation. Saved offline tokens can still be imported; copying one is not a new provider activation.

Browser storage

We set no cookies, and neither do PostHog or Cloudflare Web Analytics on this site. The payment provider's own pages may set their own. To make the service work, convokeep stores in your browser: the license data described above, your settings (mode, paper size, theme), the current step of the wizard (until you close the tab) and any AI models you chose to download. None of it contains chat content, and clearing this site's data removes it. If you pick a language in the selector, your browser remembers that choice in localStorage (convokeep.lang) so the site opens in it next time. It stays on your device, is never sent anywhere and can be removed by clearing site data. If you install convokeep to your home screen, we count the install (one event, no other details). The offline copy your browser keeps holds only the app's own files, never your chats or PDFs, and you can remove it by clearing site data.

After the app loads online, a service worker saves only the app resources needed for PDF export in your browser's Cache Storage (convokeep-export-<build hash>): code, PDF fonts, bundled synthetic samples and the preview illustration. It never saves your chat files, messages, attachments, redactions, searches, generated PDFs or license data in this cache. Old export caches are removed when a newer version activates; your browser may evict cached resources, and you can clear them by clearing this site's data.

Voice transcription model

If you use transcription, the model weights are downloaded from Hugging Face (huggingface.co and its CDN) and cached by your browser. The download exposes your IP address to Hugging Face and its CDN. Audio never leaves the browser.

Semantic-search model

If you choose Download and enable for semantic search, the model is downloaded from Hugging Face (huggingface.co and *.hf.co, the same hosts used for voice transcription). Your IP address is visible to Hugging Face and its CDN during the download. The model is cached in your browser. No chat text is sent; semantic search runs in your browser.

No training, no chat storage

Your chat is processed only inside your browser tab. We do not receive it, store it, or use it to train a model, and we send it to no AI service. Please do not put sensitive or identifying data into support emails.

Where your data goes (overseas transfers)

Data leaves your device only in the cases above. Our providers are outside Korea (mostly in the United States). Each row lists what is passed, why, and for how long.

| Recipient and role | Data | Country | Purpose and when | Kept for | |---|---|---|---|---| | Cloudflare, Inc. (hosting, database, email routing, web analytics; processor) | Request data, aggregate analytics, license records, support email in transit | United States and the Cloudflare edge worldwide; database in Asia-Pacific | Hosting and security; on every page load or license check | Request logs under Cloudflare's policy; database rows as in "How long we keep data" | | PostHog, Inc. (usage counts; processor) | The events above, IP address not stored | United States | Usage statistics; when you use the site, over the network | Under the retention setting of our PostHog plan; events hold no content | | Polar (merchant of record; independent controller for payment) | Payment, billing and tax data, email, license key and device records | Countries stated in its privacy policy (see Payments) | Payment and license check; at checkout and activation | Under its policy and tax law | | Telegram (bot message; processor) | Sale alert: product, amount, currency | Telegram's data centers in several countries | Tell the operator about a sale; per sale | Until the operator deletes the message | | Google LLC (Gmail; processor) | Support emails you send | United States | Read and answer; when you email us | At most 24 months, as above | | Hugging Face, Inc. (independent; only if you enable a model download) | Your IP address | United States | Model download; when you start it | Under its policy |

If you are in the EU/UK, transfers rely on the EU-US Data Privacy Framework or standard contractual clauses where the recipient offers them. If you are in Korea, you may refuse an overseas transfer by not using the related feature or by writing to us. Refusing Cloudflare means you cannot use the site, and refusing the payment provider means you cannot buy. Using the free preview involves only Cloudflare and PostHog. Service providers acting on our behalf (processors) are named in the first column; we do not sell your data or use it for advertising.

Recipients' privacy contacts (policies): Cloudflare (cloudflare.com/privacypolicy), PostHog (posthog.com/privacy), Telegram (telegram.org/privacy), Google (policies.google.com/privacy), Hugging Face (huggingface.co/privacy). The payment provider's policy is linked under Payments.

How long we keep data

• Chat content: never kept by us.
• License records (key hash, first activation time, device count): for a Lifetime license, as long as the license is valid. For a Day Pass, deleted automatically by a weekly job 30 days after the 24-hour period ends; because the job runs once a week, deletion normally happens within 37 days after the period ends; if a weekly run fails we fix it and the next run removes them.
• Records of your purchase (order, payment and license key) are also kept by our payment provider, Polar, under Polar's own retention policy and privacy notice; our deletion of Day Pass records applies only to the records we hold.
• IP-hash rate-limit rows: deleted automatically by the same weekly job once they are older than 24 hours, so normally within 8 days of being created; if a weekly run fails we fix it and the next run removes them. Payment webhook IDs: up to 7 days.
• Support emails: at most 24 months, except where needed to handle a dispute.
• Analytics events: aggregated and kept under the retention setting of our PostHog plan; Cloudflare Web Analytics: unsampled for about 7 days, then aggregated.
• Payment records: by the payment provider under its policy and tax law.

Deleting data

When the period ends or you validly ask us to delete, electronic records are deleted from the database or mailbox in a way that cannot be restored. We have no paper records of personal data.

Your rights and how to use them

Write to support@convokeep.com. We answer without undue delay and within the period your law requires (for Korean access requests 10 days, otherwise at most 30 days; we will tell you if the law lets us extend it). We may ask you to prove the request concerns you (for example the email you bought with); we cannot find anything linked to a chat because we hold no chats.

• Everyone: ask what we hold, correct it, delete it, object to or restrict processing, and withdraw consent.
• EU/UK (GDPR): access, rectification, erasure, restriction, portability and objection; no decisions based solely on automated processing; you may complain to your data protection authority.
• Korea (PIPA): access, correction, deletion, suspension of processing, withdrawal of consent; complaints to the Personal Information Protection Commission (privacy.go.kr, 182), the KISA privacy centre (118) or the Personal Information Dispute Mediation Committee.
• Japan (APPI): disclosure, correction, cessation of use; complaints to the Personal Information Protection Commission.
• Brazil (LGPD): confirmation, access, correction, anonymisation or deletion, portability, information on sharing, revocation of consent; complaints to the ANPD.
• US: we do not sell or share personal information for advertising and do not use it for profiling. State-law rights (access, deletion, correction) are honoured on request.
• Taiwan, Hong Kong, India, Philippines: you may ask to see, correct or delete data about you; you may complain to your authority.

Security

TLS on all traffic, no chat content on any server, hashed license keys and IP addresses, signed tokens, rate limits, and access to our provider dashboards limited to the people who run the service. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Changes and contact

We list changes by the date above and announce material changes on this site for 30 days. For privacy requests and questions, contact support@convokeep.com. For payment questions (charges, invoices, tax), contact Polar, the merchant of record. Governing law: the laws of the Republic of Korea. Rights you have under the law of your country of residence that cannot be waived are not affected.