Privacy
What we hold, why we hold it, and what you get back for it.
Current as of 26 September 2026. Keeper Pty Ltd, Melbourne. Write to privacy@stillakeeper.com about any of it. The agreement itself is on the terms page.
The person receiving a gift is never contacted
The whole product depends on it, so it is built in rather than promised: there is no code path that can send a recipient anything, and a test proves it on every build.
If you are that person, you have no account and you are on no list. The parcel, the card and the label carry the name of whoever sent it, and nothing of ours.
What we hold
| What | Why |
|---|---|
| Your name | So we can talk to you like a person, and so the card in the box is signed by you rather than by a company. |
| Your email address | It is your account, and it is how we tell you a gift is ready, has gone, and has landed. |
| Your date of birth, and your gender, if you tell us | Both are optional. The date of birth is the full date, not a rough age: we work the age bracket out from it ourselves, so it stays right as the years pass. Both make the ideas we put in front of you better from the first day rather than the tenth. They also give your own wish page a head start. |
| What you have paid for | Your card is held by Stripe. We see the last four digits and never the number. |
| Their name, your relationship, and their dates | The whole point. |
| What they are into, and a photo if you add one | What we shop from, and so their page looks like them. A camera writes the location into a photo; we strip it before it is saved, and it never leaves your device. |
| A delivery address, once there is something to send | To get a parcel to a door. Nothing else. |
| What their friends tell us | People you invite can say what they would actually want. They never see each other or what anyone else said. |
| How you use keeper | Which ideas you liked, what you approved, what you sent back. It is how we tell a good shortlist from a polite one. |
What we do with it
We work out what somebody would like. That is the entire product. We read what you tell us, what their circle tells us, what they already own, what they have said no to, and what has landed well for people in the same shape of life, and we turn it into a shortlist. If that sounds like profiling, it is, and it is the thing you are paying us for.
We look at patterns across everybody. Age, gender, relationship, occasion, price, season. Knowing which kinds of present land for which kinds of person is how the next shortlist beats the last one, and it is the ordinary work of running a shop well.
We write to you about your gifts and your account. A reminder a month before somebody's day, news about a gift you have purchased, and the codes that sign you in. We send no marketing email. None of it goes to the person a gift is for.
Our people can open your account to help you. Somebody has to be able to see it to fix a stuck parcel or an address that went to the wrong street. It is limited to the people who do that job, and every look at a photograph is logged against a reference rather than a name.
What we do not do. We do not sell your information, we do not hand it to advertising networks, and we never put keeper in front of the person receiving a gift. Those are the three that would actually cost you something.
The gift graph
Every time somebody tells us what a person is into, what they already own, and what landed well, keeper learns something about buying for that person. That accumulated picture is the gift graph, and it is why the second present is better than the first and the tenth is better than the second.
The graph is ours. It is built from what people tell us and from what we observe about what works, and it belongs to keeper in the way a shop's sense of what sells belongs to the shop. It is not a copy of your account and it is not held on your behalf.
So it outlives an account. When yours is destroyed, what you told us about the people you buy for stays with keeper: their names and addresses, their photographs, their dates, what they like and what they would never want. We keep it because knowing a person is the whole of what we are for, and because the next person buying for them should not have to start from nothing.
The same goes for anybody who helped: a friend you invited to a circle. Their name and the email address they gave us stay too, with nothing on the record saying who they helped.
What is not kept is you. Every record is separated from your account and given a reference of our own, and nothing on it says which customer told us. So nobody using keeper afterwards can find out that you were ever here, or that a present was ever sent. The graph carries what people like, never who said so.
Reading one of those records for somebody else is not built yet, and we would rather say so than let you assume the worse version. When it is built, it will be on this page before it is in the product.
Anybody we hold something about can have it removed, and we do it, whether or not they have ever used keeper. Asking us about your information, below, is how. Nobody is removed because somebody else left: that is theirs to ask for.
This is the ordinary machinery of any shop that remembers a size or a favourite. We are spelling it out because we would rather you read it here than guess.
How it is held
Their address, their photograph and the ideas people give us are encrypted with a key that is not in the database, so a stolen copy of it decrypts to nothing. Their name is not, and we would rather say so: it is on nearly every screen we build for you, so it sits in our database with the ordinary controls around it. Every read of a photograph is logged against a reference, never a name. Everything travels encrypted.
Your own information is not encrypted separately, and we would rather say so than imply otherwise: it sits in our database with the ordinary controls around it.
Who else touches it
Only to do a job you asked for: a courier once a parcel exists, who gets a name and an address and shows you as the sender; Stripe for the card; our hosting provider; our email provider, which handles your address and the messages we send you and processes that mail in Japan; and Google Fonts, which serves the typeface and therefore sees your IP address, as it does on any site.
If you talk to keeper, what you say is shared with the services that make talking work, such as Apple, Google, OpenAI and Amazon. You can always type or tap instead, and what you type or tap stays with keeper.
While we are testing keeper, we keep what you say to it, so we can see how well keeper understands people and get better at it. It stays in Australia, it is never sold and never advertised against, it goes the moment you delete your account, and we delete all of it before we launch.
Some of them operate overseas, and where that happens we take reasonable steps to keep the protection the Australian Privacy Principles require.
What we make, and how
keeper is free to use. We make our money on the gifts: we buy each one for less than the price you approve, and that margin sits inside the gift's own price rather than on top of it. Delivery is on its own line, shown before you approve. The price you approve is exactly the price we charge.
Nothing is sold, nothing is advertised against, and the price is the same for everybody.
Why nothing goes in the box
Australian Privacy Principle 5 asks for steps that are reasonable in the circumstances to tell somebody when we collect information about them. We think the reasonable step is this page rather than a note in the parcel.
Everything we hold about them, the sender already knew. What comes of us holding it is that the right present turns up on the right day. A leaflet from a company they have never heard of, sitting in the box beside it, would take the fun out of the one moment this whole thing exists for.
If you would rather it went in the box, tell us. That is a fair thing to disagree with.
How long we keep things
For as long as you have an account, because remembering is the service.
Delete your account and it goes the moment you tap: your email, your name and birthday, your card, your own page and list, and every device you are signed in on. It cannot be undone, we cannot send you a copy first, and signing in again with the same email starts a new, empty account.
What you told us about the people you buy for stays with keeper, separated from you, as the gift graph above sets out. A gift you have already paid for still arrives, so we keep that parcel's address and the words on its card until it lands or comes back, and then those go too. We keep a sealed copy of your own details for thirty days so that we can answer a lawful request: nothing in keeper reads it, and then it is destroyed. We keep the record of a sale that tax law requires, which is a record of a transaction and not of a person.
Asking us about your information
Anyone can ask what we hold about them, have it corrected, or have it removed, whether or not they have an account. Write to privacy@stillakeeper.com. We answer within thirty days, there is no charge, and asking is never a reason for us to start sending you anything.
Odds and ends
- Children. You have to be 18 to hold an account. A date of birth you record for a child is information their parent gave us, not an account for the child.
- Cookies and storage. keeper keeps your own data in your browser so it works offline, and keeps you signed in from there too. Today that is browser storage rather than a cookie. If we add cookies or similar storage we will use them to keep you signed in and to understand how the product is used, and never to carry you to an advertising network.
- Measurement. We count what keeper shows and what gets tapped. It helps us make keeper better. A count is a screen's name, a tile, a number or a code keeper made up. It never holds your name, your email, an address, or anything you typed or said. The counts stay on keeper's own servers in Sydney. We read them with PostHog, which we run ourselves, and nothing goes to PostHog the company or to anyone else. We keep them for 400 days. Deleting your account deletes yours.
- If something goes wrong in a way likely to cause you serious harm, we tell you and the regulator, as the law requires.
- If you want to raise something. Come to us first at privacy@stillakeeper.com and we will deal with it. That is also how it is meant to go: the Office of the Australian Information Commissioner ordinarily expects a business to have had its chance to put a thing right before the Commissioner takes it on, and you can reach them at oaic.gov.au.
- This page. It is dated at the top, and what you are reading is always the current version.