Keepsake
Give something Give

Privacy

Last updated 9 September 2026 — see what changed

Keepsake has no passwords and no profiles — a key your browser holds and an email address are all there is of you here. Here's exactly what we hold, and why.

Who runs this

Keepsake is run by one person, Kiarash Adl, operating as an individual — not through a company or any other entity. That's a decision, made deliberately in September 2026, not a default. He's the controller for the purposes of this policy: the one accountable for what's described here, and the one you'd contact, complain to, or send a rights request to. Reach him at hello@keepsake.ing — that inbox is read personally, not by a support team.

We don't publish a mailing address — a considered choice, not an omission. The UK is the one jurisdiction whose law would otherwise require one (UK GDPR Art. 13), and Keepsake doesn't serve the UK — see Terms. Canadian and U.S. privacy law, which do still apply, ask only for an accountable person and a working way to reach them, both already given above. The reason for withholding it is that Keepsake is a person at a home address, running a site that arranges meetings between strangers and turns down listings — not that he's hard to reach. If you need a postal address for a legal notice, or because some form demands one, ask at hello@keepsake.ing and you'll be given one.

No password, just a device key

When you post your first keepsake, your browser generates a private token and stores it in your device's local storage — that token is your identity on Keepsake, and there's no username, password, or profile behind it. What losing it costs you, and the one way back — the email address you gave when you posted — is in Terms.

Your email

Giving something asks for an email address, and posting a listing needs one: it is how we tell you that somebody asked for your keepsake, and how you get back to your listings if you lose your device key. We store it only for those two things. We never use it for marketing, and it's never shown publicly on the site. You can take it back off at any time yourself, from keepsake.ing/mine/email — see "Your rights" below for what that does and how long we hold it if you don't. Removing it doesn't remove your listings; it means we can no longer tell you when someone asks about them, and your dashboard will say so.

It is shared privately, though, in one case: if you choose a request, we send your email address to that requester directly (in their notification, and as the reply-to address on it) so the two of you can arrange the handoff. This is the one moment either of your contact details becomes visible to the other person — see the next section.

What a requester shares

If you ask for someone's keepsake, we store the note, email, and optional phone number you provide with that request. This contact information is only shown to the giver, and only once they choose you — and if they do, your email is also included in the "you were chosen" notification we send you, the same way the giver's is (see above).

Nothing is passed to the giver until you confirm the address: when a request is submitted we email the address given, asking whether it was really you, and hold the request unseen until that link is followed. If it never is, we delete the note, email, and phone number within a few days and the giver never sees them — which is also what to do if you get one of these emails without asking for anything: nothing. There's nothing to secure and nothing to click; the details erase themselves. We also rate-limit how many confirmations one address can be sent in a day, so this can't be used to fill an inbox.

Every request-confirmation email includes a link to withdraw that request. Following it deletes your note, email, and phone number from our records and marks the request withdrawn — no login needed, since that link is the only credential. If the giver already chose you before you withdraw, they may already have your contact information by email; withdrawing removes it from our database and the giver's dashboard going forward, but we can't recall an email that's already been delivered.

Photos

Photos you upload are stored on Cloudflare R2. We keep a full-size and a thumbnail version of each one for as long as the listing exists, plus 30 days after it's rejected, withdrawn, or hidden. If you upload a photo but never finish posting the listing, we delete it after 24 hours.

Location

A listing's location is a postcode centroid, not a device-precise coordinate. When you post something, we look up the latitude and longitude of the postcode you gave us in a fixed table built from public postal-code data — the same point every listing in that postcode gets, not a spot tied to your address or device. If you use "Use my location" while posting, your device's exact coordinates go straight from your browser to a reverse-geocoding lookup (BigDataCloud, or OpenStreetMap's Nominatim as a fallback) to work out your postcode. That exchange happens between your browser and those services directly — we only ever receive the postcode it hands back, never the coordinates.

Browsing "near me" is a separate feature, worth being precise about on its own: if you use "Use my location" to search rather than to post, your device's coordinates are sent to us as part of that one search request, so we can sort listings by distance — they aren't looked up from a postcode table, and we don't store them. Your browser remembers your last search location for next time, the same way it would a typed-in postcode, but our server only ever sees the coordinates for the moment it takes to answer that request.

Screening

Keepsake makes three kinds of AI call, each for one purpose and separate from the others: this one screens for safety, the next reads your first photo to save you typing, and the third makes search work by meaning instead of exact words.

Every listing's text and photos are checked automatically by AI models run by Cloudflare at the moment you post, to keep the marketplace safe. Some listings are also reviewed by a human — just Kiarash, today — before they go live.

Autofill from your photo

The second of the three, and a separate call from the safety screening above: your first photo is read by an AI vision model run by Cloudflare, to save you typing — nothing it returns decides whether your listing goes live. It proposes a title, picks a category, writes one line about visible wear, suggests a handful of short tags (like "mug", "ceramic", "blue"), copies out any words printed on the object itself — a brand, a model name, a size — and returns a plain description of what it sees.

What happens to the result. The title is a starting point — it's filled into the form for you, and anything you type over it wins. The category and the short tags are saved with your listing as ordinary listing content; the tags are how the browse page groups similar keepsakes together, so they're public in the same way your title and photo are. There's no category picker when you post, so the model's answer is the one that's saved — if it's wrong on your listing, write to us and we'll fix it. The line about visible wear and the description of what it sees never reach our records at all: they are the model's working, used only to produce the title and tags above, and they live in your browser's draft until you post or clear it. One exception: a word read off the object can end up as a tag anyway — say, "KastKing" on the label becoming a "brand: KastKing" tag — and that tag is saved like any other, even though the read-out itself isn't. If you never finish the listing, none of it is kept — the photo itself goes after 24 hours, as above.

Search by meaning

The third and last: it turns the words already public on your listing — its title, story and tags — into a list of numbers that captures roughly what they mean, so someone searching for "grandmother's teapot" can find a listing that says "my nan's old brown betty" without the words having to match. The same is done to whatever a searcher types. Only your listing's own public words are sent; nothing private, and no photo.

This is running. It was switched on in September 2026. The list of numbers for each listing is stored with Cloudflare, alongside the listing's id and nothing else — no name, no email, no address. Delete your listing and it is deleted too. What a searcher types is turned into numbers to compare against them and is not kept.

If this ever produces odd results, ordinary word matching is still there underneath and we can switch back to it on its own.

Rate limiting

To stop abuse, we keep a short-lived, hashed record of your IP address combined with the date (for example, sha256("2026-09-05:203.0.113.4")), never your raw IP address. We're being precise rather than absolute about what that buys you — the point is minimization, not secrecy: IPv4's address space is small enough (a few billion) that someone who knew the day could brute-force a specific hash by trying every address, so this isn't a strong cryptographic guarantee against a motivated adversary. What it reliably does: we never handle or store your address in the clear, and a day-scoped hash can't be joined across days into a history the way a raw IP log could. We keep each day's hash for 48 hours, then it expires automatically.

Three things use that same date-scoped hash: a brake that slows a burst of requests within a minute, a counter for how much you've done today, and a check that stops the same person asking for one keepsake twice or reporting the same listing twice on the same day — so none of them can follow you from one day into the next.

The 48 hours covers every copy, not just the counters. The check above also writes a copy of the hash beside the request or report itself, in our database — a nightly job clears it there at 48 hours too, and withdrawing a request (see below) clears it immediately along with your note, email and phone number, so the row keeps no trace of the address it came from.

Your choice, before anything loads

The first time you arrive, Keepsake asks you one question, and until you answer it nothing optional runs. Rejecting everything is one click, in the same place and the same size as accepting. There are three groups:

Strictly necessary. Not a choice, because without it there is no site: the device key that proves a listing is yours, your light/dark preference, and the record of this very decision. All of it stays in your browser's local storage. None of it goes to anyone else.

Analytics. Off unless you say yes. If you say yes, we load Cloudflare Web Analytics from static.cloudflareinsights.com, and it reports what it counts to cloudflareinsights.com. It counts page views without cookies and without following you to other sites. Cloudflare is the recipient.

Advertising. Off unless you say yes — and, as things stand, off even if you say yes, because Keepsake runs no adverts and loads no advertising tag at all. The group exists because the machinery for one was built and then deliberately left unfed: the only tag it was ever wired for is the Google Ads tag from www.googletagmanager.com, and the id that tag needs is empty in every version of this site that has ever been published, so nothing is fetched and Google receives nothing. In September 2026 that became a decision rather than an accident — the ad code was removed and nothing is planned to replace it.

We are leaving the switch on this page rather than hiding it, because the honest version of "we don't run ads" is one you can check and turn off in advance. If that ever changes, this section changes first, before a single tag loads, and "What changed" below will say so — and whatever happens, we would never send an advertiser your photos, your story text, your email, or anything a requester wrote to you. One more thing this rests on: if we haven't switched a tool on for a particular build, it doesn't load even when you've said yes — consent is the ceiling, not the trigger.

Changing your mind

"Privacy choices" at the bottom of any page reopens the same choice, and you can turn any group off again. When you switch something off we stop sending to it immediately and clear the cookies it set; the script that was already running in that tab is gone the next time the page loads. If we ever change what the groups mean, we'll ask you again rather than assume your old answer covers it.

Global Privacy Control

If your browser sends a Global Privacy Control signal — Brave, Firefox, DuckDuckGo and several extensions can — our code checks for it and, when present, turns off advertising and treats it as a "do not sell or share" request automatically, without asking you about it. We check for this signal on every visit, everywhere. Several U.S. states require honoring it, but only from businesses larger than Keepsake — we don't read any of their size thresholds as reaching us. Honoring it anyway is a choice we're making, not a legal obligation we're claiming, and if that ever changes this section changes first.

We don't sell or share data

We don't sell, rent, or trade any information you give us, to anyone, for any reason. Some privacy laws also count advertising measurement as "sharing", so the consent choice above includes a "do not sell or share my personal information" switch: turning it on switches advertising off and keeps it off, and nothing else you change afterwards will quietly undo it.

Categories of information we collect

Gathered in one place, since some places ask for it that way:

Two more categories reach us and are then thrown away rather than kept, which we list here anyway because they are still collected. The first is your date of birth: the age gate on the give form and the request form asks for it, it travels to us with that submission, it is checked once against our minimum age, and it is discarded — all we keep is a timestamp recording that the check passed (see "Minimum age" below). The second is your device's exact coordinates, but only if you use "Use my location" to search rather than to post: they come with that one search request and aren't stored (see "Location" above).

We don't sell any of it, to anyone, for any reason — see the section above. Kiarash, named under "Who runs this" above, is the controller for all of it.

Your rights: access, deletion, and portability

Because there's nothing to log into, most of this is already self-service. You can delete a listing (and its photos) at any time from your dashboard. Your email address is self-service too: on the device that holds your key, open your dashboard and follow "Your email" to keepsake.ing/mine/email, where a Remove button erases the address from our records on the spot — you don't have to write to us and wait. If you asked for someone's keepsake, the confirmation email you received has a link to withdraw that request and erase your note, email, and phone number — see "What a requester shares" above for the one thing that link can't undo (a chosen request whose contact info the giver already has by email).

For anything that isn't self-service — seeing a copy of what we hold about you (access), getting it in a portable form, or removing anything on this page you can't remove yourself — write to hello@keepsake.ing and we'll take care of it. There's one operator behind this, so these are manual requests we handle by hand, not an automated export button, but we'll get you an answer.

What we keep and for how long:

Your own email is the one thing on that list with no expiry date, and it's worth stating without hedging. If you add an email address, we keep it indefinitely, tied to your device key. There is no dormancy window, no inactivity timer, and no cleanup job that removes it: not opening Keepsake for a year, or five, deletes nothing. It is kept because it is the only way back to your listings if you lose your device key, and losing it silently to a timer would defeat the point of having offered it. It goes when you remove it — the Remove button described above, or by asking us — and not before.

Minimum age

You have to be 18 or older to post a keepsake or ask for one — see Terms for why. The form doesn't ask you to tick a box that states its own right answer. It asks a neutral question instead: your date of birth.

What happens to that date, exactly. It is sent to us along with the listing or the request — we're saying so plainly rather than implying it never leaves your browser — and there it is checked once, against nothing but our minimum age. Then it is dropped. No column in our database holds a date of birth and no code path writes it to one, copies it into a log, or passes it to anyone else. The only trace kept is a timestamp on that listing or request recording that the check passed on that day. On your side of the wire it is just as short-lived: unlike the rest of a draft listing, the field is never saved into your browser's storage, so it's gone when you post or leave the page.

None of this verifies anyone's age — the date you give us is a self-declaration, not an age-verification system. Asking it neutrally is what gives us a documented, honest basis for acting the moment we actually learn — through a report, a listing, or a request — that someone using Keepsake is a minor. Acting on that means removing the listing or request involved, and, when it's a giver, banning the device key that posted it.

Other services we rely on

Beyond what's named above (Cloudflare for hosting, storage, AI screening, and the autofill model — Google is named under "Your choice, before anything loads" as the advertising tag this site does not load, and is not a service we rely on), a few smaller services touch limited data on our behalf: Cloudflare Turnstile checks that a submission is coming from a real browser, not a bot, before it reaches our server; and Resend is an alternative email provider we're configured for and would switch to by hand if Cloudflare's own email sending stopped working. If something breaks, error diagnostics stay inside Cloudflare — the same platform already hosting the app — rather than going to a separate error-tracking company, with obvious personal data redacted before anything is written. None of them receive your photos or story text beyond what's needed to run the service itself.

What changed

A date at the top of a policy tells you something moved but not what, so this is the record. It's kept by hand, newest first, and it starts the day we started keeping it — there's no entry here for anything before that date.

9 September 2026. This page stopped telling you Keepsake has "no accounts". There have never been usernames or passwords here and there still aren't, but since the day before an email address has been required to post a listing, and "no accounts" read as a promise that nothing at all would be asked of you. The device-key section is now headed "No password, just a device key", and the sentences elsewhere that leaned on the same phrase — what to do about a confirmation email you never asked for, what the withdraw link needs from you, and why your rights here are mostly self-service — say what is actually true instead. Nothing we collect, keep, or share changed with it.

8 September 2026 (later the same day). The email address stopped being optional when you give something. It used to be a step you could skip, and skipping it left a listing we had no way to tell you about — someone could ask for your keepsake and you would only ever find out by opening the site again on the same device, and if that device was lost, so were the listings. The give form now asks for the address and says what it is for, and this page's "Your email" section says the same. What we do with it has not changed, and you can still remove it at any time.

8 September 2026. A second pass the same day. The consent banner (not this page) was still telling visitors "Google Ads measurement, so we can tell which advert brought you here" — the same overstatement this page corrected below, recurring in the one place a visitor reads before deciding, because the guard written for that drift never parsed the banner's own copy; it does now. "Minimum age" still described the date-of-birth field as one you type, in the format YYYY-MM-DD — true when written, false since a real date picker replaced the text box; it now just says "your date of birth". "Global Privacy Control" conceded a legal obligation to honor the signal "at our size" that our own research concludes doesn't attach to an operator this small under any U.S. state's threshold; reworded so the page claims only the choice it's actually making. "Other services we rely on" called Resend a provider "we can fall back to" — there's no automatic failover, only a config value an operator would switch by hand; reworded to say that. Separately, this page was condensed by roughly a fifth — duplicated statements, scaffolding narrating its own reasoning, and one stale format description cut, with two dense paragraphs turned into scannable lists — losing no fact and no fact-pinned sentence.

8 September 2026. Two corrections, both of them this page catching up with the code rather than a change in what Keepsake does. "Advertising" described what would happen if you consented to an advertising tag — that Google would be sent something and might set a cookie — as though it were the live arrangement. It never has been: the id that tag needs has been empty in every published version of this site, and the code behind it was removed in September 2026. That section now says so plainly, and says the switch stays on the page so the claim is one you can check. The same sentence has gone from "Other services we rely on", where naming Google alongside services that genuinely do handle your data was the same overstatement in a shorter form. Separately, a recovery link's lifetime was raised from 30 minutes to an hour on 7 September so that a slow mail delivery can't hand you a dead link, and this page still said 30 minutes; it now says an hour, and a test holds the two together.

7 September 2026. The 48-hour expiry on hashes of your IP address is now true of every copy. It always was for the rate-limit counters, and it was not for the copy stored next to a request or a report: that one had no expiry at all, so it stayed in our database indefinitely, including after someone used their withdraw link to remove their note, email and phone number. The page said otherwise, twice, and the page was wrong. The code changed rather than the promise — a nightly job now clears those hashes at 48 hours, and withdrawing a request clears its hash immediately along with everything else. "Rate limiting" now also says plainly that a third thing uses the hash: the check that stops the same person asking for one keepsake twice, or reporting the same listing twice, on the same day.

7 September 2026. Search by meaning was switched on. This one is a real change in what Keepsake does, not the page catching up: that section used to say the feature was built but switched off, and it now says it is running. It also says something the old paragraph had no reason to — that the list of numbers made from your listing's public words is stored, next to the listing's id and nothing else, and is deleted when you delete the listing. What a searcher types is not kept.

7 September 2026. "Who runs this" names the operator in full — Kiarash Adl — and says that if you need a postal address for a legal notice you can ask for one. Neither is a change in who runs Keepsake; the question of whether to run it through a company was settled the same day, and settled as "no," which is what the section said already. Alongside that, three corrections, all of them the page catching up with the code rather than a change in what Keepsake does. "Minimum age" described a checkbox confirming you're 18 or older; the form now asks for a date of birth instead, so that section says so and spells out that the date is checked and then discarded, with only a timestamp kept — and "Categories of information we collect" now lists it. A new "Autofill from your photo" section discloses the second AI model, the one that reads your first photo to fill in the give form, which the page had only ever described as safety screening. "Rate limiting" no longer implies the daily hash of your IP address is unbreakable; it says what the hashing does and doesn't buy you. The email retention rule is unchanged and now stated plainly, alongside the self-service button that removes it.

Questions

Reach us any time at hello@keepsake.ing.