Privacy, honestly

Kelpwise privacy policy

Effective 12 October 2026. Last updated 13 October 2026.

This policy explains what personal data Kelpwise handles, why, on what legal basis, who else sees it, how long we keep it, and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who we are

Kelpwise is an Android app that helps you control how much time you spend in distracting apps. The controller of your personal data, meaning the party that decides how and why it is used, is the Kelpwise team, reachable at:

Email for privacy matters: privacy@kelpwise.com
General support: support@kelpwise.com

We write "we" and "us" for the controller above, and "Kelpwise" for the app.

2. The short version

• Most of what Kelpwise knows about you stays on your phone: your habits, the apps you block, your schedules, your PIN, and how long you spend in each app. We do not receive it in a form we can read.
• No ads, no ad SDKs, and we never sell or share your data for advertising.
• A few anonymous counts are always sent: that the app was installed or opened, how far setup got, and whether a permission was granted. They say nothing about who you are. Anything more, and crash reports, is off until you say yes. Kelpwise asks you once, and you can change your answer at any time.
• You sign in to use Kelpwise, with Google or with a code we email you. We keep your email address (and your first name, if Google gave it) on our server. Your habits and what you block stay on your phone.
• Two optional features send encrypted data to our server, and we cannot read it: cloud backup, and the accountability partner. Both are part of Kelpwise Plus.
• To tell you about a partner's nudge quickly, your phone's push address is kept on our server and Google's notification service wakes your phone. The notification says nothing about what was sent.
• If you open the feedback board, you leave the app and use our feedback provider's website in your browser.
• The website waitlist keeps only your email address, so we can tell you when Kelpwise is out.

3. What stays on your phone

These are stored only on your phone and are never uploaded by us in readable form:

• the name you gave us for greetings (see section 4.2 for the one exception, if you create an account);
• your habits, their details, your progress, streaks and trophies;
• which apps you chose to block, and your schedules and rules;
• your PIN, stored only as a one-way hash;
• your screen time, which apps you used and for how long, and the labels you gave them (for example "productive");
• your daily screen time goal and your answers to the questions in setup;
• your steps and workouts, read from Android's Health Connect only if you create a habit that uses them. This is health-related data. It is read on your phone and is never sent to us.

If you turn on cloud backup, an encrypted copy of some of this goes to our server (section 4.5). If you uninstall Kelpwise, what is on your phone is deleted from it.

4. What we collect, why, and our legal basis

GDPR requires a legal basis for each use of personal data. Here is each one.

4.1 Anonymous usage statistics and crash reports

There are two levels.

• Always on (the basics). Short messages that say whether the app works at all: that it was installed, updated or opened, how far someone got through setup, whether a permission was granted or later taken away, and that the Plus screen was viewed or a subscription started. They carry only the random install identifier below, the app and Android version, and whether the phone is an emulator. They are not tied to your account, name or email.
• If you choose to share more. Short event messages about how the app is used, each a name plus a few numbers, yes/no values or categories. Examples: which type of habit was created, that a schedule was turned on, that the block screen appeared and how it ended, that a pairing started or ended. If Kelpwise crashes, a crash report with the technical error is sent the same way. These also carry phone model, language, time zone and screen size.
• Never included: your name, anything you typed, habit names or descriptions, the names of apps you block or use, your screen time, your location, contacts, messages, photos or files, and who your partner is.
• Technical details: app version and Android version on every event; phone model, language, time zone and screen size only if you chose to share more, so we can find which phones have problems.
• A random install identifier is created on your phone by our analytics tool. It is not linked to your name, email, Google account or advertising ID, and it is replaced if you reinstall. We use it to count how many installs are active and come back. Because it identifies an install over time, we treat it as personal data, even though we cannot tell who you are from it.
• Your IP address: events go through a relay we run on Cloudflare, which does not forward your IP address, and the analytics tool is set to discard IP data and not to work out location. The analytics provider sees the relay's address, not yours.
• Why: to know whether the app works and how many people use it (the basics), and to learn which features are used and where people get stuck and to fix crashes (if you share more).
• Legal basis: the basics rest on our legitimate interest in keeping a working app (Article 6(1)(f)), using anonymous, aggregate counts of low privacy impact that are not tied to you or shared with anyone for other purposes. Anything beyond them rests on your consent (Article 6(1)(a) GDPR, and the EU rule on storing or reading information on your device). Kelpwise asks "Share more anonymous usage data?" at the end of setup, with two equal choices and none pre-selected. Until you answer, the extra events are only held on your phone, are never uploaded, and are deleted if you say no. If you say yes, the held events are sent with the time they happened.
• Your choice: Settings > Privacy > "Share more anonymous usage data", at any time. Turning it off is as easy as turning it on. It stops the extra events and crash reports. The basics are not part of that switch; if you object to them, write to us. Changing it does not affect what was sent before.

4.2 Your account

You sign in to use Kelpwise. You do it with Google, or with a one-time code we email you. There are no passwords. Blocking keeps working on your phone even if you are offline or your sign-in has expired.

• What we receive when you sign up: your email address, your first name (from your Google account, if you used it), and how you signed in. If you use the email code, we send you the code and keep the address. We also keep technical account records such as when the account was created and last signed in.
• Sign in with Google: the one-tap sheet runs through Google Play Services, so Google learns that your Google account signed in to Kelpwise. We receive your Google account's email address and the identity token that proves it. Nothing else about you is sent to Google by Kelpwise.
• Why: to create and secure your account, to let you recover Plus, your backup and your partner on a new phone, and to be able to help you if something goes wrong.
• Legal basis: performing the service you asked for (Article 6(1)(b)).
• Deleting it: Settings > Account > Delete account. See section 10.

4.3 Kelpwise Plus (subscription)

• What: whether you hold a Kelpwise Plus subscription, and when it started. Payment is handled entirely by Google Play. We never see your card or payment details. The app reads your subscription status from Google Play on your phone.
• Why and basis: to give you what you bought (Article 6(1)(b)), and to keep records tax and accounting law requires us to keep (Article 6(1)(c)).

4.4 Emails from us

If you have an account, we send you one welcome email when you create it. It is a service message, from a kelpwise.com address, sent through our email provider Loops, which keeps your email address and first name as a contact so it can send it. Creating an account on our server tells Loops automatically, and deleting your account deletes the contact there.

• We do not send marketing, newsletters or tips to account holders. If we ever add them, they will be off until you tick a box asking for them, and every email will carry an unsubscribe link.
• We email people who do not have an account only if they joined the waitlist on our website (see section 4.11). Nobody else is emailed.
• If you write to us at support@kelpwise.com we reply to you from there (section 4.9).
• Legal basis for the welcome email: performing the service (Article 6(1)(b)).
• Open and click tracking: emails sent through our email provider Loops (the welcome email, and the launch email to the waitlist) contain a tiny image and links that go through the provider, so it can record whether an email was opened and whether a link in it was clicked. We use this only to check that emails arrive and work, not to build a profile of you and not for advertising. Many mail apps block the image, which stops the open count. If you do not want to be counted, do not load remote images in your mail app, or unsubscribe.

4.5 Cloud backup (optional, part of Plus)

Cloud backup keeps an encrypted copy of your data so a new phone can pick up where the old one left off. It is off until you turn it on.

• What goes in it: your name, habits and progress, schedules, blocked apps, app labels you chose to keep "always", trophies, your daily goal and first guess, your emergency unlock allowance, and your own answer to the analytics question. Never your PIN, your partner key, sign-in tokens or health data.
• How it is protected: your phone makes a random recovery code (8 groups of 4 letters and digits) that you write down. An encryption key is made from it on your phone, and the data is locked with AES-256-GCM before it is sent. The code and the key never reach us, so we cannot read your backup.
• If you lose your recovery code and your phone, the backup cannot be opened by anyone, including us. The app says so before you turn backup on.
• When it happens: automatically about twice a day, only when something changed, and when you press "Back up now". Restoring is always free, even if your subscription has ended.
• What our server can see: that you have a backup, how big it is and when it last changed. Not what is in it.
• Limits: we limit how often a backup can be written and how large it can be, to stop mistakes and abuse.
• Ending it: "Turn off and delete backup" deletes it from our server. Deleting your account deletes it too.
• Why and basis: you asked for it (Article 6(1)(b)). Because the data is encrypted so we cannot read it, we hold it only on your behalf.

4.6 Accountability partner (optional, part of Plus)

You can pair with one partner, who sees a few numbers you choose and can send you preset nudges. Both of you need an account and Kelpwise Plus (the person you invite gets one free week to try it).

• What you can share (each is a separate switch, all off until you turn it on): your daily streak, how many habits you did today (for example 3 of 4), your screen time against your goal as two numbers, whether the block screen was up today and for how long, and how many emergency unlocks you used. These are only numbers, yes/no values and categories.
• Habits you do together: if you choose to link a habit with your partner, they see that you share a habit of that type (for example a steps habit) and whether it is done today. Each of you names your own habit; the name never crosses.
• Never shared: habit titles, blocked app names, schedules, or your PIN, or anything you typed.
• Nudges are a fixed list of preset messages. There is no free text and no chat.
• No automatic reporting of slips: using an emergency unlock or missing a day never sends an alert. Your partner sees such things only through a count you chose to share.
• How it is protected: the pairing invite contains a random 256-bit key made on your phone. The key travels only inside the invite link, after the #, which your browser and our website never receive, through the messenger you pick, and it never reaches our server. Stats, nudges and shared-habit updates are encrypted on your phone with AES-256-GCM before they are sent, so our server stores only encrypted data it cannot read. The key stays on your phone and is left out of your cloud backup, so a new phone, or signing out, means pairing again.
• What our server can still see: which two accounts are paired and when, how often you each send something, and the size of the messages, but not their contents. Each side also sees the other's account first name after pairing.
• Keeping it small: the server keeps only your latest stats and a short run of your latest nudges and shared-habit updates, not a history.
• Ending it: either of you can end the pair instantly. The pairing and the stored encrypted messages are deleted from our server and the key is deleted from your phone. The other person simply sees that you are no longer paired.
• Invites are single use and expire after 24 hours. Someone who sees an invite before your partner accepts it could accept it first, so send it only to the person you mean to pair with.
• Why and basis: you asked for the feature, so Article 6(1)(b). Sharing your numbers with your partner is your own choice and you can stop whenever you like.

4.7 Push notifications for nudges

So that a nudge reaches your partner's phone in seconds, and not at the next background check, Kelpwise uses Google's Firebase Cloud Messaging.

• When it starts: only once you are paired. Before that nothing is sent to Google by this feature.
• What is sent: your phone gets an installation identifier and a push address from Google, and Kelpwise stores that push address on our server against your account. When your partner sends a nudge, our server asks Google to wake your phone. The message carries no names, numbers or text, only that something is waiting. Your phone then fetches and decrypts the nudge itself.
• What we do not use: Firebase Analytics or any advertising feature.
• Ending it: the push address is removed from our server when you end the pair, sign out, or delete your account, and push is switched off on your phone.
• Why and basis: to deliver the feature you use (Article 6(1)(b)).

4.8 Feedback

• Feedback board: Settings > Feedback > "Open feedback board" opens kelpwise.userjot.com in your phone's browser. It is run by our feedback provider, UserJot. Nothing from the app is passed to the page: no diagnostics, no account data, no partner data. What you post, vote on or enter there is handled by UserJot under its own terms and privacy policy, and posts may be public. Legal basis for our reading and replying to it: our legitimate interest in improving Kelpwise (Article 6(1)(f)).
• Email: Settings > Feedback also offers an email option. It opens your own email app with a short report (phone model, Android version, app version, and on/off counts, never names) that you can read and edit before sending. If you send it we receive your email address and what you wrote, and use them only to answer you. Legal basis: your request and our legitimate interest in supporting users.

4.9 Contacting us

If you write to us, we use what you send, and your email address, to reply and to keep a record of the conversation. Legal basis: our legitimate interest in answering you, or performing a request you made. Mail sent to support@kelpwise.com passes through our DNS and email routing provider, Cloudflare, which forwards it to our inbox.

4.10 Things we do not do

We do not use advertising or tracking SDKs, we do not collect your advertising ID, we do not read what is inside the apps you block, we do not sell your data, and we do not use your data for advertising. We do not make decisions about you by automated means that have legal or similarly significant effects.

4.11 Website and waitlist

If you join the waitlist on kelpwise.com, we keep your email address. Nothing else is asked.

• What we send: one email when Kelpwise is available. Nothing else, and no newsletters. Every email says how to be removed.
• Why and basis: to tell you about the launch, which is what you asked for (Article 6(1)(b)).
• How long: until Kelpwise launches and we have sent the launch email, then we delete the waitlist. You can ask us to remove you at any time at privacy@kelpwise.com.
• Who handles it: our email provider Loops, the same one that sends the welcome email (section 5). It keeps your email address until we delete the waitlist. Its emails carry the open and click tracking described in section 4.4.
• Cookies and similar technology: this website has no advertising cookies or scripts. Our hosting provider counts visits and time on page using a session identifier. It does not include your email address or anything you type, and we do not use it to identify you. The site also sets technical cookies that keep it secure and working.
• Bot check: the waitlist form uses Cloudflare Turnstile to tell people from automated programs. Cloudflare receives your IP address and some browser signals for that check, and the form does not work without it.

5. Who we share data with (processors and other recipients)

We use the following service providers. They act on our instructions under data processing agreements, except where noted.

Health Connect is a Google component on your phone. Kelpwise reads it on your phone only and does not send anything from it anywhere.

We may also disclose data where the law requires it, or to protect our legal rights. If our business is sold or transferred, your data may move to the new owner, who must keep honouring this policy.

6. Transfers outside the EU and UK

Where a provider processes data outside the EU or UK (for example Cloudflare or Google), we rely on an adequacy decision (such as the EU-US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses, with extra safeguards where needed. You can ask us for a copy of the safeguards using the contact details above.

7. How long we keep data

8. Permissions, and why Kelpwise asks

You can withdraw any permission in Android's settings at any time. Some features stop working without it.

9. Security

Your PIN is stored only as a salted PBKDF2 hash. Data in transit to us is sent over encrypted connections (HTTPS). Cloud backup and partner data are end-to-end encrypted as described in sections 4.5 and 4.6, and our database restricts each pairing to its two members and each backup to its owner. No system is perfectly secure, but we keep what we collect small, so there is little to lose. If a breach is likely to put your rights at risk, we will tell the supervisory authority within 72 hours, and tell you where the law requires it.

10. Your rights

Under the GDPR and UK GDPR you have the right to:

• be informed about how your data is used (this policy);
• access the personal data we hold about you and get a copy;
• rectify data that is wrong;
• erase your data ("right to be forgotten") in the cases the law lists;
• restrict how we use it in some cases;
• data portability: receive data you gave us in a common, machine-readable format;
• object to use based on our legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, where we rely on it (analytics), without affecting what happened before;
• not be subject to decisions based solely on automated processing with legal or similar effects (we make none).

How to use them:

• Most of your data is on your phone, where you control it directly: change your analytics choice in Settings > Privacy, and delete data by uninstalling. To get a copy of what we hold about you, email us.
• To delete your account: Settings > Account > Delete account. Pressing the button deletes your account details, your cloud backup, any pairing and its messages, and your push address from our server automatically, within one hour, and your contact from our email provider. You do not need to email us. What is on your phone stays there. Purchase records we must keep by law are kept for the period in section 7, and anonymous analytics events are not tied to your account, so deleting it does not remove them. Cancelling a Plus subscription is done in Google Play.
• Analytics events carry a random install identifier and not your name, so we usually cannot tell which events are yours.
• For anything else about your data, write to privacy@kelpwise.com. We may need to confirm it is yours first. We answer within one month, and it is free unless a request is clearly unfounded or excessive.

Complaints. You can complain to your data protection authority. In the EU that is the authority in the country where you live, work or where you think a breach happened. A list is at edpb.europa.eu. In the UK it is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put it right first, so please write to us too.

11. Children

Kelpwise is not aimed at children. Where the law sets a minimum age for consenting to online services, it is 16 in some EU countries and lower in others (never below 13). Do not use Kelpwise's account, partner or analytics features below the age that applies in your country unless a parent or guardian agrees. We do not knowingly collect data from children below it. If you believe a child has given us data, write to us and we will delete it.

12. Changes to this policy

If we change how Kelpwise handles data, for example by adding features that send new data, we will update this page, change the date at the top, and tell you in the app before the change reaches you. If a change needs your consent, we will ask for it and not assume it.

13. Contact

privacy@kelpwise.com (privacy and data requests)
support@kelpwise.com (everything else)