Keepsake privacy

Privacy Policy

Effective date: September 16, 2026

What we collect

Keepsake collects the information needed to provide the service:

• Account information: your identity-provider subject identifier, email address, and display name when provided by Microsoft Entra External ID.
• Quote content: quote text and the source, creator, page, date, tag, and optional link details you enter.
• Sharing information: the recipient and quote needed to provide sharing and revocation.
• Guest-session information: a random session token and expiration time used to associate temporary quotes with your browser.
• Operational information: request IDs, request method and path, response status, duration, and application errors used to operate and secure the service. We do not intentionally log quote contents, passwords, access tokens, or refresh tokens.

How we use information

We use this information to authenticate you, store and display your collection, provide sharing and exports, prevent abuse, troubleshoot failures, maintain security, and operate the Azure-hosted service. We do not sell your personal information or use quote content for advertising.

Authentication and service providers

Authentication is handled by Microsoft Entra External ID, which may use Google or another identity provider configured in the Entra user flow. Azure App Service, Azure Database for PostgreSQL, and related infrastructure may process or store service data on our behalf. These providers process information under their own terms and privacy policies.

Sharing and public access

Quote collections are private by default. A quote becomes visible to another authenticated Keepsake user only when you share it. Quote detail pages are permission-scoped and are not intended to be public, indexed pages.

Retention and deletion

Guest sessions and their quotes are retained for up to 24 hours. Account quotes and sharing records remain until you delete them or request deletion. You can delete individual quotes and revoke shares in the application. To request account or data deletion, contact the service operator at Set LEGAL_CONTACT_EMAIL before launch. Operational log retention depends on the Azure monitoring settings configured for the deployment.

Cookies and security

Keepsake uses a secure, HTTP-only session cookie to maintain authentication and guest-session state. The cookie does not contain quote text. We use reasonable technical safeguards, including CSRF protection, access checks, encrypted HTTPS deployment, and rate limits, but no online service can guarantee absolute security.

Children and changes

Keepsake is not directed to children under 13. We may update this policy when the service or legal requirements change. The effective date above identifies the current version.

Contact

Privacy questions and deletion requests: Set LEGAL_CONTACT_EMAIL before launch.