← Keepwarden

Privacy Policy

Last updated: 17 October 2026

Keepwarden is a task app with an AI assistant. It is built so that you never have to trust us with your data: we do not run a server that stores it, and we cannot read it. This page says exactly where your data goes, and who can see it.

Who we are

Keepwarden is made by Tomer Shtern, an independent developer. Contact: support@keepwarden.app.

Where your data lives

Your tasks, lists, notes and settings are kept in your own room on Witbitz, the platform Keepwarden runs on. What a room stores is sealed — encrypted with the room's key, which is kept on your device — so it cannot be read from storage. (When the assistant answers, what it needs is read for that answer; see below.) Only people you signed in as (your account, and a backup address if you named one) can open it; a link alone opens nothing.

We, the makers of Keepwarden, have no server that stores your data and no copy of your room's key. The app is code that runs on your device.

The app's files are served by Cloudflare, which sees your IP address when your device loads them, as any web host does; we keep no log of it.

Your device keeps a copy of your lists so the app opens quickly and works offline. It is removed when you sign out of Keepwarden on that device.

The assistant

When you write to the assistant, your message and the context it needs (your lists, your settings, and — if you connected it — what it read from your calendar) are sent, through Witbitz, to an AI model that writes the answer — anonymously: the request comes from Witbitz, with nothing that says who you are. Every change the assistant suggests is shown to you as a card, and nothing changes until you approve it.

No one can read your room from storage — not us, and not Witbitz. What differs between rooms is who can read the text of a turn while the answer is made:

• A standard room uses GPT-6 Luna by OpenAI, reached through Witbitz: the text of the turn reaches OpenAI, which can read it, under its terms for API use. It arrives from Witbitz, not from you — not your account, your email or your address — so OpenAI has no way to tell it is yours, unless the text itself says so. Witbitz's servers use your room's key for that answer only and keep nothing but the sealed copy.
• A confidential room runs an open-weights model inside a verified hardware enclave. Your room's key is sealed to that enclave before it leaves your device, and the device refuses to send it if the enclave's code cannot be verified. No one has access to your content there — not us, not Witbitz, not a model company — and that is something your device checks, not a promise.

How Witbitz does this, and how to check it: witbitz.chat/trust.

Settings → Your room says which kind of room you have.

Google Calendar

Connecting Google Calendar is optional. If you connect it, Keepwarden asks Google for:

• calendar.readonly — to see your calendars and their events, so the assistant can tell you what is on your schedule and plan tasks around it.
• calendar.events — to add or change an event, only after you approve a card that shows exactly what will be written, and to which calendar.

How it is handled. The sign-in with Google is kept by the Witbitz Sentinel, a service that runs inside a verified hardware enclave. The access tokens never reach your device, your room, or us. When the assistant reads your calendar, the Sentinel makes the request and the answer is given to the assistant for that conversation; the full answer is not stored in your room — only a line saying what was read and when. A change you approve is recorded in your room's history, like any other change.

What we never do with Google user data. We do not sell it. We do not use it for advertising. We do not let people read it, except you. We do not use it to develop, improve or train AI or machine-learning models — ours or anyone else's. It is passed on only as needed to provide the feature you asked for: to Witbitz, which runs the connection and the assistant, and to the AI model that answers your request — anonymously, through Witbitz, as described above.

Keepwarden's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. Settings → Account & connections → Disconnect removes the connection from your room and from the Sentinel. You can also remove Keepwarden's access at any time at myaccount.google.com/permissions.

Siri

If you turn on Siri, what you say to the Shortcut is sent to the Witbitz Sentinel, encrypted to a key that only your device holds, and waits there until your device collects it into your inbox.

Your account

You sign in to Witbitz with your email address and a one-time code. Witbitz uses your address to decide who may open your room. Keepwarden does not send your address anywhere else.

Deleting your data

Signing out removes everything Keepwarden kept on that device.

To delete your room itself, write to support@keepwarden.app from the address you sign in with, and tell us your room's id (Settings → Your room). We delete it at Witbitz completely and at once: its messages, files and images, the confidential tier's copies, and every stored version of each. Afterwards it cannot be opened by anyone, from any device.

• Witbitz's database keeps a 35-day point-in-time recovery of room records. These hold no messages — only the room's encrypted configuration — and they expire on their own.
• The AI model's provider that answered your turns may keep its own logs, under its own terms — but your turns reached it anonymously, from Witbitz, with no account, email or address of yours, so it cannot tie them to you (unless the text itself says who you are).

What we keep about you: nothing

Keepwarden keeps no data about you. It has no accounts of its own, no analytics and no logs; your lists, your settings and your sign-in are in your room and with Witbitz, as described above — not with us.

The only personal data Keepwarden itself may ever hold is what you send us: an email to support@keepwarden.app, kept in our mailbox. Ask, and we delete it.

Your room is in your hands: you can change or delete anything in it from the app, and deleting it as a whole is described above.

Children

Keepwarden is not meant for children under 13, and we do not knowingly collect data from them.

Changes

If this policy changes, the new version will be published here with a new date. A change that affects how Google user data is used will be made only in line with Google's policies.