Privacy Policy

01

Keyfren is operated by BB Solutions, S.A., a company organized under the laws of the Republic of Panama and based in Panama City, Panama ("BB Solutions", "we", "us").

BB Solutions is the controller of the personal data described on this page. You can reach us at support@keyfren.com.

02

Your account: an email address, a phone number you verified by SMS, or a Google account if you choose to sign in with Google. If you sign in with Google, we receive your email address, name, and Google account ID. Signing in does not by itself give us access to your Google Contacts or Calendar. If you set a password, we store only a bcrypt hash, never the password itself.

The date of birth you provide during profile setup is saved as the birthday on your profile for birthday features and to confirm you are old enough to use Keyfren. You can edit or remove it in Profile settings. If the date shows you are under 13, you cannot finish setting up Keyfren.

If you add a profile photo, we store it with Neon, our database and file storage provider. The photo is kept at a link that is hard to guess but not password-protected, so anyone who has the link can open it. It is shown to people you connect with through your Keyfren ID if you choose to share your photo with them.

If you sign up by phone, Twilio processes your number and a one-time code to confirm that you control the number.

Your contacts and everything you record about them: names, phone numbers, email addresses, notes, tags, and the dates you last spoke.

Messages you record in Keyfren, calendar events you create or connect, and any older email records already stored in your account.

03

Connecting Google is optional. Keyfren asks to read your Google Contacts and Calendar, and for permission to manage calendar events when you ask it to schedule one. The Contacts connection cannot edit or delete your Google contacts.

From Google Contacts we import contact names and details. From Calendar we read event times, titles, locations, and attendees. Keyfren may add an event to your calendar when you ask it to schedule one.

The access tokens for these connections are encrypted before they are stored, using a key held separately from the database. Disconnecting an integration in Settings deletes its stored token.

Importing phone contacts does not import SMS or iMessage conversations.

Keyfren's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide and improve the features you see in Keyfren. We do not sell it, we do not use it for advertising, we do not use it to train AI or machine-learning models, and no human reads it except where you ask us for support, where it is needed to investigate abuse, or where the law requires it.

04

Most of the people in your Keyfren account never signed up for Keyfren, and we think that deserves saying plainly rather than burying it.

What we hold about them, their name, contact details, your notes, and the history of your conversations, exists for one purpose: helping you, the account holder, keep up a relationship you already have. We do not use it for anything else, we do not sell it, we do not build profiles from it, and we do not combine it with data from other accounts.

Nobody else sees it unless you deliberately share a specific contact, and then only that contact and only with the person you chose.

You are responsible for having a legitimate reason to keep information about the people you know, and for honouring any request they make of you about it. If someone asks you to remove them, you can delete that contact and everything attached to them from your account at any time.

05

We use it to run the product you are using: showing your contacts, ranking who is worth reaching out to, and scheduling meetings you ask us to schedule.

We do not sell it. We do not use it to build advertising profiles.

Keyfren does not send your contacts or messages to any AI service.

06

While your account is open, we keep what you put in and what you connected, because the product is a memory and deleting it silently would defeat the point.

When you delete your account, it is removed from the live product immediately and in full, and any Google access we hold is revoked at the same time. Copies held in our database provider's routine backups may persist for up to 30 days until they expire in the ordinary course. How to delete your account is explained under "How to get your data out, or delete it" below.

Deleting an individual contact removes that contact along with its stored history and notes.

07

Other Keyfren users cannot see your data. Isolation is enforced by the database itself through row-level security, not only by application code.

If you deliberately share a contact with someone, they can read what you shared, and only that.

We use a small number of service providers to operate: Neon (database and profile photo hosting), Render (application server hosting), Vercel (serves the Keyfren website and app files, and keeps standard request logs such as IP address and browser type, but never receives your account data), Resend (account emails such as password resets), Twilio (SMS verification codes for phone sign-up), and PostHog, which we use two separate ways below.

First, if a request to our server fails unexpectedly, we send PostHog the technical details, what kind of error, which endpoint, nothing about you personally, so we can fix it. That happens regardless of your analytics choice below, the same way it would with any error-monitoring tool: it is about keeping the service working, not about tracking you.

Second, if you accept analytics, we also use PostHog in your browser to count page views and basic device and browser information. That part is switched off until you accept, it never records your screen, and it never receives your contacts or the text of your messages. You can change your mind in Settings at any time.

Third, on the public marketing site at keyfren.com (not inside the signed-in app, and never on any page that shows your contacts or messages), we use the Meta Pixel and the Google Ads conversion tag to measure how our ads perform, if you accept marketing cookies. Both are switched off until you accept, and we have turned off Meta's automatic data collection, so neither receives your email, name, phone number, or any other personal data. You can change your choice at any time through the "Cookie preferences" link in the site footer.

08

We treat everything in your account as sensitive: your contacts, your notes about them, your messages, your calendar, and the access you grant us to Google. These are the safeguards in place today.

In transit: all traffic between the Keyfren app and our servers is encrypted with HTTPS (TLS), and browsers are told to connect to us only over HTTPS. The connection between our server and the database is encrypted with TLS as well.

At rest: our database provider, Neon, encrypts stored data on disk. On top of that, Keyfren encrypts the access tokens for your Google connections itself, with AES-256-GCM and a key held separately from the database, so a copy of the database alone would not reveal them. Passwords are never stored, only a bcrypt hash.

Separation between accounts: row-level security in the database refuses to return one user's data to another user's requests, so isolation does not depend on our application code alone being bug-free.

Access by our team: our admin tools show only aggregate figures, such as how many accounts exist, never the contents of anyone's contacts, notes, or messages. Direct access to production systems is limited to the people at BB Solutions who operate Keyfren, and is used only when you ask us for support, to investigate abuse or a security issue, or when the law requires it.

Collecting only what is needed: we ask Google for read-only access to Contacts, and for Calendar only the access scheduling needs. We do not send your contacts or messages to analytics, advertising, or AI services.

If something goes wrong: if we learn of a security incident that affects your personal data, we will notify you without undue delay and, where the law requires it, the relevant data-protection authority.

No online service can promise perfect security, and Keyfren has not yet completed an independent security audit. These are the measures we actually run, and we will update this section when they change.

09

BB Solutions operates out of Panama, but the database that holds your data and the server that runs the app are hosted in the United States. If you are in the EU, UK, or anywhere else with rules about moving personal data across borders, that means your data leaves your region to be processed.

We have not yet put a formal transfer mechanism, such as Standard Contractual Clauses, in place with our hosting providers. That is a real gap for a product this early, and one we intend to close as Keyfren grows rather than paper over.

If you are evaluating Keyfren for your team or company, we have a Data Processing Agreement template with the full detail on sub-processors and this transfer question: keyfren.com/dpa.

10

We process your data to provide the service you signed up for, which is our contract with you; because you asked us to, for optional things like Google connections and analytics, which you can withdraw at any time; and for our legitimate interest in keeping the service secure and working, such as the error monitoring described above.

Wherever you live, you can access, correct, export, and delete your data using the tools in Settings. If you are in the EU, UK, or another region with data-protection rights, you also have the right to object to or ask us to restrict processing, to withdraw consent, and to complain to your local data-protection authority. Write to support@keyfren.com and we will answer.

If you are someone in a Keyfren user's contacts and want to know about or object to what they hold, write to the same address. We cannot browse our users' accounts, so we will do what we reasonably can, which may include asking the account holder to remove you.

11

Settings has a "Download my data" button that gives you a single file containing everything we hold for your account: profile, contacts, messages, calendar events, older email records if present, and integration settings. You can also export just your contacts as CSV or vCard.

Settings also has a "Delete account" button. It is real and immediate: your account is deleted from the live product, and all contacts, messages, calendar events, shares, profile photos, and stored tokens attached to it are deleted with it.

If you had connected Google, we also ask Google to revoke the access you granted, so the connection does not outlive the account.

We do not require you to email anyone or wait for us to process a request. The button does the work.

12

Questions about any of this, or where to send a request: support@keyfren.com. Keyfren is operated by BB Solutions, S.A., Panama City, Panama.