Privacy Policy

Effective date: 9 April 2026

Kepthouse is an independent app and is not affiliated with, endorsed by, or connected to the UK government, the DVLA, DVSA, Companies House, any local council, or any other government entity. Vehicle, MOT, EPC, company and bin collection information shown in the app is sourced from the official UK government services listed in section 6 below. Your use of this information is solely at your own risk.

Kepthouse ("the App") is a home maintenance management app for Android, developed and operated by Kepthouse ("we", "us", "our"). This policy explains what data the App collects, how it is used, and your rights.

1. Data We Collect

The App stores the following data locally on your device:

• Your name (entered during onboarding, used only for display within the App)
• Maintenance tasks, warranties, appliances, subscriptions, and service contacts you create
• Photos and documents you attach to items
• App preferences (theme, currency, backup settings)

We do not collect, transmit, or have access to any of this data. All data is stored in a local database on your device.

2. Google Drive Backup

If you choose to enable backup, the App uses the Google Drive appDataFolder scope to store encrypted backup files in your own Google Drive account. This is a hidden, app-specific folder that only Kepthouse can access.

• Backups contain your database and attached files, bundled in a ZIP archive
• Backups are stored in your Google Drive storage, not on our servers
• We cannot see, access, or retrieve your backup data
• You can delete backups at any time from within the App or via Google Drive settings

When you sign in with Google, the App receives your email address and a scoped access token. These are used solely to authenticate with Google Drive and are not transmitted to us or any third party.

3. Analytics & Crash Reporting

The App uses Firebase Crashlytics to collect crash reports when the App unexpectedly closes. Crash reports include device model, OS version, and a stack trace of the error. This data is used solely to identify and fix bugs.

The App uses Firebase Analytics to collect anonymous usage data including daily active users, session counts, screen views, and device information (model, OS version, screen size). This data is aggregated and anonymous — it tells us how many people use the App and which features are popular, but it cannot identify individual users. No personal data, item content, or app data is included in analytics.

The App does not use advertising identifiers. We have explicitly blocked the Google Advertising ID (AD_ID) permission. No advertising SDKs or behavioural tracking are included.

4. Location Data

When you use the "Find my address" feature on a property or contact, the App requests access to your device's GPS location. This permission is requested on demand — only when you tap the location button — and is never accessed in the background.

• Your GPS coordinates are used to determine your approximate street address via a geocoding lookup through our server (kepthouse.app), which forwards the request to the OpenStreetMap Nominatim service
• The resulting latitude and longitude are stored locally on your device alongside the associated property or contact
• Coordinates are included in Google Drive backups if you have backup enabled
• Your GPS coordinates are not logged or stored on our server — the geocoding request is forwarded and the response returned in real time
• Location data is also used to display your properties and contacts on a map within the App, using OpenStreetMap map tiles downloaded directly to your device

You can deny or revoke location permission at any time in your device settings. The App will continue to work without it — you can enter addresses manually and use the "Show on map" button to geocode typed addresses without GPS.

5. Calendar Import

If you use the Calendar Import feature, the App reads your Google Calendar data (calendar names, event titles, dates, descriptions, and recurrence rules) using read-only access. This data is processed locally on your device to create tasks and subscriptions. Calendar data is not transmitted to us or any third party. The App does not modify or delete your calendar events.

6. Government Data Lookups

Kepthouse is not affiliated with any government entity. The App surfaces publicly available information from official UK government services. The official sources are listed below, and you can verify any information shown in the app by visiting them directly:

• Vehicle tax and details — DVLA Vehicle Enquiry Service: https://vehicleenquiry.service.gov.uk/
• MOT history — GOV.UK Check MOT history: https://www.gov.uk/check-mot-history
• Energy Performance Certificates — GOV.UK Find an energy certificate: https://www.gov.uk/find-energy-certificate
• Limited company verification — Companies House: https://find-and-update.company-information.service.gov.uk/
• Bin collection schedules — sourced from individual UK local council websites. Find your council: https://www.gov.uk/find-local-council

When you use an optional lookup feature, the following data is sent from your device to our server (kepthouse.app), which forwards the request to the relevant service and returns the result to your device:

• DVLA Vehicle Lookup — your vehicle registration number is sent to the DVLA Vehicle Enquiry Service to retrieve MOT status, tax status, and vehicle details. The registration number is not stored on our server.
• EPC Lookup — your property postcode is sent to the EPC Register (Open Data Communities) to retrieve Energy Performance Certificate data. The postcode is not stored on our server.
• Companies House Lookup — a company name is sent to the Companies House API to check registration status. The company name is not stored on our server.
• Bin Collection Schedule — your postcode (and house number or name) is sent to our server which looks up your local council and retrieves the collection schedule. Neither is stored on our server.
• Address Geocoding — an address or GPS coordinates are sent to the OpenStreetMap Nominatim service (via our server) to convert between addresses and map coordinates. Addresses and coordinates are not stored on our server. Geocoded coordinates are stored locally on your device. Nominatim is a free, open-source geocoding service operated by the OpenStreetMap Foundation.

The information returned by these services may be incomplete, delayed, or incorrect. Always verify important details with the official source before making decisions.

Our server acts as a proxy to keep government API keys secure. No user data is logged or stored on our server — requests are forwarded and responses are returned in real time. The data retrieved (vehicle details, EPC ratings, company status, bin collection schedules, plant care data) is stored locally on your device as part of your items.

These lookups are optional and only triggered when you explicitly tap a "Look up" button, or when the automatic daily background refresh runs for items you have previously looked up. Auto-refresh is enabled by default and can be toggled per-source on the More screen.

Shared response caching. For efficiency and to stay within third-party API rate limits, some public-record responses are cached on our server by their public identifier only (for example, a company number on Companies House, or a bin schedule by council + postcode). The cache holds the same public information anyone could look up directly. No user ID, device ID, or account link is stored alongside cached data.

The government APIs have their own privacy policies:

• DVLA Privacy Policy
• EPC Register Privacy Policy
• Companies House Privacy Policy

7. Third-Party Services

The App uses the following third-party services:

• Google Sign-In — for authenticating Google Drive backup and Google Calendar import. Subject to Google's Privacy Policy.
• Google Drive API — for storing and retrieving backup files in your own account.
• Google Calendar API — for reading calendar events during import (read-only access). No events are modified or deleted.
• Google ML Kit (on-device) — for OCR text recognition on receipts. All processing happens locally on your device; no images are sent to Google's servers.
• Firebase Crashlytics — for collecting crash reports. Crash data is sent to Google's Firebase servers. No personal data or app content is included.
• Firebase Analytics — for collecting anonymous, aggregated usage statistics. No personal data or app content is included.
• Google Play Billing — for processing subscription and one-time purchases. Payment data is handled entirely by Google Play; we do not see or store payment details.
• DVLA Vehicle Enquiry Service — for retrieving vehicle tax and MOT data. See section 6.
• EPC Register (Open Data Communities) — for retrieving Energy Performance Certificate data. See section 6.
• Companies House API — for verifying company registration status. See section 6.
• OpenStreetMap / Nominatim — for geocoding addresses and displaying maps. Map tiles are downloaded directly from OpenStreetMap tile servers. Geocoding requests are proxied through our server. Subject to the OpenStreetMap Foundation Privacy Policy.

8. Data Sharing

We do not share, sell, or transfer your data to any third party. The App operates entirely offline except when you explicitly trigger a Google Drive backup, calendar import, data lookup, address geocode, or purchase. Anonymous analytics and crash data are sent to Google's Firebase platform as described above.

9. Data Retention and Deletion

Kepthouse does not store any of your data on our servers. All your items, photos, and settings are stored locally on your device. The only data transmitted from your device is anonymous crash reports and usage statistics collected by Firebase, which cannot identify you personally.

To delete your data:

• Uninstall the App — this permanently deletes all local data including items, photos, and settings
• Google Drive backups — remain in your Google account until you delete them manually (Google Drive > Storage > Backups)
• Firebase analytics and crash data — this data is anonymous and aggregated. It cannot be linked to you and is automatically retained according to Google's Firebase data retention policy

If you have any questions about deleting your data, contact us at support@kepthouse.app and we will help.

10. Children's Privacy

The App is not directed at children under 13. We do not knowingly collect personal information from children.

11. Security

Your data is stored locally using Android's app sandbox, which prevents other apps from accessing it. Google Drive backups use Google's own security infrastructure and your Google account credentials.

12. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the App after changes constitutes acceptance of the revised policy.

13. iOS Waitlist (kepthouse.app/ads)

Kepthouse is currently an Android-only app. If you visit one of our ad landing pages at kepthouse.app/ads/ from an iOS device, you may be offered a form to join a waitlist. If you submit your email address:

• Your email is stored in a private log file on the Kepthouse web server, alongside the date, which ad topic you came from, and a one-way hash of your IP address (used only for rate-limiting to prevent spam).
• Your email is also forwarded to support@kepthouse.app so we know there is a new waitlist signup.
• We will only ever use your email to send a single notification message when the iOS version of Kepthouse is released. No marketing newsletters, no third parties, no sharing.
• Your email and the waitlist record are deleted within 90 days of the iOS version launching (or within 90 days of your request, whichever is sooner).
• You can request deletion at any time by emailing support@kepthouse.app from the same address.

Submitting the form constitutes your consent under UK GDPR. Legal basis: consent (Article 6(1)(a)).

14. Web Bin Schedule and Calendar Subscription (kepthouse.app/ads/bin-day)

The Bin Day landing page offers a free, temporary web tool that looks up your local council’s bin collection schedule and lets you subscribe to it as an Apple/Google Calendar feed. This is an interim feature for users who cannot install the Android app yet and will be retired when the Kepthouse iOS app launches.

If you use this feature:

• Your address is never stored on our servers. When you submit your postcode and house number, we look up the address via the OpenStreetMap Nominatim service to obtain the latitude/longitude, then call our existing council bin schedule service to fetch your collections. The address itself is not written to any database or log file on Kepthouse infrastructure.
• The calendar subscription URL contains a signed token. The token is an HMAC-signed encoding of your latitude/longitude (rounded to ~1m precision), the council identifier, and your Unique Property Reference Number (UPRN). We do not store this token on our servers either — the URL itself is the only record. When your calendar app polls the subscription URL, the server verifies the signature, decodes the location, and re-fetches the bin schedule live.
• Lookup logs. When you fetch a schedule, our access logs (managed by our hosting provider) record the request URL and a hash of your IP address for the standard duration that web servers keep access logs (typically 30–90 days). The logs do not contain the address, only the encoded token and timestamp.
• Calendar subscription cache. To reduce load on the bin scraper, the rendered iCal output is cached on the server for up to 6 hours per token. The cache is keyed by token only and is automatically purged after the cache window.
• Third parties used to provide this feature:
  • OpenStreetMap Nominatim — for forward geocoding (address → latitude/longitude). Their usage policy applies to their service.
  • UKBinCollectionData (open source) — the underlying bin schedule scraper that fetches your council’s public bin schedule data.
• Stop using the feature. Delete the calendar subscription from your calendar app at any time. Because your address is not stored server-side, there is nothing else to delete.

Submitting the address form constitutes your consent under UK GDPR. Legal basis: consent (Article 6(1)(a)). When the iOS app launches and this web tool is retired, your subscription URL will simply stop returning new bin events.

15. Contact

If you have questions about this policy, contact us at:
support@kepthouse.app