GraftKeeper is built to keep your recovery on your phone. This policy explains the few cases where data leaves it, why, and what you can do about it.
Who we are
GraftKeeper ("we") is the controller for the limited personal data processed on our servers. Contact: privacy@graftkeeper.com. Our company details, EU representative and Turkish data controller registration (VERBIS), where required, will be listed here before launch.
Data that stays on your device
Your journey (surgery date, technique, graft counts), photos, symptoms, medication, washes, check-ins, notes, the proof vault and imported chats are stored only on your device, in the app's protected storage. We do not receive them and cannot see them.
Photos are not added to your photo library or to iCloud. EXIF and GPS data are removed from any copy that leaves the app.
Data that reaches our servers
Only in these cases, each with its own purpose and legal basis:
- Device registration: a random install identifier, platform, app version and language, to deliver content updates and settings (legitimate interest).
- Account (optional): if you sign in with Apple or Google we receive an identifier and, if you allow it, an email address (contract).
- Clinic sharing: the items you choose to share with a clinic you select, kept until you revoke the share (explicit consent, GDPR Art. 9(2)(a)).
- Community (optional, off at launch): your posts, replies and photos you post, with faces blurred on your device (explicit consent).
- Encrypted backup (optional): ciphertext we cannot decrypt, plus its size and date (contract).
- Time-stamping: the SHA-256 fingerprint of a file, never the file, forwarded to a time-stamping authority (contract).
- AI features (Pro, optional): text you submit, with phone numbers and emails removed on your device, processed to produce an answer and not used for training (explicit consent). Photos are never sent.
- UV index: your location rounded to about 10 km, to look up the UV index (legitimate interest).
- Usage analytics: anonymous screen views and feature counts keyed to the install identifier. Never a symptom, photo, medication or triage outcome (legitimate interest).
Who processes data for us
Hosting in the EU (Hetzner, Germany or Finland), object storage in the EU, Apple and Google for sign-in and notifications, RevenueCat for subscription status, Anthropic for optional AI text features, and an RFC 3161 time-stamping authority. Each processes only what is described above. We sell no data and use no advertising or marketing SDKs.
How long we keep it
Shares: until you revoke them or delete your account. Community content: until you delete it or your account. Backups: until you delete them. Device registrations without activity: 24 months. Server logs: 30 days.
Your rights
You can access, export, correct and delete your data, withdraw any consent at any time (one tap in Settings → Privacy), and object to processing. Deleting your account in the app removes everything we hold about you on our servers.
You can also complain to your data-protection authority (in Türkiye, the KVKK Authority). Write to privacy@graftkeeper.com with any request.
Children
GraftKeeper is not intended for anyone under 18. The community requires an 18+ confirmation.
Changes
We will tell you in the app before any change that affects how your data is used, and ask for consent again where the law requires it.