Privacy

Last updated: July 15, 2026

Klepto is designed to keep your collection on your device. There’s no account, no login, no profile. This policy describes exactly what data exists, where it lives, why we have it, and what you can do about it.

Who we are

Klepto is developed and operated by Brian Ewanchuk, based in Washington State, USA. Contact: [email protected].

What lives on your device

Your collection — items, photos, categories, notes, tags, locations, favorites, wishlist — is stored in a local database on your device. On iPhone, iPad, and Mac, it also syncs to your private iCloud database via Apple CloudKit (your Apple account, not ours). On Android, it optionally syncs to your private Google Drive (your Google account, not ours). We cannot access either cloud copy — the data is stored in per-user containers that only your device has credentials for.

What passes through our servers

When you scan a barcode, take an identification photo, refresh a market price, or perform a catalog search, the request goes to api.klepto.io. That request includes:

  • The barcode, image, or query text you’re identifying
  • A random per-device identifier (install ID) used only to enforce rate limits and prevent abuse
  • Standard connection metadata your device sends any web server (IP address, User-Agent, timestamp)

Images sent for identification are forwarded to the identification service, the response is returned to your device, and the image is not retained on our servers.

What we store server-side

  • Pseudonymous authentication tokens. On first launch, your device registers with our server and receives a token used to authenticate future requests. We store only a SHA-256 hash of the token, never the token itself. The token is not linked to your name, email, Apple ID, Google account, or any other personal identifier.
  • Rate-limit counters. Simple counts keyed by your install ID, so no single device can exhaust our API quota.
  • Bad-scan reports. If you use the “report a bad scan” feature, we store the barcode, your note, and the photo you attached, so we can improve the catalog. This is opt-in per report and disclosed at submit time.
  • Aggregate diagnostics. Anonymous timings and error rates for scans (which stage was slow, whether the scan succeeded). Not linked to your install ID.

What we do not collect

  • No email address, name, phone number, mailing address, or payment details
  • No location data
  • No contacts (on iPhone and Mac, the app can display avatars beside people you’ve shared collections with, but that lookup happens entirely on-device and nothing leaves your phone)
  • No advertising identifiers (IDFA, GAID)
  • No tracking cookies or cross-app / cross-website tracking
  • No third-party analytics SDKs (Google Analytics, Firebase, Amplitude, Mixpanel, Sentry, etc.)
  • No advertising networks

We do not sell, rent, license, or share your data with anyone for marketing purposes.

How we use the data we have

  • Authentication tokens and rate-limit counters are used solely to keep the API working and prevent abuse.
  • Bad-scan reports are reviewed to improve identification accuracy and update our catalog data.
  • Aggregate diagnostics help us find performance regressions before they hit users at scale.

We do not build profiles, do not use your data to train third-party models (see the third-party section below for what we send them), and do not perform automated decision-making that has legal or similarly significant effects on you.

Third-party services we call

Identification requests may be forwarded to third-party catalog and vision services on your behalf:

  • Anthropic (Claude vision API) — for photo-based identification. Anthropic’s policy: anthropic.com/legal/privacy.
  • Catalog APIs — go-upc, UPCitemdb, iTunes, OMDb, Discogs, Brickset, Rebrickable, TheGamesDB, BoardGameGeek, ComicVine, Scryfall, TCGdex, YugiohProDeck, GBIF, Numista, and others, depending on category. See “Credits & Attribution” inside the app for the current full list.
  • Cloudflare — hosts our API infrastructure and terminates TLS. Cloudflare’s policy: cloudflare.com/privacypolicy.

Requests forwarded to third parties include the identification query but not your install ID, name, or any personal information. Each service has its own privacy policy governing what they do with the request; we only include the minimum needed to get a result.

Payments

Paid features, if any, are sold through the Apple App Store (iPhone, iPad, Mac) or Google Play (Android). Apple and Google handle all payment processing, billing, and refunds — we never see your card number, address, or Apple/Google account details. Subscription management, if a subscription tier exists, happens in your device’s App Store or Google Play settings.

International data processing

Klepto’s infrastructure runs on Cloudflare’s global edge network. Requests may be processed at the Cloudflare data center closest to you, which may be outside your home country. Cloudflare provides data-transfer protections for EU/UK personal data under Standard Contractual Clauses. Because we do not collect personal identifiers linked to your identity, the transfer risk to you is minimal.

Your rights

  • Delete server data. In the app, open Settings → Reset & Delete → Delete Server Data. This wipes your authentication token, rate-limit counters, and any bad-scan reports you filed (including their photos) from our servers. It does not touch your item collection, which lives on your device and your iCloud / Google Drive.
  • Delete your local collection. Delete the app. Your local database goes with it. To also remove synced copies, delete Klepto’s data from iCloud settings (iOS/Mac) or your Google Drive appDataFolder (Android).
  • Export. In the app, open Settings → Export to export your collection as PDF or CSV.
  • Access, correct, or ask questions. Email [email protected].

We honor deletion, access, and portability requests regardless of jurisdiction. If you’re in California, the EU, the UK, or Canada, you have the rights above under CCPA/CPRA, GDPR, UK GDPR, or PIPEDA respectively — exercised the same way.

Data retention

  • Local device data: as long as the app is installed and you keep it.
  • iCloud / Google Drive sync data: as long as you keep it in those accounts.
  • Authentication tokens (hashed): 90 days from issue; renewed automatically on use, revoked on request.
  • Rate-limit counters: reset daily; retained no longer than 30 days for abuse investigation.
  • Bad-scan reports (with attached photo): retained until the reported catalog issue is resolved, or you request deletion via the app.
  • Aggregate diagnostics: 90 days.
  • Server access logs: 30 days.

Security

We use TLS in transit, hash authentication tokens before storage, and scope database queries by install ID so one device’s request cannot access another’s data. No system is perfectly secure; if we ever discover a breach affecting your data, we will notify you at the contact email you have on file (if any) and post a disclosure at klepto.io.

Children

Klepto is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided personal information to Klepto, contact us at [email protected] and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be announced via an in-app notice before they take effect. The “Last updated” date at the top of this page always reflects the current version.

Contact

Questions, complaints, or requests: [email protected].