Privacy

The short version

• This website sets no cookies, runs no third-party analytics, and shows no ads. We count visits as daily totals that identify nobody.
• If you join the interest list we keep your email address, whatever you typed in the note, and whether you ticked the feedback box. We use it for early access and nothing else.
• If you have an account, what your household puts in it — projects, tasks, quotes, tradespeople — is visible only to the people in that household.
• Quote PDFs are stored in the European Union and read once by an AI model under instructions not to keep them and not to train on them.
• We don’t sell anything, we don’t run advertising, and we don’t hand your data to anyone for their own marketing.
• You can delete your account from inside the app, and you can write to us to be erased from the interest list. They’re two different things — §10 says exactly what each one removes.
• Anything at all: privacy@keelwell.co.uk.

Who we are

Keelwell is built and run by one person — a private individual based in the United Kingdom — who is the data controller for everything described on this page. There is no company behind it and no support desk.

The operator’s name and postal address are a home address, so they aren’t published here. Ask at the contact address below and you’ll be given them.

How to contact us

Write to privacy@keelwell.co.uk — about anything on this page, or to exercise any of the rights in §12. We answer data-rights requests within one month.

Mail to that address lands in a mailbox hosted by Fastmail, so Fastmail holds whatever you write to us. A data-rights request identifies you by its nature, which is why we say so here rather than leave you to guess. See §11.

The website (keelwell.co.uk)

This domain sets no cookies and loads nothing from a third party — no fonts, no scripts, no tag managers, no embedded anything.

• Visit counts. When someone opens the home page we add one row for that day: the date, the hostname of the site they came from (if any), and a running count. No other page is counted — not this one. No IP address, no cookie, no page path, nothing tied to a person. It answers “did anyone arrive from that link”, and it cannot answer anything about you.
• Rate limiting on the interest form. To stop the form being flooded we store a SHA-256 hash of your IP address combined with a time window — never the address itself, and it can’t be reversed into one. Rows older than about 24 hours are deleted.

The interest list and invite emails

If you register your interest we store your email address, the optional note about your renovation (up to 1,000 characters), and whether you ticked the box agreeing to be contacted for feedback, with the time you did. Our lawful basis is your consent.

Invite emails are the thing you signed up for. Every one carries a working opt-out link, and one click is enough — you don’t have to reply or log in.

Opting out writes a suppression record — your email address and the time — which we keep indefinitely. That record is the opt-out doing its job: it is what makes sure a later import can’t quietly put you back on the list. It deliberately survives erasure, because deleting it would undo the very thing you asked for.

Ask us to erase you and we delete your registration and every record of an invite sent to you. The suppression record stays.

The app (keelwell.app)

• Your account. Email address, display name, and your password stored as an argon2 hash — never as plaintext, and not recoverable by us.
• Your household. Everything in the app belongs to a household rather than to one person. Only the people you invite into yours can see your projects, tasks, quotes and tradespeople. Other households cannot, and this is enforced in the database itself, not only in the screens.
• The session cookie. One cookie, keelwell_session, set only on keelwell.app. It is what keeps you logged in — strictly necessary, HttpOnly, and good for 30 days from your last use. It carries no tracking and follows you nowhere. The website domain in §4 sets no cookie at all; the two are separate.
• Your theme preference. Light or dark is remembered in your own browser’s local storage. It is never sent to us.
• Turnstile. Cloudflare’s bot check runs on the registration and password-reset forms only — nowhere else in the app. We pass it a challenge token and deliberately withhold your IP address, and we store nothing from it.
• Email we send you. Transactional only: address verification and password resets. Lawful basis: performance of our contract with you. The security measures around your account rest on our legitimate interest in keeping it from being taken over.
• Arrival counts. The app is invite-only for now. When someone arrives without an invite we add one to a daily count — the date and a number, nothing else. Same shape, and same limits, as the website counter in §4.

Your quotes and PDFs (the AI part)

A quote PDF is usually the most revealing document in a renovation — your address, your builder, what you’re paying. So this section is specific.

• Where the file lives. Uploaded PDFs are stored in Cloudflare R2 in the European Union, in a bucket created under Cloudflare’s EU jurisdiction setting. The original filename is kept with the file.
• The one read. When you save a quote, the PDF is sent once to an AI model reached through OpenRouter, to pull out the figures and dates so you don’t have to type them. Every single request carries zero data retention and an instruction that your data is not used to train models. What comes back is stored on your quote; you can see it and correct it.
• Tradesperson websites. If you add a tradesperson’s website, we read the public pages at that address the same way and under the same instructions, to work out what they do. The text we read is cached and re-read after 7 days.
• Where the reading happens. OpenRouter routes each request to a model provider, and that inference may take place outside the UK and the EEA. We can’t promise otherwise, so we don’t. The retention and training instructions above travel with every request wherever it lands.

People you add (tradespeople)

Members of a household can store the details of tradespeople they work with — name, trade, phone number, website, notes. Those people didn’t sign up here, so two things are worth saying plainly: the details are visible only to that one household, and they are never used to contact anyone or shared with anyone else.

If you’re a tradesperson and you think a household here holds your details, write to the contact address. We’ll tell you what is stored and pass a removal request to the household that entered it.

How long we keep things

These are the windows as the system actually behaves today, not aspirations.

• Interest registrations. While the early-access programme runs, or until you ask us to erase them.
• Opt-out (suppression) records. Indefinitely, by design — see §5.
• Invites. An invite is valid for 30 days. The record that we sent you one is kept as provenance afterwards, including after you delete an app account — only an interest-list erasure removes it. See §10.
• Sessions. A session expires 30 days after you last used it. Once expired it stops working immediately; the spent record itself is cleared when your account is deleted.
• Password-reset and verification links. One hour and 24 hours respectively, single use, and stored only as a hash.
• Accounts nobody ever verified. If no one in a household has confirmed their email address after about 7 days, the household and its accounts are removed.
• Your household’s own content. Projects, tasks, quotes and stored PDFs stay until you delete them or the household is deleted. We don’t expire your work.
• Cached tradesperson website text. Re-read after 7 days. To be straight with you: the superseded cache entry is not currently deleted on a schedule. It holds text that was public on that website.
• Daily counts. Kept indefinitely. They contain no personal data — that is the whole reason they’re built that way.
• Rate-limit hashes. About 24 hours.

Deleting your data

There are three separate routes, and they remove different things. Most policies blur this into one sentence; blurring it would make ours untrue.

Deleting your account, from inside the app

Removes your login: email address, password hash, display name, and your sessions. What your household shares — projects, tasks, quotes, tradespeople — stays with the household, with your name detached from the “who added this” record, so the people you were renovating with don’t lose their work.

If you were the last person in the household, the household goes too, and with it every project, task, quote, stored PDF, and the household’s AI key.

One thing it deliberately does not remove: the record on the interest list that you were invited to early access. That lives outside your account, and only the erasure route below removes it.

Deleting your household

If you’re its only member, you can delete the whole household. Everything in it goes, including the PDFs held in object storage.

Erasing you from the interest list

Write to privacy@keelwell.co.uk and we delete your registration and every invite record we hold for you. If you had opted out, the suppression record from §5 stays — indefinitely — so you can’t be re-invited by accident.

Who else processes your data

A short list, and it is the whole list.

• Cloudflare. Hosting for this website and the app, the container the app runs in, object storage for your PDFs (EU, per §7), the database behind the interest list, Turnstile, and the sending of our email.
• Neon. The app’s PostgreSQL database — accounts, households, projects, tasks, quotes. Hosted in Frankfurt, Germany.
• Fastmail. Mail hosting for privacy@keelwell.co.uk. Whatever you send to the contact address is held there.
• OpenRouter, and the model providers it routes to. The AI reads described in §7, under the zero-data-retention and no-training instructions sent with every request.

Each of these keeps its own operational logs — which will include IP addresses — as part of running its service. Those logs are theirs; we don’t hold them and can’t search them for you.

Your rights

Under UK data protection law you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable form, and object to our processing it.

To use any of them, write to privacy@keelwell.co.uk. There’s no form and no fee, and we’ll reply within one month.

If we get it wrong, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. We’d rather you told us first, but that’s your call, not ours.

Changes to this policy

When something changes we update this page and change the date at the top. The page only ever describes what the system actually does — so a change here means the software changed first.