Privacy at Kelavi

An email address to create your account, and the photos you choose to upload. That's it — Kelavi doesn't ask for your name, a phone number, or payment details to use the core product.

Reading a photo's location and date, and checking whether it's sharp/high-resolution enough and not a near-duplicate of one you just added, all happen on your own device — before anything is uploaded. You then choose, per photo, whether to keep it as a “memory” (the photo itself is kept) or just mark the place and date (the photo file never leaves your device).

• Precise location and date — encrypted (AES-256-GCM) before it's ever written to our database. Only ever decrypted for you, or for someone you've shared your map with.
• Photos you keep as memories — stored in a private area that isn't publicly accessible; every view is a short-lived link generated at the moment your map is actually opened.
• City and country names — resolved once when you add a photo (so chapters can show “Lisbon” instead of just coordinates), stored as plain text. This is less precise than the exact coordinates already shown on the map itself to anyone allowed to view it, so it isn't a separate exposure.
• A coarse, approximate location marker (accurate to roughly 150km — nowhere near precise enough to identify a specific place) and the year a photo was taken. Not currently used for anything visible in the product; kept ready for a possible future anonymized map feature that doesn't exist yet.
• Map title and chapter notes — plain text you've written yourself.
• Your sharing setting and any invite/public links that come with it.
• Account information — your email address, display name, timezone (used only to know your own local day for something like “on this day”), and your notification/email preferences.
• A short record of what Kelavi sent you — the type and channel (email/push) of each message and when, so we don't send you the same thing twice or more than the limits described below. Never the content of the message itself, and never your precise location.
• A basic signal that your shared map was viewed — enough to tell you “someone looked”, never who. Automated/crawler requests (e.g. a messaging app generating a link preview) and your own visits to your own shared link are excluded before anything is recorded.

Kelavi doesn't sell your data, doesn't use it for advertising, and doesn't build a profile of you to target ads elsewhere. There is no advertising or marketing-tracking technology in the product today.

Precise coordinates and capture dates are encrypted with a key that only Kelavi's servers hold — never a plain-text database column. They're decrypted, server-side, only to render your map (or a map you've been given access to).

A photo you don't explicitly keep as a memory is never uploaded — Kelavi only ever sees what it needs to place a dot on the map (location and date), read on your own device. A kept memory photo lives in a private storage area and is only ever served through a short-lived signed link, never a public URL.

Your map is private by default — visible only to you. Invite only lets you generate a link you control and can revoke at any time. Public makes your map reachable by anyone who has the link — it is never listed anywhere or made searchable, and switching to it is always something you choose explicitly, never a side effect of another action like sharing.

Kelavi only asks for notification permission when you explicitly choose to turn notifications on — never automatically. Account has four categories (memory reminders, map activity, sharing activity, and a monthly reflection), each with its own email and/or push toggle, so turning one off never silently affects another. Kelavi updates (product news) is a separate, always-off-by-default choice, kept apart from anything about your own map. Messages are only ever sent when something in your own map/sharing history actually justifies it — Kelavi doesn't send reminders on a fixed schedule just to bring you back, and caps how often it sends anything at all (at most a couple of pushes and one email a week, one reflection a month).

Kelavi has no analytics provider connected today. If that changes, analytics will stay off until you explicitly allow it — see Cookies for the full, up-to-date breakdown and your current setting.

A Kelavi Print is a one-time purchase, not a subscription. When you buy one, we store an order: its id, the payment id from our payment provider, the amount, the currency, the product, the payment state, and the print setup you chose (size, layout, your title and your own line, and which memories you picked). No photo data and no coordinates are ever copied into a payment record.

Kelavi does not keep the finished file. There is no stored PDF and no public download link: the print is rebuilt from your own map each time you download it, and streamed only to you while you're signed in. That also means a print follows what your Kelavi holds today — and once you delete your Kelavi, it can't be made again. The copy you already downloaded stays yours.

Our payment provider receives what it needs to take a payment and an order reference. It never receives your map title, your places, your chapters, your notes or your photos.

After you delete your account, order records may be kept only as long as tax and accounting law requires. That is payment administration — an amount, a date, a payment id — and is kept separately from any content: no photos, no locations, no notes.

Kelavi is a place to curate and keep meaning, not a photo backup or permanent archive. Don't rely on it as the only copy of anything: keep your own originals, and download what you want to keep. Deleting your Kelavi is meant to be a normal thing to do, not a loss.

From Account, deleting your account removes your stored photos immediately, then deletes the account itself — which automatically removes every place, chapter note, share link, notification setting and print order tied to it. There are no generated print files to remove, because none are kept. This happens right away, not after a waiting period, and can't be undone.

You can access, correct, export (by viewing your own map), or delete your data at any time from Account — most of this is self-service by design, rather than something you need to request from us.