Third-party services and data processing
These services handle technical data or purchases for Keeva. The tables below list the providers, their purposes, and the data they receive. Services that process data on our behalf are called sub-processors.
We commit to giving at least 30 days advance notice before adding a new sub-processor. We publish notice of changes on this page.
Current sub-processors (v1.0 — Android)
| Provider | Purpose | Data shared | Region | Provider DPA / Privacy |
|---|---|---|---|---|
| Google LLC (Firebase) | Error reporting (Crashlytics) — crash payloads + a device-instance UUID for grouping crashes | Device-instance UUID; crash stack traces (no user-typed content per our Privacy Policy) | United States, with regional processing per Google's data center policy | Firebase Privacy & Security · Google Cloud DPA |
| Google LLC (Firebase Analytics) | Optional usage analytics — disabled by default and sent only after the user opts in via Settings → About Your Data | App-instance / installation ID; bounded app-activity events; timezone user property when analytics is enabled | Google global (US-primary) | Firebase Privacy & Security · Google Cloud DPA |
| Google LLC (Play Store) | Play Store distribution; receipt validation | Google Play account ID (Play Store users only); purchase receipts | United States, with regional CDN | Google Play Terms |
| Google LLC (Firebase Remote Config) | App version kill switch (force-update fetch) — fetchAndActivate() called on cold start + onResume (5-min rate-limit) to enforce minimum app version | Firebase installation ID + app version + device locale | Google global (US-primary) | Firebase Privacy & Security · Google Cloud DPA |
Planned sub-processors (not yet active)
| Provider | Purpose | Data shared | Region | Provider DPA / Privacy |
|---|---|---|---|---|
| Apple Inc. | App Store distribution; paid-app purchase receipt validation (only if Keeva launches on iOS; not used for the current Android release) | Apple ID (when signed in to App Store), purchase receipts | United States (with regional CDN) | Apple Privacy Policy |
| IAP infrastructure (TBD) | Purchase and subscription records for optional future capabilities, if introduced | User identifier; subscription status; receipt metadata (provider TBD) | TBD | To be confirmed before this service is introduced |
If purchase services for optional new capabilities are introduced, they will be listed under "Current sub-processors". We will publish notice on this page at least 30 days in advance.
What we deliberately do NOT use
For transparency, here is what Keeva v1.0 does not delegate to any sub-processor:
- No backend application server — Keeva is local-first. Your habits, logs, notes, and photos live on your device, not on a Keeva server (a phone-to-phone transfer on Android 12 and later may also copy them to your new phone). An OS-level backup, if enabled, is managed by Google; see the Privacy Policy. Monthly memory photos are excluded from Google Drive backup.
- No Firebase Authentication — Keeva v1.0 ships without sign-in. No Firebase user account exists for you
- No Firestore / Firebase Cloud Storage — Keeva does not upload your habit data or monthly memory photos to either service. If Android device backup is enabled, Google may store a copy of the habit database and some of your settings in your Google Account; that OS backup is separate from Keeva and excludes the photos.
- No marketing analytics SDK (Mixpanel / Amplitude / Segment / etc.) — Keeva uses Crashlytics for default-on crash diagnostics and Firebase Analytics only for optional usage analytics, disabled by default
- No advertising SDK — Keeva is ad-free
- No direct payment processor — Paid-app purchase billing is handled by Google (and by Apple if Keeva later ships on iOS); we never see your card number
Cross-border transfers
The sub-processors above are headquartered in the United States. When you use Keeva from outside the US, your error-report data and (for Play Store users) Play account identifier may be transferred to and processed in the United States.
We rely on the safeguards each provider offers:
- Google (Firebase + Play) — the only sub-processors active in v1.0: Standard Contractual Clauses per Google Cloud DPA
- Apple (planned, not yet active): published privacy policy + EU-US Data Privacy Framework certification. No data reaches Apple today — this applies only if Keeva later launches on iOS.
- Future IAP infrastructure (when active): Standard Contractual Clauses per provider DPA, to be confirmed before the service is introduced
Change notification
We commit to publishing a notice of upcoming sub-processor changes at least 30 calendar days before the change takes effect. Notice is delivered via:
- This page's "Last updated" timestamp + change log below
Change log
| Date | Change |
|---|---|
| 2026-04-25 | Page created — initial sub-processor inventory for v1.0 launch |
| 2026-04-28 | firebase_remote_config row added per Wave 4 force-update kill switch ship + GDPR Art. 28 disclosure requirement |
| 2026-05-21 | Firebase Analytics row added and default-off / opt-in wording aligned with app privacy settings |
| 2026-07-31 | Cross-border safeguards re-ordered so Apple is shown as planned-not-yet-active, matching the tables above (v1.0 is Android-only — no data reaches Apple today); "No payment processor" corrected to "No direct payment processor". No sub-processor added — the 30-day advance-notice commitment is not engaged. |
| 2026-09-08 | Clarified installation identifiers without claiming complete anonymity. No provider added or data flow changed. |
| 2026-10-03 | Change notices are published on this page (no mailing list). Planned sub-processors carry no release timing; Apple applies only if Keeva launches on iOS. "No Firestore / Firebase Cloud Storage" now separates Keeva, which uploads nothing to either service, from Google-managed Android device backup. No provider added or data flow changed. |
| 2026-10-11 | "No backend application server" now notes that on Android 12 and later, a phone-to-phone transfer during new-phone setup may also copy your data to the new phone. No provider added or data flow changed. |
Contact
For questions about this list, see our Privacy Policy contact section.
This policy is governed by the English version. In case of any discrepancy between translations, the English version prevails.
第三方服務與資料處理
以下服務協助 Keeva 處理技術資料或購買。表格列出各家服務的用途，以及會接收哪些資料。代表我們處理資料的服務，稱為子處理者（sub-processors）。
我方承諾在新增任何子處理者之前，至少提前 30 天通知。變更通知會刊登在本頁。
目前的子處理者（v1.0 — Android）
| 提供商 | 用途 | 共享的資料 | 地區 | 提供商 DPA / 隱私 |
|---|---|---|---|---|
| Google LLC（Firebase） | 當機回報（Crashlytics）——當機資料 + 用於分組當機的裝置實例 UUID | 裝置實例 UUID；當機堆疊追蹤（依據隱私政策，不含使用者輸入內容） | 美國，含依 Google 資料中心政策的地區性處理 | Firebase 隱私與安全 · Google Cloud DPA |
| Google LLC（Firebase Analytics） | 選用的使用分析——預設關閉，僅在使用者透過「設定 → 關於你的資料」主動開啟後傳送 | App 實例 / 安裝 ID；有界限的 App 活動事件；啟用分析時設定的時區使用者屬性 | Google 全球（美國為主） | Firebase 隱私與安全 · Google Cloud DPA |
| Google LLC（Play Store） | Play Store 發佈；收據驗證 | Google Play 帳號 ID（僅 Play Store 用戶）；購買收據 | 美國，含地區性 CDN | Google Play 條款 |
| Google LLC（Firebase Remote Config） | App 版本強制更新開關——於冷啟動 + onResume 時呼叫 fetchAndActivate()（5 分鐘速率限制）以強制執行最低 App 版本 | Firebase 安裝 ID + App 版本 + 裝置語言 | Google 全球（美國為主） | Firebase 隱私與安全 · Google Cloud DPA |
計劃中的子處理者（尚未啟用）
| 提供商 | 用途 | 共享的資料 | 地區 | 提供商 DPA / 隱私 |
|---|---|---|---|---|
| Apple Inc. | App Store 發佈；付費 App 購買收據驗證（僅在 Keeva 推出 iOS 版時適用；目前 Android 版本不使用） | Apple ID（登入 App Store 時）、購買收據 | 美國（含地區性 CDN） | Apple 隱私政策 |
| IAP 基礎設施（待定） | 未來選購功能的購買與訂閱紀錄（若推出） | 用戶識別符；訂閱狀態；收據元資料（提供商待定） | 待定 | 於此服務啟用前確認 |
若推出未來新功能的選購服務，相關服務將列入「目前的子處理者」。我們會至少提前 30 天在本頁公告。
我們刻意不使用的服務
為求透明，以下是 Keeva v1.0 不委託任何子處理者的項目：
- 無後端應用伺服器——Keeva 採本地優先設計。您的習慣、打卡紀錄、筆記與照片存在裝置上，不在 Keeva 的伺服器；Android 12 以上設定新手機時，手機對手機傳輸也可能將這些資料複製到新手機。若開啟作業系統備份，備份由 Google 管理；詳見隱私權政策。Google Drive 備份不含每月回憶照片。
- 無 Firebase Authentication——Keeva v1.0 不需登入。您沒有 Firebase 用戶帳號
- 無 Firestore / Firebase Cloud Storage——Keeva 不會將習慣資料或每月回憶照片上傳至這兩項服務。若 Android 裝置備份已開啟，Google 可能在您的 Google 帳號中保存習慣資料庫和部分設定的副本；這項作業系統備份與 Keeva 分開管理，且不含每月回憶照片。
- 無行銷型 analytics SDK（Mixpanel / Amplitude / Segment 等）——Keeva 使用 Crashlytics 進行預設開啟的當機診斷，Firebase Analytics 僅用於選用的使用分析且預設關閉
- 無廣告 SDK——Keeva 不含廣告
- 無直接支付處理商——付費 App 購買計費由 Google 處理（Keeva 未來推出 iOS 版時另由 Apple 處理）；我們看不到您的卡號
跨境傳輸
上述子處理者總部位於美國。當您在美國以外使用 Keeva 時，您的錯誤回報資料以及（對 Play Store 用戶）Play 帳號識別符可能會被傳輸至美國並在當地處理。
我們依賴每個提供商提供的安全保障：
- Google（Firebase + Play）——v1.0 唯一實際啟用的子處理者：依 Google Cloud DPA 的標準合約條款
- Apple（計劃中，尚未啟用）：已發佈的隱私政策 + EU-US 資料隱私框架認證。目前沒有任何資料傳送至 Apple——此項僅於 Keeva 未來推出 iOS 版時適用。
- 未來 IAP 基礎設施（啟用時）：依提供商 DPA 的標準合約條款，於此服務啟用前確認
變更通知
我方承諾在子處理者變更生效前至少 30 個日曆天發佈通知。通知透過以下方式傳遞：
- 本頁面的「最後更新」時間戳 + 以下變更日誌
變更日誌
| 日期 | 變更 |
|---|---|
| 2026-04-25 | 頁面建立——v1.0 上架初始子處理者清單 |
| 2026-04-28 | 新增 firebase_remote_config 列，依 Wave 4 強制更新開關上線 + GDPR 第 28 條揭露要求 |
| 2026-05-21 | 新增 Firebase Analytics 列，並與 App 隱私設定中的預設關閉 / 主動開啟語意對齊 |
| 2026-07-31 | 跨境傳輸的安全保障重新排序，將 Apple 標示為「計劃中、尚未啟用」，與上方表格一致（v1.0 僅支援 Android——目前沒有任何資料傳送至 Apple）；「無支付處理商」修正為「無直接支付處理商」。未新增任何子處理者——不涉及 30 天提前通知承諾。 |
| 2026-09-08 | 釐清安裝識別碼的說明，不再宣稱資料完全匿名。未新增服務提供者，也未變更資料傳輸方式。 |
| 2026-10-03 | 變更通知改為刊登在本頁（不設通知名單）。計劃中的子處理者不再標示推出時程；Apple 僅在 Keeva 推出 iOS 版時適用。「無 Firestore / Firebase Cloud Storage」改為區分 Keeva（不會上傳至這兩項服務）與由 Google 管理的 Android 裝置備份。未新增服務提供者，也未變更資料傳輸方式。 |
| 2026-10-11 | 「無後端應用伺服器」補充：Android 12 以上設定新手機時，手機對手機傳輸也可能將資料複製到新手機。未新增服務提供者，也未變更資料傳輸方式。 |
聯絡
如對本清單有任何疑問，請見隱私政策聯絡章節。
本政策以英文版為準。若翻譯版本與英文版有任何差異，以英文版為依據。
This policy is governed by the English version. In case of any discrepancy between translations, the English version prevails.
This policy is governed by the English version. In case of any discrepancy between translations, the English version prevails.