Legal
Privacy policy
Last updated 29 July 2026
Keena is a small product for saving places and deciding where to go with the people you go with. This page explains exactly what that involves collecting, who else can see it, and how to get rid of it.
The short version. We collect what is needed to run shared lists: your account, the places you save, and what you and the people you share with think of them.
We do not run advertising or analytics trackers, we do not sell data, and your data is stored in Australia.
Who we are
Keena is operated from Western Australia. For anything in this policy, including access and deletion requests, contact us at hello@keena.app. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).
What we collect
Information you give us
- Account details: your email address, display name, and profile photo if you upload one. If you sign in with Google, we receive your email address, name and profile picture from Google.
- Places you save: the venue name, address, category, and the Google Places identifier and photos for that venue.
- What you add to them: ratings, notes, menu notes, scheduled dates and reminder preferences.
- Who you share with: the groups and collections you belong to, and the email addresses of people you invite. We use an invitee's email address to send that one invitation and to connect their account if they accept.
- Availability and poll responses: the dates you mark yourself available for when planning with a group.
Information we collect automatically
- Authentication data: session tokens, sign-in timestamps, and if you enable two-factor authentication, the fact that a second factor is registered (never the secret itself in a readable form).
- Technical data: IP address, browser and device type, and server logs. These are used for security, abuse prevention and debugging.
We do not use advertising cookies, analytics pixels, session recording, or any third-party tracking SDK. See the cookie policy for the full list of what is stored in your browser.
How we use it
- To run the service: showing your lists, syncing them with the people you share with, and putting plans on your calendar.
- To send transactional email: invitations, plan reminders, day-poll notifications, password resets and security alerts. We do not send marketing email.
- To keep accounts secure and investigate abuse.
- To fix bugs and improve the product.
Who else sees your data
People you share with
This is the main one, and it is the point of the product. When you add a place to a shared list, join a group, or invite someone to a collection, the other members can see that place, your rating of it, your notes on it, and your availability. Removing someone from a group stops future sharing; it does not retract what they have already seen.
Service providers
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Database, authentication, and storage for venue photos and avatars | Sydney, Australia |
| Vercel | Application hosting and edge delivery | Global edge network |
| Google Places | Venue search, addresses, ratings and photos | United States |
| Anthropic, OpenAI, Google | Interpreting links and notes you paste in (see below) | United States |
| Email delivery | Sending transactional email over SMTP | See provider on request |
Automated processing
When you paste a link or a block of text to add a place, its contents are sent to a large-language-model provider so we can pull out the venue name, type and address. That request contains what you pasted. We do not send your ratings, notes about other people, or group membership. Providers are used under their API terms, which for the models we use means the content is not used to train their models.
Otherwise
We do not sell personal information and we do not share it for advertising. We will disclose data if we are legally required to, and we will tell you unless we are prohibited from doing so.
Where your data is stored
The database, authentication records and uploaded photos are hosted in Supabase's Sydney region. Some processing happens overseas: hosting edge functions, Google Places lookups, and the language-model calls described above. By using Keena you consent to that disclosure to overseas recipients.
How long we keep it
- While your account is open: we keep your account, saved places and shared content so the product works.
- If you delete your account: your profile, saved places, ratings and notes are deleted within 30 days. Content you contributed to a shared group may remain visible to that group in anonymised form where deleting it would break the group's own records.
- Server and security logs: retained for up to 90 days.
- Backups: deleted data persists in encrypted backups for up to 30 days before rolling off.
Your rights
You can ask us to give you a copy of your personal information, correct it, or delete it. Most of it you can reach directly in the app under settings. For anything else, email hello@keena.app and we will respond within 30 days.
If you are not satisfied with how we have handled a privacy matter, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Security
Data is encrypted in transit and at rest. Access to your rows in the database is enforced at the database level, not just in application code, so another user's session cannot read your data even if the app has a bug. You can turn on two-factor authentication in settings, and we recommend it. No system is perfectly secure; if a breach affects you we will notify you and the OAIC as required under the Notifiable Data Breaches scheme.
Children
Keena is not intended for people under 16. We do not knowingly collect information from them. If you believe a child has given us personal information, contact us and we will delete it.
Changes
If we change this policy we will update the date at the top. If a change materially affects how we handle your data we will tell you in the app or by email before it takes effect.