Privacy Policy

This page explains what data Kleido (“we”, “us”) collects, how we use it, and how you can control it. It applies to kleido.app and the Kleido iOS and Android apps. We're a small team. If anything here is unclear, email contact@kleido.app and we'll answer like a human.

What we collect

• Account information, including your email address, name when provided, and account ID, collected through our authentication provider Clerk. We use it to manage sign-in, identify your account, and respond to support requests.
• Payment information: card payments are handled by our payment processors. Web subscriptions use Stripe. In the iOS and Android apps, subscriptions are purchased through Apple's App Store or Google Play and managed for us by RevenueCat. Card numbers and CVCs never touch our servers. We receive customer and transaction identifiers and subscription details such as product, purchase and renewal dates, and access status. RevenueCat associates mobile purchases with your Kleido account ID to manage subscription access. Optional customer invoice payments use Stripe or Square, depending on the payment account you connect. We send the invoice description, amount, currency, and job or payment reference needed to process the payment, and receive payment and refund details to keep your invoice balance up to date. We also store the account identifiers and authorization details needed to maintain your payment-provider connection.
• Usage analytics via PostHog: screen and page views, searches, button clicks, errors, and device or browser information. When you sign in, these events are associated with your account ID and may include your email, name, and account creation date. We use this information to understand product use, diagnose problems, and improve Kleido. Our servers also record request and usage logs to operate the service and prevent abuse.
• Saved jobs and customer information: details you enter or save, including customer names, phone numbers, email and street addresses, vehicle information and VINs, key codes and bittings, job notes, dates, amounts charged, and payment-method labels. We store these with your account so you can retrieve and manage your work. If you choose to import a contact in the mobile app, the system contact picker provides the contact you select, including available name, company, phone, email, and address fields. These fill the customer form and are stored with your account when you save it. Kleido does not automatically upload your address book; you can enter customer details manually instead.
• Vehicle lookups: the vehicle details, VINs, or key codes you enter are sent to Kleido to answer your lookup. For VIN decoding, we send the VIN to the U.S. National Highway Traffic Safety Administration (NHTSA) to retrieve vehicle details. You can select a vehicle manually instead. Saved vehicle and job details are stored with your account as described above.
• Optional location: when you open the Save bitting form for a new job or tap Detect, Kleido can read your device location with your permission, including precise coordinates, to fill the job location. Coordinates are sent to a geocoding provider to find an address; this can happen before you save the job. You can also type an address, which is sent for address suggestions. Saved job locations are stored with your account. Maps on Android and the web load tiles directly from CARTO, which receives your IP address and requests for the map area and zoom level being displayed. Kleido does not continuously track your location in the background. You can decline location permission and enter an address manually.
• Community notes and photos: we store the notes you submit and photos you choose from your library or take with the camera. Selected photos upload when you attach them, before you publish the note. Published notes and their author attribution are visible to other users. Uploaded images use publicly accessible URLs; anyone with an image link can view it. Only upload photos you have permission to share, and avoid including private customer details. Camera and photo permissions can be changed in your device settings.
• Submitted code corrections: if you email us about a bad code, we keep that thread for quality control.

What we don't collect

• No automatic upload of your address book
• No automatic upload of your entire photo library or device files
• No personalized advertising or remarketing through our Google measurement tag
• No biometric data
• No browsing history outside of pages you visit on Kleido itself

Cookies

Essentialcookies from Clerk keep you signed in. Without these, the app can't function. Analytics cookies from PostHog record session-level usage for product improvement. When analytics is available, we also retain the first approved campaign labels in this browser for up to seven days to connect a visit to account creation. Validated signup labels may be stored with your account, checkout, and PostHog profile so we can understand which campaigns bring accounts that later start trials or make subscription or series-pass payments. They contain no advertising click IDs. Do Not Track and Global Privacy Control disable this browser attribution. Optional Google Ads measurement cookies are described below.

Optional advertising measurement

If you allow it, our public marketing pages use a Google Ads tag to measure visits from advertisements. Google receives page-visit and browser or device information, including your IP address, and may use advertising click identifiers and first-party measurement cookies to connect an ad click to a visit. A measured page visit is not a subscription, trial, or payment. We do not send account identities, customer details, VINs, key codes, or saved jobs to this tag, and we disable personalized advertising, remarketing, and enhanced conversions for this integration.

The current optional choice also covers measuring verified free trials and purchases from Google ads. With that permission, we save the Google click ID in this browser for up to seven days and attach it to a new account created in that period. For outcomes within 30 days of the click, our server may send the click ID, event time, transaction reference, purchase amount, and currency through PostHog to Google Ads. We do not send email addresses, phone numbers, card details, or your work in Kleido through this outcome integration. An older choice covering visits alone does not grant permission for trial or purchase sharing.

The tag is not loaded before you allow measurement. Do Not Track, Global Privacy Control, or analytics opt-out prevent it from loading even if you previously allowed it. Your choice is saved in this browser for up to 180 days. You can change it below; turning it off removes Google's first-party ad measurement cookies on kleido.app and stops future tag loading. Information already received by Google is governed by Google's privacy policy.

Turn measurement off while signed in to stop future trial and purchase sharing for your account across devices. This account withdrawal is permanent for the integration; allowing browser measurement again does not reverse it. Privacy signals observed while signed in also withdraw account outcome sharing. We check that account preference before preparing each outcome. Withdrawal does not recall information already sent or an upload already in progress. If you are signed out, sign in to apply the change to your account as well as this browser.

Data retention

Account data is retained for as long as your subscription is active and for 90 days after cancellation, then deleted. You can request earlier deletion at any time. Stripe, Square, Apple, Google, and RevenueCat retain billing and transaction records under their own retention policies and applicable requirements; we do not override those policies. Deleting a Kleido account does not cancel an App Store or Google Play subscription. Cancel it through the store where you purchased it.

To prevent repeated free trials of web subscriptions, we may keep a private, keyed record of a verified email address's prior subscription use for 12 months after account deletion. This record does not contain the email address itself, card details, saved jobs or lookup history, and is not shared with analytics providers. It only determines free-trial eligibility; it does not prevent you from buying a subscription. You can contact us to request access, correction or deletion of this record. We review those requests individually. Expired records are excluded immediately from eligibility checks and removed by our daily cleanup.

Third parties

Kleido relies on a small set of vendors to operate. Each handles data under its own privacy policy:

• Clerk : authentication and account management
• Stripe : web subscription billing and optional customer invoice payments
• Square : optional connected-account customer invoice payments and payment/refund status updates
• RevenueCat : subscription management for in-app purchases
• Apple & Google : in-app purchase processing on iOS and Android; Google also provides the optional advertising measurement described above
• PostHog : product analytics
• Vercel : application hosting and uploaded image storage (Vercel Blob)
• Location and mapping providers : Apple's location services on iOS, and Photon (Komoot) or OpenStreetMap Nominatim for address lookup and fallback geocoding. These services receive the address search or coordinates needed to answer the request. CARTO supplies map tiles directly to Android and web devices as described above.
• NHTSA : VIN decoding; receives the VIN submitted for a vehicle lookup
• Turso : database hosting

We don't sell or rent personal data to anyone, and we don't share it with third parties beyond what these vendors need to provide their service.

Your rights

Under GDPR (if you're in the EU/UK) and CCPA (if you're in California), you can request a copy of the personal data we hold on you, request that it be corrected, or request that it be deleted. Email contact@kleido.app from your account email. We respond within 30 days.

Children

Kleido is a tool for working professionals and is not directed at children under 13. We don't knowingly collect data from anyone under 13. If you believe a child has signed up, email us and we'll delete the account.

Changes to this policy

When we change this policy in any meaningful way, we'll update the date at the top of the page and provide a notice in Kleido or by email before the change takes effect.

Contact

Questions about your data, this policy, or anything else? Email contact@kleido.app.