Privacy Policy

Last updated: August 6, 2026

Kelbo is operated by Bootheel Tech LLC. This policy explains exactly what the app collects, why, who it goes to, and how to get rid of it. Questions go to support@kelbo.app.

The short version

We use your phone number to sign you in. That's the only identifier we ask for.
Your contacts' phone numbers are hashed on your device. We never receive your contact list or their names.
There is no advertising, no ad tracking, no analytics SDK, and no location collection.
We do not sell your information.
You can permanently delete your account and all of its data from inside the app at any time.

What we collect

Data	Why
Your phone number	Creating your account and signing you in with an SMS code. It's your account identifier.
Time zone	Working out when "today" ends for you, so streaks break at the right moment.
Habits, completions, and streaks	The core function of the app.
Character data: level, XP, six stats, avatar and pet choices	Showing your progress and your character.
Points, rewards, and redemptions	Running the rewards system you set up for yourself.
Hashed contact phone numbers	Showing which of your contacts already use Kelbo. See below.
Your referral code and hashes of numbers you invited	Applying referral discounts, and not texting the same person twice.
Pokes you send and receive	The poke feature.
Purchase and subscription status	Unlocking Premium features. We never see or store your card details.
Feedback and custom pet requests you submit	Responding to you. These are emailed to our support inbox, along with any image you attach.

How contacts work, specifically

This is the part most people want to understand, so here is the actual mechanism.

Contacts access is optional, requested only when you open the Social screen, and you can decline.
If you allow it, the app reads phone numbers from your device, normalizes them, and converts each one into a SHA-256 hash on your phone, before anything is sent anywhere.
Only those hashes are sent to our server, which compares them against hashes of Kelbo users to find matches.
Your contacts' names never leave your device. We do not receive, store, or transmit them.
A contact's actual phone number is only sent to us if you explicitly tap to invite that specific person, and then only so we can send them that one text message. We keep a hash of it so you aren't offered the chance to text them again.
We do not build a social graph, contact people who aren't Kelbo users other than the single invite you asked us to send, or use contact data for anything else.

Who else processes your data

Kelbo relies on these providers. Each receives only what it needs to do its job.

Provider	What it handles
Twilio	Sending your login codes and any invite texts you choose to send.
Neon	The database storing your account, hosted on Amazon Web Services in the United States.
Railway	Hosting the Kelbo server.
RevenueCat	Validating purchases and tracking subscription status.
Google Play	Processing payments. Your payment details go to Google, never to us.
Resend and Microsoft 365	Delivering and receiving support and feedback email.
Expo	Building and delivering the app itself.

How long we keep it

Your data stays as long as your account exists. When you delete your account, we permanently remove it immediately: your habits, completion history, streaks, character, points, rewards, referral code, invite records, pokes, and your phone number and its hash. There is no grace period and no recovery, so please be sure.

Two exceptions worth naming plainly. Support emails you have already sent us remain in our support inbox unless you ask us to delete them. And records of purchases you made are retained by Google Play under their own policies and tax rules, which we do not control.

Deleting your account

In the app, open the menu and choose Delete account. If you have already uninstalled the app, use the web deletion form instead.

If you have an active Premium subscription, cancel it in the Google Play Store before deleting your account. Deleting a Kelbo account does not cancel a Google Play subscription and you would keep being billed.

Security

Traffic between the app and our server is encrypted with HTTPS. Your login session uses a signed token stored in your device's secure storage. We do not store passwords, because Kelbo does not use them.

Children

Kelbo is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your information. Deletion is available directly in the app. For anything else, email support@kelbo.app and we will respond within 30 days.

Changes to this policy

If this policy changes materially, we will update the date at the top and note the change in the app.