Legal

Privacy Policy

Effective date: October 20, 2026 · Last updated November 6, 2026

Version française. The English version governs if the two differ.

This policy explains how KeyUp (“KeyUp”, “we”, “us”) handles information when you use the KeyUp app for Android phones and Wear OS watches, the KeyUp iPhone app (in private testing), the KeyUp web app (for example in Safari on iPhone), the web guest and watch pairing pages, the web dispatch console, and this website at keyupradio.com (together, the “Service”). KeyUp is a sole proprietorship in the United States. Anyone can join: KeyUp has a Free plan, and paid plans are optional. If anything here is unclear, email [email protected].

1. Information we collect

Your account

Your username, display name and password. We store your password only as a secure one-way hash, so we can’t see it. If you sign in with Google instead, you may have no password at all (see “Sign in with Google” below). You can also add an email address. We check it with a confirmation link, and we use it only to reset your password, confirm the address, send your data when you ask, and for important account messages. It’s never shown to other people. If you create or manage a Space, we keep its name, rooms, members, roles and settings.

Sign in with Google

On an Android phone and in the web app you can sign in or sign up with your Google account instead of a password. Google handles the sign-in on its own screen under its own privacy policy. We never see your Google password, and Google gets none of your KeyUp content. Google tells us a stable ID for your Google account and the email and name you allow it to share. We keep the ID, a one-way hash of the email, a shortened copy of the email (for example a***@gmail.com) so you can see which account is linked in You › Account and plan › Sign-in methods and password, and the email you confirm with us. We keep nothing else from your Google account. A KeyUp account is never linked to a Google account just because the email matches: you link it yourself after signing in. You can unlink Google at any time, and deleting your account removes the link.

Agreeing to the Terms and this policy

We record when you agreed to the Terms and this policy and which version of each: the date and time, how you agreed (the tick box, or an older app that showed the sentence), where (for example the join screen on a phone) and the app version. We don’t record your IP address with it. It’s how we know you agreed. It’s part of Download my data and is deleted with your account or guest pass.

Your age group

When you sign up we ask for your birth year, only to check the age rules (section 10). We keep whether you’re an adult or a teen, never the year. On Android, KeyUp also asks Google Play what it already knows about the age on your Google account: an age range (for example 13 to 15, 16 to 17, or 18 and over) and, for people under 18 where state law requires it, whether a parent approved KeyUp. Google Play never gives us your exact age, and the app doesn’t send Google’s install ID to our server. We use this only for the age rules and to follow the law. We don’t keep the range: after the check we keep only whether you’re an adult or a teen, the parent approval status (approved, waiting or declined) and when we last checked. The range can only make the age rules stricter. It never treats anyone as older.

Guests

Guests join with a guest pass and just a name, with no account. When a guest pass is used, the app sends its install ID (see “Your devices”), which is also how we limit how many guest passes the same phone can use in a Space. To tell when a guest keeps coming back, we count the days a guest was in a Space in the last 30, by account and by a salted one-way hash of the install ID, and offer the Space’s owner and admins to add them as a member. The people of the Space are never counted.

Your devices

Each phone, watch or browser you sign in on is listed on your account, with its type, model, app version and when it was last used, so you can see and remove your devices. For each device that can get notifications while KeyUp is closed, we store a push notification token, encrypted, so we can tell you about talk, messages and calls. In a web browser, this is the browser’s push address, stored the same way and deleted when you sign out. The KeyUp iPhone app (in private testing) has no push token yet: it shows alerts only while it is open. For a browser, the type is a short label the web app makes, such as “Chrome on Android phone” or “Safari on iPhone”, never the browser’s full details.

Install ID. Each app or browser makes a random install ID: a long random number that isn’t your phone number, your name or your advertising ID. It is sent when you sign in, sign up or use a guest pass. We keep a salted one-way hash of it, never the number itself, with that device’s entry on your account, so it is linked to your account for as long as the device is listed. We use it to show one entry for the same device instead of a new one each time you sign in; to recognize a device you have used before, so the sign-in lockout that follows wrong passwords doesn’t shut you out on your own device; to keep the 24-hour block in place on a device where someone under 14 tried to sign up; to block a device after we suspend an account that used it; and to limit how many guest passes the same phone can use in a Space. It is removed when you remove the device or delete your account. In a web browser the ID stays in that browser’s storage after you sign out, until you clear the site’s data.

Free trial marks. On Android phones the app (from version 115) also sends a one-way hash of the phone’s Android ID, the same for every KeyUp install on that phone. We keep a one-way hash of it with your account, only to give one free trial per phone, and it is deleted with your account. When a free trial starts, we keep a keyed one-way mark of the Space owner’s verified email, install IDs, linked Google account and current phone for at least 400 days, even after the account is deleted, so a new account can’t start a second free trial. Marks older than 400 days are deleted the next time a free trial starts on KeyUp, so one can stay a little longer. A mark can’t be turned back into the email or the ID, and we use it for nothing else.

The KeyUp web app keeps your session in your browser’s own storage, never in web addresses. It sets no cookies and uses no analytics. If you set up a watch on our pairing page, your password is used once to approve the code, and the page doesn’t keep you signed in.

Profile picture (optional)

You can add one profile picture (guests can’t). We process, check and store it only on our own server (hosted by Microsoft Azure, see “Our service providers”), with no other outside company involved. Before saving it, we remove all hidden details, including GPS location, camera model and dates, and we keep only a small and a medium-sized copy, never your original file. Your picture is shown only to signed-in people who can see you in KeyUp: you, your friends, people who share a Space or a room with you, and the server admin. People you block can’t see it, and it’s never available as a public link.

To keep KeyUp safe, every new picture is checked automatically on our server by an open-source image classifier before it’s saved. Pictures it rates as explicit are refused and not stored. Borderline pictures are saved and flagged for our admin to review. If the check can’t run, new pictures are paused rather than let through unchecked. Like any automatic check it can make mistakes; if yours is wrongly refused, choose another or contact us. Anyone who can see a picture can report it, and our admin reviews reports and can remove pictures. For each decision we keep a short record (accepted, flagged, refused, removed or approved, and the check’s score), never the picture itself, for as long as your account exists. Removing or replacing your picture deletes the files at once.

Live voice

When you talk, your audio passes through our servers in real time to the other people in the room. Live audio is not stored, unless the room has Replay turned on and you agreed (see below). If someone's connection drops for a moment, KeyUp holds your talk in memory for up to 5 minutes to deliver it to them. This hold stays in our server’s memory and is never written to disk. Open mic decides when you’re talking using voice detection that runs on your device.

We count how many talks happen in each room each day and how long they last, to see whether KeyUp works. We never record what is said unless you turn on Replay or transcripts. (A talk a device missed because its connection dropped, a guest’s too, is held in the server’s memory for up to 5 minutes to deliver it, never on disk.)

To see how well KeyUp works in each country, each connection is tagged with a two-letter country code that our network provider (Cloudflare) supplies, never your address. The tag is kept only while you are connected, and delay measurements are added up per country per day with no name or user ID.

Replay and transcripts (optional)

Replay and transcripts are off unless the Space turns them on for a room. Replay was called Rewind before October 2026. Replay saves short voice clips so room members can replay them. Transcripts turn talk into text that room members can read and search. By default they are made by speech-to-text that runs on KeyUp’s own servers, not by an outside company. A Space can choose its own transcription provider instead (see below). Even when a room has them on, KeyUp saves your voice as a Replay clip, or turns it into text, only after you agree in the app, with one switch, You › Privacy and AI › Save and transcribe my voice. That switch agrees to both: Replay saves your voice as short clips people in the room can play back, and transcripts turn what you say into text and may be translated. People still hear you live either way. If you want only one of the two, Customize inside that switch has them apart (Save my voice for Replay and Transcribe my voice). The switch agrees to KeyUp’s own transcripts only; if a Space uses its own transcription provider, KeyUp asks you separately for that provider (see below). If you have not agreed, people in the room still hear you live, but nothing you say is saved. Guests are never recorded. Rooms that save voice clips show “Replay on”, and everyone in the room is told when this changes. You can withdraw your consent at any time (You › Privacy and AI › Save and transcribe my voice, or each half on its own under Customize); saved clips are deleted when the room’s keep time ends (1 hour by default, up to 1 day on Free, 7 days on Plus, 30 days on Crew and 90 days on Business, set in the room’s Keep clips for), or sooner if the Space admin deletes them. We keep a record of each consent change and each time Replay is turned on or off, without any audio or text, and your consent choices are included when you download your data.

Translated talks. When a room translates talks, the text of a talk is translated on the KeyUp server (or by the Space’s own transcription provider, when the Space uses one) into the languages the room chose, and kept with the transcript.

A Space’s own transcription key. A Space owner or admin (an adult) can connect the Space’s own account with a speech-to-text company, such as OpenAI, Groq, Deepgram, or a speech-to-text service they run themselves. When a Space does, the audio of people who agreed to that provider is sent to it to be turned into text, under the Space’s own account and that company’s own terms and privacy policy. KeyUp has no contract with that company. Before your voice goes to it, KeyUp asks you once, naming the provider (“This Space uses Deepgram to turn speech into text, so what you say is sent to Deepgram.”), and if the Space changes to a different provider, you are asked again. Until you agree, your voice in that Space is not transcribed, and talking works as usual. Guests are never transcribed, and a Space with a member under 18 can’t use its own key, so a teen’s voice is never sent to such a provider. Accounts whose age is not confirmed are not transcribed by a Space’s own key, until they confirm their birth year. We send only the audio of each talk to be transcribed, never your name, email address, location or messages. The text comes back to KeyUp and is kept like any other transcript. The key is stored encrypted, is never shown again (only its last 4 characters), and is never sent to any phone or watch. If the key stops working, transcripts in that Space pause and the owner and admins are told; KeyUp never sends that Space’s audio to its own speech-to-text instead. While a Space is paused, KeyUp tries the key again on its own from time to time (after 1, 2, 4, 8, 16 and 32 minutes, then every hour for up to 24 hours) and resumes when the provider answers. To check a key, and for those tries, KeyUp sends the provider one second of a quiet tone, never anyone’s voice. An owner or admin can also remove the key at any time with Remove key, and KeyUp removes it by itself when the Space changes owner, when its owner deletes their account, or when the person who saved it leaves the Space or stops being an admin; the owner and admins are told, and the Space goes back to KeyUp’s own transcripts. We count how many minutes went through the key, for the Space’s owner and admins.

Messages, pictures, voice notes and calls

Text messages, pictures and voice notes you send in rooms and direct messages are stored so the people you send them to can see them. Calls are live audio and are not recorded. We keep basic call details, such as who called whom, when, how the call ended and for how long, so they appear in your call history and as a short line in your conversation.

Calls for help, pinned notes, status and missed talks

Call for help. When a member sends one, we keep who sent it, the note they typed (up to 140 characters), the room, when, and whether someone marked it handled. It is deleted after 30 days. The Space’s owner, admins and moderators see a line for it in the Space’s activity log. The people who get it can also hear the sender’s last talk from the past minute, but only when the room has Replay on and the sender agreed; that is an ordinary Replay clip and follows the room’s keep time. Call for help is not an emergency service (see the Terms).

Pinned note. A room can have one pinned note: its text (up to 500 characters), who pinned it, when, and which members have read it. Who has read it is kept only while they are in the room. It stays until someone replaces or removes it, or the room is deleted.

Status. A short line you choose, up to 40 characters, shown to the people who can see you in your Spaces and your friends. It never includes where you are. It is deleted when the time you chose ends, or when you clear it.

Missed talks. To show who talked while you were away, KeyUp keeps, for each talk that someone in the room did not hear, who talked, when, how long the talk was, the saved clip it belongs to (only when the room has Replay on and the talker agreed), and which people in the room missed it (the people the talk was kept for). It is kept for 48 hours and used for nothing else. The list you see holds only talks you missed. The person who talked sees, right after their talk, who heard it and who didn’t (offline, quiet, or didn’t hear), unless either of you turned off Send read receipts. That is worked out when the talk ends and is not kept. For each talk with a saved Replay clip, KeyUp also keeps two numbers for 48 hours: how many people in the room heard it and how many could have. No names. Only the person who talked sees them, as Heard by 2 of 3 on their Replay. So that catching up on one device clears missed talks on your others, KeyUp also keeps the time you last caught up in each room, for 48 hours. Turning a missed talk into text with Transcribe works only when you and the person who talked have agreed to transcription, and counts like any other transcript.

Notifications for one room. Your own choice for each room (Everything, Mentions only or Off) is kept until you change it or delete your account.

Reminders. A reminder you set (“remind me in 20 minutes to …”) is stored on our server for you alone and never shared with the room. If you say it to KeyUp, the recording goes to your Space’s own transcription provider (if you agreed to it) or to KeyUp’s own transcription, and it is deleted as soon as the text exists. Only when KeyUp’s transcription is busy or cannot do the language you spoke, your phone or watch may turn the sentence into text with its own dictation instead, and the web app offers your browser’s speech service as a button: if you tap it, your browser may send the recording to the company that makes your browser, for example Google or Apple. Our server works out the time itself. Only if it can’t, and you are an adult who agreed to the assistant in a Space whose assistant has its own key, that one sentence is sent to that Space’s AI provider to find the time. When it is due, the reminder’s text goes to your watch and phone in the push notification, so they can read it aloud. It is deleted when you delete your account.

Radio Bridge (beta, optional)

If a Space owner sets up a Radio Bridge, we keep the license details they enter: the call sign, the FCC Registration Number (FRN), the licensee’s name, whether they are the licensee or an authorized user, the frequencies, where the gateway will be, who confirmed the statements and when. We use them only to check that the radio may transmit. They are deleted when the Space is deleted.

Private calls (beta)

A private call is an end-to-end encrypted 1-to-1 call. Your voice is encrypted on your device with keys made for that call only, and it can only be unlocked on the other person’s device. Our servers pass the encrypted audio along without being able to hear it, so private calls can’t be recorded, transcribed, rewound or sent to an AI. Both screens show a safety code: if the two codes match, nobody in the middle is listening, unless a device is already compromised. Private calls are in beta and have not been independently reviewed yet. How they work is written down on How KeyUp protects your conversations.

For private calls our servers still see: who called whom, when, whether the call was answered, declined or missed, how long it lasted, that it was private, which device answered, the size and timing of the encrypted audio (which can show roughly when someone was talking), and the IP addresses your devices connect from. The two public keys for the call pass through our servers while the call rings or runs, and are deleted when it ends. Private calls are new, are still being tested and have not yet been independently reviewed, so please don’t rely on them for sensitive conversations yet. They don’t protect against a device that is already compromised, or someone recording the call another way.

Friends, invites and presence

Your friends list, invites you send and receive, and your presence: whether you’re online, which room you’re in, whether you’re on your phone or watch, and when you were last seen (to the minute). Presence is shown only to your friends and the people you share a Space with. The people in a room also see a small Quiet mark on your picture while you will not hear that room (Quiet is on, you muted its sound, or the sound is off on every device you have there); they see only the mark, never the reason.

Read receipts and typing. In direct messages and room chat, KeyUp shows the other people when you have read the chat: the ticks on their messages turn red, and a tap on them shows who read it and when (“Seen by Sam”). While you type, the others see a line “is typing...”. Send read receipts, under You › Privacy and AI › Advanced, is on by default. If you turn it off, nobody sees when you read their messages or heard their talks, and you don’t see when others do. We keep the time you last read each chat while you are in it. The typing signal is passed on live and not stored.

Phone calls. While you are on a phone call, your phone tells KeyUp so that your watch and your other devices stay quiet. That is shown to your own devices only, is kept in memory only while the call lasts, and holds no number, no name and nothing about the call.

Invite links and Google Play. The Get KeyUp on Google Play button on an invitation page carries the invitation code in its link, so KeyUp can finish the join after you install. That means Google receives the code, as the install referrer. If you install KeyUp from Google Play that way, the first time KeyUp starts it asks Google Play for the install referrer, once, so it can take you to that invitation. KeyUp uses only the invitation code in it and keeps nothing else from it. This is not used for advertising or tracking.

AI assistant (optional, bring your own key)

A Space owner can connect their own account with an AI company (OpenAI, Anthropic, Google Gemini, or a compatible provider) and turn the assistant on for chosen rooms. If a room’s owner turns on an assistant, what is said to it in that room is sent to the AI service that owner connected with their own key. With the Space’s lookups switch on, that provider may use its own web search to answer, so the question text goes to its search too, under the Space’s own account with it. KeyUp doesn’t sell data to AI companies and has no contract with them for this feature. Everyone must agree once, in You › Privacy and AI › Ask the AI by voice, before the assistant can hear them.

When someone asks the assistant a question, we send that AI company the question, the asker’s display name, and a short window of recent room conversation (a few minutes) only from people who agreed. The assistant is for people 18 and over: teen accounts can’t ask it, and what they say is never sent to it. It goes under the Space owner’s account and that company’s own terms and privacy policy. We never send audio, email addresses, phone numbers, locations, or anything from other rooms. Voice questions are turned into text first, by our own servers or, when the Space uses its own transcription provider and you agreed to it, by that provider (see above). The assistant’s AI company never gets the audio. The Space owner’s API key is stored encrypted, is never shown again, and is never sent to any phone or watch. A Space can keep short assistant notes for a room (assistant memories, see section 5); those notes stay on our server.

Models we download. The speech and picture models we run on our own server (for transcripts, voices and the profile picture check) are downloaded from Hugging Face, a company that hosts AI models. Downloading one sends Hugging Face a request from our server, never any of your content. The models then run on our own server.

Problem reports (only when you send one)

If you choose to send a problem report from the app, it includes your message, the app’s logs from that session, the app version, your phone model and your Android version. On the phone and the watch, the logs end with a short activity trail of the last 2 minutes: the names of screens opened, when the room connected or dropped, when talks started and stopped, and counts of sound hiccups in each talk. It holds names and numbers only, never what anyone said or wrote. Problem reports never include audio or messages.

The app also keeps a small diagnostic log on your phone and watch (the last 48 hours, about 2 MB at most), with connection, talk and error events, and a trail of the last 2 minutes of steps (screens opened, talk start and stop, connection changes and playback counts such as how many sound gaps a talk had), but no names, audio, messages, transcripts, passwords or sign-in keys. It stays on your device unless you choose You › Help › Send logs, which opens your own email or share app so you can send it to [email protected].

Reports about other people (only when you send one)

You can report a person or a message from their profile or a long press on the message. A report includes the reason you pick, your note if you write one, and whether you also blocked them. Our servers then copy, at that moment, recent material from that person that you could already see: from the last 7 days, the last messages in your direct conversation with them and in rooms you share with them (both sides, for context), transcripts from those rooms, their last few saved Replay voice clips, and pictures and voice notes they sent there. Nothing from rooms you’re not in, nothing from before you joined a room on a guest pass, and nothing from private calls, which are end-to-end encrypted and never recorded. The copy is kept with the report, so it stays even if the messages are deleted later.

Who sees a report. A report about something in a Space goes to that Space’s owners and admins, with only that Space’s part of the copy (never your direct messages). It also comes to the KeyUp team when there’s no Space (for example a direct message), when it’s about child safety, an intimate image shared without consent, threats or violence, or illegal activity, when you tick “send to KeyUp too”, when the reported person is an owner or admin of that Space, or when a Space admin sends it on to us. The person you report isn’t told who reported them, and you don’t see anyone else’s reports. If the reported person is on a guest pass, the report also notes which guest pass they used and who made it.

What happens next. The people reviewing it may dismiss it, remove the person from a Space, or, for our team, suspend the account. A suspended account can’t sign in, but its data is kept so the decision can be reviewed. We record who looked at each report and when. Where the law requires it, for example for apparent child sexual abuse material, we report to the authorities, such as the National Center for Missing & Exploited Children (NCMEC), and preserve the report as the law requires.

Crash reports

If you turn on crash reports (You › Privacy), the app sends a crash report to Sentry, our crash reporting provider. The server sends its own errors to Sentry. A report contains technical data such as the error details (stack trace), app version, device model and operating system version. It never includes message content, audio or screen recordings, and IP addresses are not stored.

If crash reports are turned on in the app, it also uploads small audio diagnostics to our own server: technical events about connection and talk problems, such as how many bits of sound in a talk you heard arrived late or went missing, with your user ID, the room ID and your device model. They never include audio or messages. We keep them for 30 days.

Watch crown talk and the Accessibility service

If you turn on crown talk and allow KeyUp crown talk in your watch’s Accessibility settings, KeyUp’s crown service reads crown and bezel turns to start and stop a talk, can keep the screen black and lock it after a dark-screen talk, and can open KeyUp to show who is talking. It reads crown turns only when the screen is off or KeyUp or your watch face is showing. It reads nothing else on the screen: not what is on it and not what you type. To know when to step aside, it only notes which app is in front. Nothing from this service is stored or sent anywhere. While the service is on, Android also lets KeyUp turn on the watch’s microphone for a talk you start with the screen off; nothing is sent until you speak. You can turn it off at any time in the watch’s Accessibility settings or in KeyUp.

If you pick Raise to talk instead of the crown, the same service lets the watch’s mic work with the screen off, and KeyUp reads the watch’s motion sensors on the watch to notice when you raise your wrist. Motion readings aren’t sent to KeyUp. A short note of each raise goes in the app’s diagnostic log on the watch, which leaves the watch only if you choose Send logs.

Phone and watch permissions

• Microphone: so you can talk. The mic is used only while you talk, or while open mic is on.
• Notifications: to alert you to talk, messages and calls.
• Bluetooth headphones: KeyUp plays through the headphones you connect. It doesn’t ask for a Bluetooth permission.
• Foreground services: to keep audio and calls running while the app is in the background, with a notification showing that KeyUp is active.

This website

If you sign up for the beta or the iPhone and Apple Watch waitlist, we collect your name, email, phone model, watch model (or whether you have an Apple Watch), how you plan to use KeyUp, how you heard about KeyUp (if you say), which list you joined, any note you add, and your consent to beta and waitlist emails. We email that address a confirmation link, and it joins the update list only after the person clicks it; the same applies if you unsubscribed and sign up again. If you send feedback, we collect your message and, if you choose, your name and email. Both forms are stored in Cloudflare D1 and emailed to our team. We use your email to send you the confirmation email and, once you confirm, beta news and occasional KeyUp updates. To stop spam, we also keep your browser’s user agent, your approximate country (from Cloudflare), and a salted one-way hash of your IP address, never the raw IP. To limit how many confirmation emails one address can get, we also keep a salted one-way hash of the email address for about a day. Website analytics use Cloudflare Web Analytics, which doesn’t use cookies.

Country check at sign-up

We check the country of your connection when you create an account, to follow export rules. We don’t store it. The KeyUp server looks up your connection’s IP address in a country database kept on our own server, so the address is not sent anywhere else, and it is not logged or kept. We only count how many sign-ups were refused per country. Signing in to an existing account is not checked. The beta form and the page with the steps after it make the same check with the country Cloudflare reports (the form keeps your approximate country, as described above). Country data on our server: IP Geolocation by DB-IP, used under the CC BY 4.0 license.

State age laws at sign-up

Some US states have age laws for apps: Texas now, and other states as their laws start. When you create an account or use a guest pass, the KeyUp server reads the US state of your connection, as reported by our network provider Cloudflare, only to apply those laws. In a state where KeyUp can’t open new accounts for people under 18 yet, a sign-up from someone under 18 is refused and nothing about it is stored. We don’t store your state. Our log keeps only the state code of a refused sign-up, and a count of sign-ups whose state was unknown, never who it was.

Payments

Google Play (in the Android app) or Stripe (on the web) handles payment. They collect your payment details under their own privacy policies, and our pages never ask for a card number. We never see your card number or its security code.

We receive and keep what we need to run your plan: the plan, its status, the renewal date, the reference numbers the store or Stripe gives us (such as a Stripe customer ID or a Google Play purchase token), and the country, so we can add the right tax. When you buy on the web, we also keep a checkout record: the email address you typed into Stripe’s checkout, the plan, period and price, the Terms sentence you agreed to and its version, and when you agreed. We use that email to send your purchase confirmation and renewal reminders. The record is kept 3 years after the purchase, or 1 year after the plan ends if that is later, also after you delete your account. A checkout you didn’t finish is deleted after 7 days. After you delete your account, the subscription record (plan, status, dates, price and the store’s or Stripe’s reference numbers) is kept for our accounts, no longer linked to your account. It isn’t deleted on a set schedule, and its reference numbers can still match records that Google Play or Stripe hold. Deleting your account also cancels a web subscription; a Google Play subscription has to be canceled in Google Play. Paying is optional, and only adults (18 and over) can buy a plan.

2. How we use information

• To provide the Service: deliver talk, messages, calls and notifications to the right people and devices.
• To run optional features you or your Space turn on, such as Replay, transcripts and the AI assistant.
• To keep the Service secure, prevent spam and abuse, and enforce our Terms of Service.
• To fix bugs and keep the Service reliable, using crash reports and the problem reports you choose to send.
• To send account emails, such as password resets and email confirmations, and beta and service notices.
• To send occasional product updates, only if you agreed and confirmed your address: we email a link first, and you’re on the list only after you click it. Every product update email, including beta emails, has a one-click unsubscribe link (you can also unsubscribe by emailing us), and unsubscribing doesn’t stop the account and service emails you need.
• To send one email with tips on inviting someone, if you are the only person in your Space a day after you sign up. It has a link to stop it, and it is never sent to teen accounts.

We do not sell your personal information, share it for cross-context behavioral advertising, show ads, or use your voice, messages or transcripts to train AI models. We don’t use your voice to identify you (no voiceprints).

3. Who we share it with

We share information only as needed to run the Service:

Our service providers

Profile pictures, their automatic check, KeyUp’s own transcripts and voice detection all run on our own server or your device, with no extra provider (the models themselves are downloaded from Hugging Face, as above). The AI company a Space owner connects, and the transcription company a Space connects with its own key, are not our providers: they work under the Space’s own account and terms (see above).

If KeyUp is ever part of a merger, acquisition or sale of assets, your information may transfer to the new owner, who must keep honoring this policy or tell you before changing it.

4. Security

Connections between your devices and our servers are encrypted in transit (TLS). That encrypted connection ends at Cloudflare, which passes your traffic on to our server through a secure tunnel, so Cloudflare can technically see traffic that is not end-to-end encrypted while it passes through. Passwords are hashed, and push tokens, AI keys and transcription keys are stored encrypted. Rooms, messages and regular calls are not end-to-end encrypted: our servers handle your voice and messages as they pass through, so features like Replay, transcripts and the AI assistant can work. Private calls (beta) are end-to-end encrypted: our servers pass the audio along without being able to hear it (see “Private calls (beta)” above for what our servers can still see). Only the people who run KeyUp can access stored data, and only to keep the Service running, keep it safe, or help you when you ask. No system is perfectly secure. If you find a problem, please tell us: our Security page explains how.

5. How long we keep it

We keep your data only as long as KeyUp needs it. When the time is up it’s deleted, not just hidden.

The KeyUp app and web app don’t log IP addresses. They’re used for a moment to limit abuse, then forgotten. (This website keeps a salted one-way hash of the IP for spam control, as described above.)

6. Download your data or delete your account

Download your data anytime: You › Account and plan › Download my data on your Android phone (You › Account › Download my data on the watch and the web). You get a text copy of your account, rooms and messages, including your call history, your direct chats and their Delete messages after setting, your questions to the assistant and its memories. It also lists the calls for help you sent, the notes you pinned, your status, your room notification levels and your entries in the 48 hour list of missed talks. Photos and voice notes aren’t included. On the web you can also choose Email my data to me.

Delete your account anytime: You › Account › Advanced › Delete account on your Android phone (in Classic look, More › All settings and features › Account and plan › Advanced; You › Account › Delete account on the web; the watch sends you to your phone or the web; on a guest pass, Delete guest pass). It takes effect at once and can’t be undone. We delete your profile, sign-ins, devices, memberships, friends, the photos, files and voice notes you sent, your transcripts, your assistant memories, your problem reports, and your direct chats, including the other person’s copy of them (their messages, photos and voice notes in those chats). The text of messages you wrote in rooms is wiped, and the room keeps an empty “Message deleted” line so replies still make sense. We also delete your status, your room notification levels and your entries in the missed-talks list. A pinned note you wrote is deleted. A call for help you sent has its note and audio clip erased, and the record itself is deleted when its 30 days are up. Spaces you own go to another adult member. Members who are in only one room of a Space can’t take it over. If no other adult member can take over (the other members are under 18, or never confirmed their age), the Space and everything in it is deleted. Before you confirm, KeyUp shows which Spaces that would be, so you can hand one over first.

What is kept for a while after you delete:

• Backups. Our database is backed up every night on our server, and before each update, and each night’s backup is also copied to a second machine we control. Every copy is kept for at most 30 days, so your deleted account can still exist in them until they’re removed. We use a copy only to recover the whole service after a failure, never to bring back a single account.
• Calls with other people. Calls with you stay in the other person’s recent calls, whether you started them or they did, and your name is replaced with “Deleted account”. Calls in a direct chat are removed with that chat. A call in a room leaves a line in the room’s chat saying a call took place, with no name.
• Reports about you or your messages, and reports you made, and their evidence, as in the table above, because they protect other people.
• Your username. It is kept out of use for 30 days after you delete your account, so nobody, including you, can take it again at once. We keep only a one-way scrambled copy of it for that time, never the name itself.
• Basic security records, such as the fact that an account was deleted, for up to 12 months, without your name.
• Free trial marks. If you owned a Space that started a free trial, the keyed one-way marks of your verified email, install IDs, linked Google account and phone, for at least 400 days after the trial started, so a new account can’t start a second free trial (see “Free trial marks” above). A mark can’t be turned back into the email or the ID.
• Web checkout records. If you bought a plan on the web: the email you typed into Stripe’s checkout, the plan, price and the Terms you agreed to, for 3 years after the purchase, or 1 year after the plan ends if that is later.
• Subscription records. If you paid for a plan: the plan, status, dates, price and the store’s or Stripe’s reference numbers, kept for our accounts with no set end and no longer linked to your account.
• Anything on a legal hold, until the hold ends, and anything else the law requires us to keep.

The beta waitlist on this website is separate from your account. If you signed up here, deleting your KeyUp account doesn’t remove that entry. Use the unsubscribe link in any KeyUp email, or write to [email protected], and we remove it.

No app, or can’t sign in? See Delete your KeyUp account to ask us by email. You can also email [email protected] for either request.

7. Intimate images shared without consent

If an intimate image of you was shared on KeyUp without your consent, you can ask us to remove it on our removal page, Remove an intimate image, or by email to [email protected]. You don’t need a KeyUp account. We remove it, and identical copies we find, within 48 hours of your request. In the app, you can also report the message or person with the reason Intimate image shared without consent. That report always comes to the KeyUp team.

8. Requests from law enforcement

We respond to valid legal requests. We check that each request is real, and we give only what the law requires for the account it names. We tell the person before we give their data, unless a court order or an emergency stops us.

• What we keep is listed in section 5, for as long as it says there. What’s past its time is gone, and we can’t give it.
• What we don’t have: the content of private calls (they’re end-to-end encrypted, so we can’t hear them), IP addresses (our server doesn’t log them; Cloudflare, which carries our traffic, sees them), and passwords (only a one-way hash).
• Preservation requests. When law enforcement asks us in writing to preserve an account while it gets legal process, we keep a copy of that account’s data for 90 days, 90 more if they ask again, or until they release it. We don’t give the copy to anyone without valid legal process.
• We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), as the law requires.

Send requests to [email protected].

9. Your privacy rights

Wherever you live, you can ask us to:

• Access the personal information we have about you, and get a copy in a portable format.
• Correct information that’s wrong.
• Delete your information.
• Object to or restrict certain uses, and withdraw consent you gave, such as for Replay, transcription, the AI assistant or product emails. Withdrawing consent doesn’t affect what happened before.

Your right to object. You can object at any time to us using your information on the basis of our legitimate interests (for example security logs or crash reports), and we’ll stop unless we have compelling reasons or need it to handle a legal claim. You can withdraw any consent you gave at any time in the app (You › Privacy and AI) or by email.

What you must give us. We need your username, password and birth year (to check the age rules) to create an account, and your devices’ connection details to deliver talk and messages. Without them we can’t provide the Service. Everything else, such as your email address, profile picture, Replay, transcripts and the AI assistant, is optional.

No automated decisions. We don’t make decisions about you based only on automated processing that have legal or similarly significant effects. Reports are reviewed by people.

US state privacy laws. If you live in California or another US state with a privacy law, you have the rights above, including the right to know what we collect and why. We don’t sell personal information or share it for targeted advertising, so there’s nothing to opt out of there, and we only use sensitive information, such as your voice, to provide the Service. You can use an authorized agent, and if we turn down your request, you can appeal by replying to our answer. We won’t treat you differently for using your rights.

EU and UK users. If the GDPR or UK GDPR applies to you, KeyUp is the controller of your personal information, except for AI assistant requests, which the AI company handles under the Space owner’s account, and audio a Space sends to its own transcription provider, which that provider handles under the Space’s account. We rely on these legal bases: to perform our contract with you (running the Service); our legitimate interests (keeping the Service secure and reliable, including crash reports); your consent (saving your voice for Replay, transcription of your voice, the AI assistant, product emails and problem reports); and legal obligations. You also have the right to data portability and to complain to your local data protection authority.

Canada, including Québec. If you’re in Canada, you have the right to access and correct your personal information and to withdraw consent, and you can complain to the Office of the Privacy Commissioner of Canada, or in Québec to the Commission d’accès à l’information. The person in charge of protecting personal information at KeyUp is the owner, reachable at [email protected]. Your information is stored on our server in the United States (see section 11). If a breach creates a real risk of significant harm, we’ll tell you and the regulator, and we keep a record of every breach.

To make a request, email [email protected]. We may need to confirm it’s really you. We’ll respond within 30 days, or tell you if we need more time where the law allows.

10. Children and families

KeyUp is not directed at children. You must be at least 14 to create an account or use a guest pass, and a parent can’t create an account for a child under 14. Where local law sets an older age for agreeing to the use of your data, you must be that age. KeyUp itself has no parental consent step. Where a state law requires a parent’s approval, we use the approval the app store collects (on Android, Google Play, which parents manage in Family Link): in Texas now, and in other states as their laws start. A teen whose parent hasn’t approved the latest KeyUp changes is paused until they do: they can still sign in, but can’t talk, send messages or join rooms. New accounts for people under 18 may be unavailable in some US states for now (see State age laws at sign-up). Families are welcome to use KeyUp with teens who are 14 or older.

When you sign up we ask for your birth year to check the age rules. We don’t store the year itself, only whether you’re an adult (18 or older) or a teen (under 18). On Android we also use the age range and the parent approval status Google Play shares (section 1), only for the age rules and to follow the law. Accounts made before we asked confirm their birth year once, the first time they do something only adults can do. Accounts made before October 4, 2026 by people who were 13 stay open as teen accounts. Guests confirm they’re 14 or older. In US states with app store age laws (Texas today), guest passes are for people 18 or older: joining asks your birth year, which is used only for that check and not kept. If someone under 14 tries to sign up, we don’t keep the username or the year. To stop an immediate retry, that device’s install ID, as a one-way hash, is held for 24 hours.

Teen accounts get extra protections. Only adults can start or own a Space or buy a plan. Teens join Spaces only when invited, and Spaces marked Adults only (18+) are closed to them. Teens can’t use the AI assistant, and what they say in a room is never sent to it. A Space with a member under 18 can’t use its own transcription provider, so a teen’s voice is never sent to one. Only a teen’s friends can start a direct message, a direct call or an Ask to join with them; once a teen messages someone first, that person can reply in that chat and ask them to join a room, and a block either way ends it. Teens don’t appear to strangers in the list of people to message, and friend requests to a teen from an adult who shares no Space with them are marked so the teen can spot them.

We don’t knowingly collect personal information from children under 14. If we learn that an account belongs to someone under 14, we disable it at once and delete it (the teen accounts made before October 4, 2026 by people who were 13, described above, are the one exception). If you believe a child under 14 has given us information, email [email protected].

11. Where your information is processed

KeyUp isn’t offered in countries and regions under comprehensive US sanctions, and it isn’t available in some countries that restrict internet calling apps.

KeyUp is based in the United States. Our server is hosted by Microsoft Azure in a data center in the United States (Central US), and most of our other providers are in the US. If you use KeyUp from another country, your information is transferred to and processed in the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as our providers’ standard contractual clauses.

12. Changes to this policy

We’ll update this page when our practices change and update the “Last updated” date. If a change is significant, we’ll tell you in the app or by email before it takes effect.

13. Contact

KeyUp, keyupradio.com, a sole proprietorship in Pennsylvania, United States. Privacy questions or requests: [email protected]. Privacy contact (the person in charge of protecting personal information): [email protected]. All our contacts are on the Legal contacts page.

• Help and questions: [email protected]
• Report abuse or a user (spam, harassment, someone breaking these terms): [email protected]. In the app, use Report on their profile or message instead: it sends us the evidence.
• Safety concerns (threats, self-harm, child safety): [email protected]. If someone is in immediate danger, call 911 or your local emergency number first.
• Legal requests (law enforcement, subpoenas, copyright and other legal notices): [email protected]