Privacy policy

As of October 2026. This page is a courtesy translation of the German privacy policy (Datenschutzerklärung). The German version is legally binding.

This policy applies to the app "KeyMoments" for iPhone and iPad and to this website. KeyMoments is built so that your child's memories stay with you: we do not store your content on our own servers, show no advertising and use no analytics or tracking services. Only if you switch on the optional add-on "KeyMoments Plus" do notes and photos go to the AI Claude for individual texts (section 4).

1. Controller

Mario Hiebl
Pflanzbergweg 27, 92263 Ebermannsdorf, Germany
Email: [email protected]

2. Where your content is stored

Entries, photos, videos, voice recordings and their transcripts, moods, appointments, stories, letters and diary are stored on your iPhone and in your own iCloud account (Apple CloudKit). Texts and media are end-to-end encrypted before upload. As the provider, we have no access to them. Once everything has reached iCloud, photos and videos are not part of your device backup; if something exists only on the device, or if your iCloud is full, it stays in the backup. The provider of iCloud is Apple Distribution International Ltd., Ireland; Apple's privacy policy also applies.

Backup as a file: If you create a backup in your profile, an encrypted file protected with your password is created on your device. You decide where to keep it (for example Files, iCloud Drive, a USB stick). We receive nothing from it.

If you share a book with others (for example the other parent or your child), these people see the contents of this book through iCloud. You decide whom you invite and what rights they have.

3. Processing on the device and services from Apple

Photos and videos: With your permission the app searches your library for your children's faces. Face recognition runs only on the device: Apple's Vision finds the faces, and the openly available face model SFace (OpenCV Model Zoo, Apache License 2.0) computes features from them. Both work without an internet connection, and no photos or face data are sent to us or third parties. Only these features (biometric data) and small preview pictures of the learned faces are stored, end-to-end encrypted in your iCloud, so that for example the other parent can also find photos. You can delete them at any time in your profile ("Delete all faces and learn again"). If you tap "Not …" on a suggestion, the app remembers the features of that face as a counter-example, so that it does not keep suggesting for instance another child of the family. This happens only on this device, not in iCloud, not in the device backup and not in the backup file. It is deleted by "Delete all faces and learn again" and when you delete or leave the book. Please learn the faces of other people (for example grandparents) only with their consent. What is visible in a photo (for example beach, zoo, cake) is also recognised by Apple's Vision on the device, only for suggestions for title, place and text. Place and time of a photo are taken over for entries.

Place names: To turn the coordinates of a photo into a place name (for example "Hellabrunn Zoo" or, if there is no special place nearby, the address with street and house number) and to show places on a map, the app uses Apple's map service. Only the coordinates or the place name go to Apple, no photos. Places where you often are ("Home", "At grandma's") are remembered by the app only on the device.

Faces of other people: You can voluntarily teach the app the faces of family members or friends (for example "Grandma Inge") so that stories mention who was there. Each invited person can also learn their own face. Please learn other people only with their consent. Recognition runs only on the device. Only encrypted feature vectors and a small preview picture of the learned people are stored in the child's book (in the iCloud of the book's owner, visible to everyone invited). You teach your own face once; it then applies to every book you belong to and is stored in each of them this way. So that the app can ask "Is this grandma?", it examines on the device the faces in the book's photos. The features of faces that look like a learned person are kept by the device in a temporary cache, only on this device, not in iCloud and not in the device backup. The features of all other faces (for example friends in group photos) are not stored permanently. If you confirm a face for a person you may not edit, it also stays only on your device. You can delete learned people at any time. With the person, even if it is deleted on another device, and when you delete or leave the book, the app also deletes this data on the device. The cache is also emptied by "Delete all faces and learn again" and deleted as soon as no person is learned any more.

Comments and reactions: Comments, emoji reactions, wish lists, kid quotes and measurements are stored end-to-end encrypted in the child's book and are visible only to the family. The owner of the book can delete them at any time.

Location: When you take a photo or video in the app, KeyMoments asks for your current location once to suggest the place. As with photos from your library, the place is stored only in the entry in your iCloud. If you share an entry by link, the place goes with it (see section 6).

Location in the calendar: Also only if you switch on sun or weather in the calendar (see below). If you withdraw the permission in Settings, the app forgets the last saved place and the weather.

Notifications: Reminders (for example weekly photo, handover, "On this day", monthly recap) and notices of new entries are created locally on your device, with no server.

Stories and texts: Recaps (including the drafts the app prepares itself), captions under photos and titles are created with Apple's language model on the device (Apple Intelligence) where available, only from the contents of your book and with no internet connection. Only if you have bought, switched on and consented to KeyMoments Plus does Claude write them instead (section 4). So that the texts fit your family, the app remembers how you changed AI texts (at most 40 examples). These examples live on the device and in the iCloud key-value store of your Apple ID, so your other devices can use them too; only general features go to the AI (for example "shorter", "no exclamation marks"), not the texts themselves. You can delete them in your profile under "AI texts" with "Forget what was learned", which then applies on all your devices. So that the app never learns from its own texts later, it also remembers checksums of the texts it wrote itself: short numbers instead of the texts, and the texts themselves are not stored for that. They live only on the device (and in its device backup), not in iCloud.

Dictation: With "Say it instead of typing", spoken language is turned into text. If your iPhone supports it, this happens on the device. Otherwise the speech is sent to Apple for recognition. The app does not store the voice recording, only the finished text.

Transcripts of voice recordings: If you allow speech recognition, the app transcribes voice recordings in entries, kid quotes, interviews and questions for the family, so you can read and search them. If your device supports it, this happens only on the device; otherwise the recording is sent to Apple for recognition. The transcript is stored end-to-end encrypted in iCloud like the entry and is visible to everyone who sees the book. You can edit or delete it.

Microphone and camera are used only when you start a recording yourself.

Calendar: Appointments from your Apple Calendar are taken over or shown only if you choose that. If you switch on "Show appointments in the iPhone calendar" in your profile, the app creates a separate calendar "KeyMoments – Name" for each child and puts the appointments there, preferably in your iCloud calendar so they also appear on Mac and Apple Watch. Apple's rules apply to this calendar; calendars in iCloud are not end-to-end encrypted. If you switch the sync off, the app removes these calendars again.

Sun and weather in the calendar (only if switched on): If you switch on "Sunrise and sunset" or "Weather" in the calendar, the app asks for your location and rounds it to about 10 km. Moon phases and sun times are computed by your device itself. Only for the weather forecast does the app send this rounded place to Apple Weather (WeatherKit, the same service as Apple's Weather app; data sources). Only the rounded place and, for technical reasons, your IP address are sent, no content from your book.

Music for the slideshow: If you tap "Find free music on Pixabay" in the slideshow, the app opens the website pixabay.com in a built-in browser. Pixabay's privacy terms apply (Pixabay GmbH, Germany); the site may set cookies. Nothing from your book is sent. A song you download stays only on your device.

Time check: So that sealed letters cannot be opened early by changing the clock, the app occasionally reads the current time from the response of the website apple.com. Only a simple request without content is sent (for technical reasons with your IP address).

Public holidays and school breaks: if you choose a region in the calendar, the app loads the public holidays and school breaks of that region from the free service OpenHolidays API. Only the country, region and period are sent, no data from your book.

4. Optional: KeyMoments Plus, texts with Claude

KeyMoments Plus is an optional add-on subscription. With it, the AI Claude from the provider Anthropic writes the captions under photos, titles, entry texts, stories and recaps instead of Apple's language model on the device. The app sends something only if you have bought Plus, switched it on in your profile under "AI texts", "KeyMoments Plus", and agreed to the notice. You can switch it off there at any time; after that, texts are created only on the device again.

What is sent, only for the text you are having written at that moment (or for a recap the app prepares as a draft, and only if you switch on "Prepare recap drafts" under KeyMoments Plus):

• the app's instruction to the AI, your notes (with the names in them) and, if you have an existing entry or story rewritten, also its previous text and the texts under the photos, the child's first name, the author's name, place names, the date and, for recaps, titles and texts of the entries in the period and titles of appointments,
• the photos of the entry (at most ten) or, for recaps, all selected photos of the recap (at most 31, for a yearly recap 50, then reduced to at most 640 pixels), otherwise reduced to at most 1,100 pixels and saved again without the embedded image data (no GPS coordinates, no device details). Videos are not sent as video: instead up to three stills from them go (start, middle, end), reduced in the same way and without image data, and only if you have allowed the app speech recognition, the spoken text of the video, which Apple's speech recognition transcribes (on the device if the device can, otherwise through Apple's speech recognition service, as with transcripts of voice recordings). Voice recordings and the sound track itself are not sent,
• for each photo, in words: day and time of day of the shot, the place name, the surroundings (for example town, lake, region) and the weather on that day, and the names of the people the on-device face recognition found in the photo (child, siblings, learned people). The device works out the surroundings through Apple's map service from the photo's coordinates, and asks Apple Weather (WeatherKit) for the weather: only the place rounded to about 10 km and the date go to Apple, no content,
• the purchase receipt of your Plus subscription signed by Apple (transaction identifiers, product, purchase and expiry date; no names, no email address, no payment details) or, for the free trial with 100 Sparks , the app receipt signed by Apple (a pseudonymous identifier Apple assigns for this app and your Apple ID, app version and download date).

Our relay server (plus.key-moments.de, run on Cloudflare Workers by Cloudflare, Inc., USA) checks the purchase receipt, forwards the request to Anthropic and returns the text to the app. It stores no notes, texts or photos. It stores only: the pseudonymous identifier of your subscription (original transaction number from Apple) or, for the free trial, Apple's pseudonymous app identifier; how many entries, stories and summaries you have written in the current subscription month; the number and cost of requests; redeemed top-ups; and, for at most 100 days, random identifiers of the individual entries (so that an entry counts only once). Cloudflare processes technically necessary connection data such as the IP address; we keep error logs without content for at most 7 days.

Anthropic (Anthropic, PBC, USA) processes the requests as our processor in order to write the text. Anthropic does not use inputs and outputs from the API for training its models and deletes them automatically after a short time (according to Anthropic currently after 30 days at the latest, except where misuse of the usage policies is suspected). The transfer to the USA is based on the EU Standard Contractual Clauses in the data processing agreement with Anthropic. Claude is not used for face recognition; the photos serve only to understand the notes correctly.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching it off, and for the purchase receipt and counters the performance of the subscription contract (Art. 6(1)(b) GDPR). Please send only photos and notes whose sharing the people shown or named would agree to. We delete the counters 13 months after the end of your subscription at the latest.

5. Optional: help improve the ideas

Only if you switch on "Help improve the ideas" in your profile (off by default) are the titles of new entries and appointments sent to us, together with the kind (entry or appointment), the category, whether it is a milestone, the child's age in months, the month and the app language.

Beforehand the app replaces the names it knows with placeholders: your children's names, your own name in the app and, for appointments, the person the appointment is with. It also removes phone numbers, email addresses and links. Other names in the title (for example "Grandma Inge" or friends) and place names in the title are kept. Photos, the text of the entry and the place field are not sent.

The data is stored in the app's public iCloud database (Apple CloudKit). This database is not end-to-end encrypted. CloudKit automatically stores a pseudonymous, app-specific iCloud identifier of the sender with each record. It reveals neither your Apple ID nor your email address to us. But the same identifier is also attached to links you share (section 6), where your name appears as the author. The titles can therefore be linked to you; they are pseudonymous, not anonymous.

Purpose: better ideas and suggestions for all users. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching it off. Switching off stops the sending of new titles. Titles already sent are not deleted automatically; we delete them as soon as we no longer need them for this purpose, or sooner if you ask us to.

6. Sharing by link, invitations and links to other providers

If you share a single memory by link, the app places a copy in the app's public iCloud database (Apple CloudKit). The copy contains:

• title, text and date,
• the place, but only roughly: the town the app works out from the photos' shooting data, with no street and no house number (older app versions up to 1.0.2, build 90, sometimes sent the exact address),
• the name of the author (your name in the app or the name of the family member who wrote the entry),
• the child's first name. The switch "Show the child's first name" is on by default. If the name is in the title or text, it stays visible there even with the switch off,
• if selected, up to 12 reduced-size photos (without embedded location data) with date and place of the shot.

CloudKit also automatically stores the pseudonymous, app-specific iCloud identifier of the person sharing (see section 5). The copy is not end-to-end encrypted. It is meant for people who know the link, but it sits in a publicly readable database. So share by link only what outsiders may see.

Links expire after the time you choose, after 90 days at the latest, and can be withdrawn in the app at any time. After expiry the app and website no longer show the content. The copy including photos is deleted immediately when you withdraw it, and after expiry the next time the app starts on the device where you created the link. If you delete the app beforehand or no longer use that device, the copy stays in the database. Send us the link then, and we will delete it. The viewing page loads Apple's CloudKit library for this.

Invitations on handover and transfer: If you hand your child their letters, or transfer a book to another person, the app places an invitation in the public iCloud database. It contains the pseudonymous iCloud identifier, valid only for this app, of the invited person and the link to the share. The record's name also contains the identifier of the book and the app-specific iCloud identifier of the sender (for letters) or of the invited person (for transfers). CloudKit additionally stores the identifier of the creator. No content from the book is in it, and only the invited person can use the link. As soon as the invited person has accepted, the sender's device deletes the invitation the next time the app starts; older invitations we delete on request.

Links to other providers: Some buttons open websites of other providers in the browser. The app does not send content from your book there.

• "Open in Google Maps": If you tap this at a place, the coordinates are sent to Google (Google Ireland Ltd.). Google's privacy policy applies. "Open in Maps" uses Apple Maps.

The German version of the app also offers links to German print partners; they are not part of the English version.

7. Purchases and subscriptions

Subscriptions and purchases are handled exclusively through Apple's App Store. We do not receive payment details. For KeyMoments Plus, the purchase receipt signed by Apple goes with every request to our relay server (section 4). The app stores the start of your free month in your iCloud account. So that invited people can see whether a book is paid for, the app stores in the book until when your subscription runs; for a gift subscription also the name of the person giving it and the term.

8. This website, email and social media

This website is delivered through Cloudflare Pages by Cloudflare, Inc. (USA). When you visit, Cloudflare processes technically necessary data such as IP address, time, browser and the page requested in order to deliver the page and protect it against misuse (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. This website sets no cookies itself and includes no external fonts or analytics services. Only the page for shared links loads Apple's CloudKit library (see section 6).

If you write to us at [email protected], the email is delivered through Cloudflare's forwarding service to our mailbox at GMX (1&1 Mail & Media GmbH, Germany). We use your address and message only to reply to you (Art. 6(1)(b) or (f) GDPR) and delete them when they are no longer needed for that.

KeyMoments is present on Instagram (@keymoments.app) and Facebook (KeyMoments). These services are run by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. When you view, comment on or message our posts there, Meta processes your data according to its own privacy policies, also in the USA (Meta is certified under the EU-US Data Privacy Framework). For the page statistics ("Insights") that Meta shows us only in summary and without names, we are jointly responsible with Meta (Art. 26 GDPR). Meta has taken the main responsibility for this; you can find the agreement at facebook.com/legal/terms/page_controller_addendum. You can assert your rights directly with Meta or with us. We use comments and messages only to reply (Art. 6(1)(f) GDPR). The website itself includes no content from Instagram or Facebook, only simple links.

KeyMoments is also present on TikTok (@keymoments.app). For users in the European Economic Area and Switzerland, TikTok is run by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. When you view, comment on or message our videos there, TikTok processes your data according to its own privacy policy (tiktok.com/legal/privacy-policy-eea), also outside the EU. For the statistics that TikTok shows us only in summary and without names, we are jointly responsible with TikTok (Art. 26 GDPR); you can find the agreement at tiktok.com/legal/…/tiktok-analytics-joint-controller-addendum. You can assert your rights directly with TikTok or with us. We use comments and messages only to reply (Art. 6(1)(f) GDPR). The website includes no content from TikTok, only a simple link.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent. Because your content is in your own iCloud account, you can delete it at any time in the app or in your iCloud settings. You can also complain to a data protection supervisory authority, for example in your country or region.

10. Children

The app is aimed at parents. Children use it only if their parents invite them (child access). A child's private diary lives only in the child's own iCloud account and is not visible to the parents. So that child access runs on only one device, the app stores a random device identifier in the child's iCloud account.

11. Components used

The app contains the face model SFace by Yaoyao Zhong from the OpenCV Model Zoo (Apache License 2.0). It is built into the app and runs only on the device; no data is sent to the model's developers or to third parties. You can find the licence text in the app under Profile, Help, "Licences & acknowledgements". The app contains no other components from other providers, and no advertising or analytics SDKs.

12. Changes

We adapt this policy when the app changes. The version published here applies.