Effective date: 2026-10-11
Who is responsible: Keto Log is made by Kfir Arad, an individual developer based in Denmark. Contact: keto@kfir.app
Everything below is stored only on your device, in a database encrypted with a key that is generated on your device.
Symptoms and notes are not saved to Apple Health and are not part of the CSV export. They are in the encrypted backup file.
The developer has no copy of any of this and no way to obtain one.
If you add a Keto Log widget to your Home Screen or Lock Screen, the app hands iOS a drawing of what the widget shows: today's net carbs against your goal, calories, fat and protein, the last few foods you logged, and your running fast. iOS keeps that drawing on your iPhone, in a storage area shared between the app and its widgets. This copy is outside the encrypted database, is protected only by your iPhone's own lock, and can be seen by anyone looking at your Home Screen. A Lock Screen widget shows its figures (net carbs against your goal, or your running fast) while the iPhone is locked. It never leaves your device. Remove the widgets to stop it being shown; the copy is replaced each time the app updates the widgets and is deleted with the app.
The database key is kept in your iPhone's Keychain. If you use iCloud Keychain, Apple syncs the key between your own devices, end-to-end encrypted, so that your log can be opened after you restore or replace your phone. The key is not your health data, and the developer never receives it. Settings shows a recovery key that you can keep somewhere safe.
Keto Log does not store your log in iCloud itself. If you have iPhone backups turned on (iCloud Backup or a backup to a computer), iOS includes the app's encrypted database file in that backup, as it does for other apps. That backup is made by Apple's system under your Apple Account and Apple's privacy policy.
Apple Health sync is off until you turn it on in Settings, and iOS asks for your permission for each kind of data. You can change these permissions at any time in the Health app or in Settings, or turn the sync off in Keto Log.
When it is on, Keto Log:
Showing workouts is a separate switch in Settings, also off until you turn it on. When it is on, Keto Log reads the workouts that Apple Health holds (activity, time, duration, and energy and distance where recorded) and shows them on their day. They are displayed only: they are not copied into Keto Log's database or changed, and Keto Log never saves workouts to Apple Health.
Net carbs, ketones, blood pressure, pulse, blood lipids, fasts, symptoms and notes are not saved to Apple Health.
Keto Log does not use Apple Health data for advertising or marketing, does not sell it, and does not share it with anyone. It never leaves your device through Keto Log. Turning a switch off stops further saving and reading; data already saved to Apple Health stays there until you delete it in the Health app.
If you choose to add a photo, Keto Log asks for access to the camera and to your photo library. A photo you take is saved to your photo library. Keto Log remembers which picture belongs to which entry and shows it with that entry. Photos are not uploaded, and they are not copied into the app. If you delete a picture from your library, the entry simply has no photo.
On iPhones that support Apple Intelligence, Keto Log offers an assistant and a written review of your figures. Both use the language model that is built into iOS and runs on your iPhone. What you type, a photo you show the assistant, and the figures, symptoms and notes used for the review are processed on your device and are not sent to the developer or to any other company by Keto Log. Sending a photo to the assistant needs iOS 27 or later.
The assistant can read your log to answer you. It saves nothing until you approve it. Conversations are not kept after you start a new one or close the app. The latest written review is stored in the app's database on your device.
The model can be wrong. See the notice in Settings > About.
Keto Log makes no internet requests. It contains no update service, no analytics and no other code that contacts a server, and it works with the network switched off.
Three things are done by Apple's own system services, under your Apple Account and Apple's privacy policy, not by Keto Log: Apple Health (if you turn the sync on), iCloud Keychain (which syncs the encryption key), and iPhone backups.
Once a file has left the app, it is under your control and that of the service you saved it to.
Apple may collect its own information about app downloads and crashes, depending on your device settings, under Apple's privacy policy.
Your data stays on your device until you delete it. You can delete individual entries, readings and fasts in the app. Deleting the app removes its database from your device. To remove everything completely, also:
Because the developer holds no data about you, there is nothing for the developer to delete, correct or hand over on request. If you believe otherwise, write to the contact address above.
If you are in the EU or EEA, the GDPR gives you rights of access, correction, deletion, restriction, objection and portability, and the right to complain to a data protection authority. In Denmark that is Datatilsynet (www.datatilsynet.dk). In practice the only information about you that the developer could hold is an email you send to the contact address.
If you send an email, the developer receives your address and whatever you write, uses it only to answer you, and deletes the correspondence when it is no longer needed. Please do not send health information by email.
Keto Log is not directed at children and is intended for adults. It does not knowingly collect personal data from anyone.
If this policy changes, the new version will be published at the address above with a new effective date. If the app ever starts to collect data, the policy and the App Store privacy label will be changed first.