Legal
Privacy
Last updated August 12, 2026
No device position is ever read. The app links no third-party packages, so there is no analytics library and no advertising network inside it.
Nothing is sold to a data broker. Image safety checks run on your phone.
This policy covers the Porchkeep iOS app and the website at porchkeep.com. It was written by PlainSpan LLC without a lawyer. Counsel review is pending, and this page changes if that review changes it.
Porchkeep is not open. There is no public build and no account exists. What follows describes the app as it is built today, and it gets a new date the moment that stops being true.
What your phone is asked for
Every permission the app declares, and what it is for. iOS shows you each one at the moment it is needed, and declining any of them leaves the rest working.
- Camera. The live capture that confirms a real person is making the account, and photographs for your profile.
- Photo library. Only the pictures you pick. Never the whole library.
- Microphone. Voice answers, voice Knocks, and audio in a call inside the app.
- Face ID. App Lock, if you turn it on.
- Contacts. Optional. It exists so the app can hide your profile from people you already know. The comparison runs on the device and no contact is uploaded.
There is no location permission. The app declares no purpose string for one, so iOS never puts that prompt up. No coordinate exists anywhere in the product, and nothing works out how far apart two people are.
What Porchkeep holds
| What | Why | How long |
|---|---|---|
| Your first name | So people know what to call you. | Until you delete your account. |
| Your date of birth | To confirm you are 18 or over, once. The age on your profile comes from it. | Until you delete your account. |
| Your email address | To sign you in, and to send you receipts and the outcome of anything you report. | Until you delete your account. |
| The neighbourhood you picked off a list | So a Table has somewhere to be, and so the city question means your city. | Until you change it or delete your account. |
| Your answers, your Knocks, and your messages | They are the product. Discovery here is over what people wrote. | Public for 14 days. Your own copy stays until you delete it. |
| Your photographs and voice recordings | So a profile has a face and a voice on it. | Until you remove them or delete your account. |
| That you passed the liveness check, and when | So the mark on your profile means something. | Until you delete your account. |
| Which answers were put in front of you, and where they sat | Without it there is no way to tell you whether anybody read you. | 90 days, then the individual rows are dropped. |
| Your device model and iOS version | To tell which phones a crash is happening on. | 30 days. |
| Whether you pay, and for how long | So a purchase works. Apple takes the payment. | Seven years for the transaction record. Tax law wants records of money taken. |
Position data is stripped out of every image on upload. Your card number never reaches Porchkeep, because Apple handles the payment.
What is never collected
- No Social Security or national ID number. There is no field for one.
- No stored image of an identity document. None is ever received.
- No advertising identifier, and no advertising.
- No score about you, and no percentile.
- No field for religion, health, politics or ethnicity. Write about any of it in your own words if you want to. It stays text you wrote, and it never becomes a filter.
Your face
Making an account means a short live capture and a face template computed from it. The template is destroyed when the check finishes and in no case later than 24 hours. No identity document image is stored, because none is ever received.
The full schedule, the destruction guidelines and the notice you are shown before the camera opens are published separately, at the biometric policy. Illinois requires that document to be readable without installing anything, which is why it has a page of its own.
Safety checks on your phone
Nudity detection runs on the device. Nothing is uploaded for it, not even a hash. Two layers run, because Apple's own sensitive-content analysis is switched off by default on most phones and an app that relied on it alone would ship a protection that quietly did not exist. A bundled classifier runs underneath it.
A result describes one image. It is not stored against a person, and there is no counter anywhere of how often it fired.
How long things are kept
Answers are publicly readable for 14 days. On day 15 they come off every public surface, so nobody can find yours and you cannot find theirs. Your own copy stays where only you can see it, until you delete it.
Some material has to be held longer, and only for a named reason: a report, an active enforcement action, a preservation request from law enforcement, or a report to the National Center for Missing and Exploited Children. Federal law sets one year for the last of those (18 U.S.C. section 2258A(h)), and a court order can set longer. Held material is not visible to other members and is not used for anything else.
Who else sees any of it
- Other members see your profile, your answers, and whatever you write to them.
- Apple takes any payment and knows what was bought.
- Amazon Web Services hosts this website. See the section on it below.
- Google Workspace delivers mail sent to the address at the bottom of this page.
Personal information is not sold. Information may be disclosed where the law requires it, and where a court orders it.
Deleting your account
Deletion is in the app, it takes one confirmation, and there is no offer to stay. Everything in the table above goes at that moment: the profile and its photographs and recordings, the answers, the Knocks, the messages, and the sign-in details behind them.
Four things survive, each for a stated reason:
- A record that money changed hands. Seven years, because tax law wants it.
- A report somebody else filed about you, and the messages it named. Twelve months. That report belongs to whoever wrote it.
- A one-way value derived from the liveness check, if the account was removed for harming somebody. It cannot be turned back into a face or a name, and leaving of your own accord never creates one.
- Anything a court has ordered kept, until the order lifts. You are told when that applies to you unless the order itself forbids it.
Your rights, and how to use them
You can ask what is held about you, ask for it to be corrected, ask for it to be destroyed, and take a copy with you. Export produces one JSON file another service can read.
Depending on where you live, your state may give you more. Personal information is not sold here and none of it drives targeted advertising, so there is nothing of that kind to opt out of. Access and destruction requests are honoured on their merits. Write to hello@plainspan.com.
Under 18
Porchkeep is for adults. Nobody under 18 may hold an account, and the app is not directed to children. A credible signal that an account holder is under 18 locks that account rather than asking them to confirm and continue.
An intimate image of anyone under 18 is reported to the National Center for Missing and Exploited Children. That is a legal duty, and it is not something PlainSpan LLC can waive on request.
This website
porchkeep.com sets no cookies, runs no analytics, and makes no third-party request. That is enforced by the content security policy the site is served with rather than by intention.
Amazon Web Services records a standard access log when a browser asks for a page: the IP address, the browser user-agent, the page, and the time. Those logs sit in a private encrypted bucket and are deleted after 90 days. They are used to keep the site up and to find faults.
Where things are
PlainSpan LLC is a limited liability company in Texas, United States, and information is processed in the United States.
Changes
A change to this policy changes the date at the top. Substantial changes are announced in the app as well.
Contact
Write to hello@plainspan.com, or see support for what to include. To have an intimate image removed, use the takedown page, which does not need an account.
Written by PlainSpan LLC. Not reviewed by counsel, and that review is pending. Terms are at /terms. The biometric schedule is at /retention.