Privacy policy
Who is responsible
DepKeeper is operated by İsmail Akar. For privacy questions, email support@godiak.com. Updated 28 October 2026. This text describes the current Android internal test application, optional staging license service and account-deletion request resource, alongside depkeeper.com. General production release is not yet available.
Optional Google license account and purchases
Free report functions do not require an account. When you choose Google sign-in for license verification or restore, Google supplies a signed identity token to the app and our license service verifies it. We derive a pseudonymous license identifier from the verified issuer and subject; we do not use your email as proof of purchase. The license database stores this identifier, registered device public keys, encrypted Google Play purchase tokens, product identifiers, verification/revocation states, revision counters and acknowledgement retry information. The Google-signed identity token may contain email and basic profile claims. Verification uses its issuer, subject and security claims; email, name and profile images are not saved in the license database. Raw identity tokens and Google passwords are not stored in the license database. Google Play handles payment; we do not receive payment-card numbers. Your rental reports, addresses, photos, signatures and PDFs are not uploaded to the license service.
License providers and network processing
Cloudflare Workers and a separate license D1 database process license requests. Google handles sign-in, Google Play purchases and purchase validation. These requests expose network information such as IP addresses to the providers. Application rate limiting uses hashed source identifiers and counters; application code does not deliberately log raw identity tokens, purchase tokens or report content. Provider security logs and recovery copies may have their own retention. The current license environment is a restricted test service; public production availability and offline entitlement terms have not been finalized.
Request license account deletion
Visit https://depkeeper.com/account-deletion/ without installing the app. App versions that include the new deletion action also link there from Settings or Packages. Existing internal-test versions may not yet show that action; the web and support request channels are independent of the installed version. The page explains the scope and provides support@godiak.com as a request channel. Online submission requires a fresh verified Google identity and explicit confirmation; support must establish ownership before processing an email request. A submitted request is not an immediate deletion confirmation. Do not send passwords, verification codes, private documents or purchase tokens. The request queue stores only the pseudonymous account identifier, a random request reference and request time. The Google verification service remains in staging and is limited to approved test accounts; other requesters can contact support for an ownership-verification path. Support checks the request queue each working day and aims to complete verified requests within seven days once pending payments or acknowledgement jobs have been resolved. This is a support target, not an automatic deletion deadline. Keep your request reference for follow-up.
Deletion scope, retention and later restore
Once a verified request is processed, the service removes the license account identifier, registered device keys, encrypted purchase tokens, license status and related jobs and challenges, then removes the completed request. Pending payments and acknowledgement jobs must be settled safely before processing; deletion does not initiate refunds or cancel Google purchases. Existing one-way token hashes for refunded/revoked purchases are retained to prevent replay, without a usable purchase token or account mapping; no fixed expiry is currently configured. Pending requests remain until processed. Provider backups/security logs are not claimed to disappear immediately. Local reports, photos, signatures, properties and PDFs are not erased by license-account deletion. Google accounts and Google Play purchase history remain under Google control. Cached verified rights can remain usable until signed expiry. A later verified sign-in and restore may create a new license record for the same valid purchase owner; repurchase is not required.
Your reports stay on your device
You can create reports without an account. Report titles, addresses, dates, rent and deposit details, names, notes, photographs and annotations are stored in the app’s private storage on your device. DepKeeper does not upload these records to a server operated by us. The core report and PDF workflow works without an internet connection.
Short stays and professional profiles
Short-stay photos, checks and notes stay locally with their reports. Agent Mode stores company/preparer details, logos, property and contact details, reusable room templates, keys, meter readings, signatures and contract information on your device. Reports preserve a snapshot of the details used for that handover. On-screen signatures are tied to report content; they do not verify a person’s identity or provide a qualified electronic signature. Imported contract PDFs are copied into local app storage. This professional profile is not an online account. Clearing app storage removes local data; manage exported copies separately.
Photos you choose
DepKeeper uses the camera images or photos you choose to add. Original photos are retained separately from your annotations and may contain camera metadata, including capture time and location. Review originals before sending them to anyone. A photo or report does not establish when damage occurred or who caused it.
Optional maps, address search and location
You can type an address manually. Opening the optional map requests OpenStreetMap tiles: the tile service receives your IP address, requested map area and application User-Agent. Address search or reverse-geocoding a selected point can send your query or coordinates to the Android platform geocoding provider, whose identity and data handling depend on your device. Accepted coordinates can be stored locally with a property or report. GPS is requested only when you choose the location action; you may deny or revoke location permission. A map can make network requests even without GPS permission. Choosing directions opens Google Maps or Apple Maps with the destination coordinates under that provider’s practices. Map tiles may be cached locally; provider log retention is outside our control. Check a suggested address before accepting it.
Optional card and identity-document scans
When you choose a scan, bundled Google ML Kit processes the selected business card, identity card, passport, driving licence or document image on your device. PDF scans support up to four pages. Recognition images and text are not sent to Google for recognition or uploaded to us. Business-card suggestions can be reviewed before saving to your local profile or property. Identity-document suggestions may include a name, address, document or identity number, date of birth and nationality. Only fields you select and confirm are transferred to the chosen tenant or landlord in the contract editor; they become part of the local contract when saved and can appear in exported documents. Number and machine-readable-zone checks do not authenticate a document or its holder. Collect only information you need and are entitled to use.
Scan copies and temporary data
The scan flow uses app-private temporary files to read images and PDFs. Owned camera captures and read copies are normally deleted after processing or cancellation. Recognized identity text and field-review choices remain in memory during the scan session, including screen rotation, and are released when the session closes. Scan images are not automatically attached to a report. If the app is interrupted, leftover scan files can remain: the next app startup attempts to remove recognized temporary scan files older than 24 hours. This is not a guarantee of deletion exactly 24 hours after capture or secure erasure. Original files you chose from another app or storage provider remain there.
Google ML Kit diagnostics
Separately from on-device recognition, Google ML Kit sends device and app information, a per-installation identifier, configuration, event and error information, and usage/performance metrics to Google. Input/output sizes can be included in diagnostics; document contents and recognized text are not sent for recognition. Google documents HTTPS transport for these metrics. The SDK is therefore not entirely network-free. Entering fields manually avoids submitting an image to recognition, but does not promise that all SDK diagnostics are disabled. See the provider disclosures below.
Contact shortcuts
Names and phone numbers used by the contact list come from your local reports, properties and edits in DepKeeper. The app does not request access to your device address book. When you choose a call, SMS or WhatsApp shortcut, the selected number is passed to the dialler, messaging app or WhatsApp link. You complete the call or message in that service. Its provider may process the number and any message you choose to send; opening WhatsApp can make a network request.
PDF, Word and Excel exports
PDF and Word (DOCX) reports are generated on your device. Agent Mode can also export an Excel (XLSX) portfolio with selected categories and fields, which can include names, phone numbers, addresses, coordinates, financial details and contract text. Review the selected fields and finished file before sharing. File names can include the report title, address and date. Saving, opening in another app or sharing makes a copy or grants access at the destination you select; that app, storage service or recipient controls its copy under its own practices. Deleting a report cannot recall copies already exported or shared. Imported contract pages included in a generated report are rendered as images; keep the original separately because its digital signatures, searchable text, links and interactive form fields are not preserved in those rendered pages. Word documents are editable; editing an exported copy does not update the app’s report.
Keeping and deleting local data
Local reports remain until you delete them or remove the app’s data. Generated PDF and Word documents can also remain in the app’s saved-document history; changing a draft does not overwrite those earlier copies. Deleting a report removes its database entry and attempts to remove its saved documents, associated contact overrides, identifiable export cache and unused photo/assets. Photos may be retained when another or unreadable record could reference them. Deleting an Agent property leaves its existing reports and their snapshots intact; delete those reports separately if needed. Portfolio spreadsheets and some older export cache files can remain until app cache/data is cleared. Clear app storage to remove all app-private records; separately manage files saved to Downloads or other destinations.
Before uninstalling or changing phones
Save any reports you need before clearing app storage or uninstalling: these actions remove local app data, including saved-document history. This build does not provide cloud backup and disables Android app backup and device transfer for its records. Exported PDF, Word and Excel files are documents to keep or share; do not assume they can restore editable report drafts.
Advertising and app analytics
The normal Android 0.4.14 build has no advertising SDK, advertising identifier permission or developer-operated app analytics service. Google ML Kit does send its own diagnostic and usage metrics as described above. No reports are automatically uploaded to us. A separate demo advertising development configuration is outside this policy’s scope.
When you visit this website
The website is delivered through Cloudflare. Connection and request information, such as your IP address and traffic information, is processed to deliver pages and protect the service. Cloudflare Web Analytics is enabled through the hosting layer to report aggregate visits, page views and page performance. Its current configuration excludes visitors from the European Union. Cloudflare describes this service as not using cookies or tracking individual visitors across websites. This website measurement is separate from the app: it does not receive your app reports, room photos or property details. There is no rental-report upload form or account registration on this site, and we do not add advertising cookies. Campaign labels in links describe public campaigns, not personal accounts. PDF downloads, email enquiries and app installations are not automatically measured by these page-view statistics.
Your website language
At the language-neutral depkeeper.com entrance, the website first uses a language you previously chose. Otherwise, a Cloudflare function uses its approximate visitor country to select a supported language; browser language is the fallback, with English used when there is no match. Only the chosen language is returned to the browser. We do not store the country or IP address for this feature and do not request GPS permission. A manual language choice is saved in your browser local storage for up to one year, without a visitor identifier; you can replace it using the language menu or remove it by clearing site data. Explicit language and article links keep their requested language. VPNs and network routing can affect the country estimate. This functional preference is separate from optional website measurement.
Optional website interaction counts
If you allow optional measurement using the Website measurement preference control near the footer, DepKeeper counts page views and link clicks by language, page type, placement and resource category. No optional event is sent before you allow it. Your choice and its 90-day expiry stay in your browser local storage, without a visitor identifier. You can change your choice there at any time; Do Not Track and Global Privacy Control disable these optional requests. We do not put report contents, form entries, addresses, IP addresses, user agents, full URLs or referrers into the measurement database. Cloudflare still processes connection data to deliver the request. Only daily aggregate counters are stored in a Cloudflare D1 database restricted to the EU. Reporting uses the latest 90 days; older counters are deleted on the next accepted event, so they may remain longer when there is no activity. Cloudflare backup and operational retention is separate. Counts are actions, not unique people, completed downloads, sent emails or app installations. Withdrawing permission stops future optional events; individual contributions cannot be separated from existing aggregate counts. The separate Cloudflare visit measurement described above keeps its existing EU-excluded configuration and is not controlled by this optional-event preference.
When you contact support
Emailing us shares your email address, message and any attachments with İsmail Akar through the support@godiak.com mailbox, whose mail is routed through Hostinger. We use this information to answer your enquiry and investigate the issue you describe. Please send a short description first; avoid attaching private room photos, identity documents or complete rental reports. You can ask us to delete your correspondence using the same email address.
Service providers and retention
Cloudflare handles website delivery and website analytics; Hostinger routes email for support@godiak.com, and Google handles ML Kit diagnostic processing. OpenStreetMap provides optional map tiles, and the device’s geocoding provider handles optional address queries. These providers may process information outside your country under their own terms. Provider request and diagnostic retention depend on the service; we do not set those periods. Support correspondence may remain in the mailbox until deleted. Contact us to request deletion of information held for your enquiry. Local app data follows the deletion choices above.
Your privacy choices
You can use the app without address suggestions, control Android permissions, delete local reports and choose whether to export or contact us. Depending on applicable law, you may also have rights to access, correct, delete, restrict or object to the processing of information we hold, request portability, and complain to a data protection authority. Contact us using the email below. We cannot access or recover local reports on your device or delete copies held by another recipient.
Security and policy changes
The website uses HTTPS. The app stores records inside Android’s private app storage and grants temporary file access when you choose to open or share a document. It does not provide a separate encrypted identity-document vault. Keep your device locked and check recipients before sending a report. This is not a claim that exported PDF, Word, Excel files or email are end-to-end encrypted. Changes to this policy will appear here with an updated date.
Launch waiting list
If you choose to join, İsmail Akar / DepKeeper stores your email address, language, consent version and request time solely to send one Android app launch announcement. Joining is optional and is separate from website measurement. Use only your own address. The list is stored in a separate Cloudflare D1 database restricted to the European Union. Cloudflare Turnstile loads when the form opens to protect it against automated abuse; Cloudflare processes technical browser/network information for that purpose. We do not store your IP address or Turnstile token in the waiting list. This is a single opt-in request, not verification that you own the mailbox; no confirmation email is currently sent. Entries expire after 90 days; expired entries are excluded from any launch mailing and removed by weekly maintenance and on the next accepted form request. Provider recovery copies can persist under Cloudflare retention. You can withdraw using the Leave the list button in the same form or by emailing support@godiak.com. We use a generic response so the form does not reveal whether an address was already registered. We do not sell this list or use it for a general newsletter. Website waiting-list notice updated 24 September 2026; the app-preview scope above remains separate.
License account deletion
Request deletion of your DepKeeper license account. This does not erase reports stored on your device.
Provider information
Contact
Operator: İsmail Akar