Last updated: 29 October 2026
This explains what information Kerchiff collects about you, why, how long it is kept, and what you can ask us to do with it. It is written to be readable. If anything here is unclear, ask and we will explain it.
Kerchiff is a service of Kerchiff Inc., a Canadian company based in Ontario. It has a privacy officer: one person accountable for your information, who answers the address below. If you want to know who that is, ask and we will tell you.
To ask a question, or to make any of the requests below:
We collect different things depending on how you interact with us.
When you comment on one of our Instagram posts with a keyword
A keyword is a word we ask for in a post, like "LINK". When your comment has one, we keep:
We use this to reply to you, and to understand which posts bring people to us. Knowing which post someone came from is the main thing this system is for.
We do not keep the rest of what you wrote in your record. Instagram sends us your whole comment, and that original message is deleted after 60 days (see below). If your comment has no keyword, we keep no record about you at all — only that original message, for those 60 days.
When you comment on one of our Facebook posts with a keyword
The same as Instagram, except that Facebook gives us:
We treat your Facebook and Instagram accounts as separate. We do not guess that they belong to the same person.
When you send us a direct message on Instagram
If your message has a keyword, or replies to one of our stories, we keep:
We use this the same way we use comments: to reply, and to understand which posts and stories bring people to us. Instagram does not send your username with a message, only an ID, so we ask Instagram for it — see "Your Instagram name and picture" below. As with comments, the rest of what you wrote stays only in the original message, for 60 days. The one exception is an answer to a question we asked you, below.
We do not keep anything else from your reply. When one of our keywords is tied to one of our own stories or posts, we keep a small picture of that story or post, so we can see which one it was. That picture is ours, not anything you sent.
Your Instagram name and picture
Once you are in our records through Instagram, we ask Instagram once for your public profile, and keep:
We use these so we can see who we are talking to, and to greet you by name in messages we send you. An answer you gave us can be used the same way, in a message to you. We keep our own copy of the picture because Instagram's link to it stops working after a while. We ask once, not over and over. If Instagram does not answer, we leave them blank, and ask again only if you later send us a message. If you have told us your name, or we have written one for you ourselves, we keep that instead. When you ask us to delete your information, these are deleted with it, and they are part of the copy you get if you ask for one.
When you answer a question we ask you in a message
Sometimes a message from us asks you something, like your name, your level or your email address. While we are waiting for your answer, we treat your next message as the answer, and we keep:
If we ask for your email address, we add it to your record as your email, beside any you gave us before, so we can send you what you asked for and know it was you if you later buy something with it. If someone else in our records already has that address, we still add it to yours and note that the two of you might be the same person, but we do not join your records.
If your answer is not the kind we asked for, like words where we asked for a number, we ask once more and keep nothing from the reply that did not fit. Every question has a Skip button; if you tap it, we keep only that you skipped. You can ask us to correct or delete an answer, like any other detail.
When you tap a button in a message we sent you
If a message from us has buttons and you tap one, we keep which button you tapped and when. We use it to send you what that button offers, and to understand which messages people respond to.
A button that opens a web page goes through kerchiff.com first, which sends you straight on. That is how we know you tapped it: we keep which link it was and when you tapped it, each time you do. Nothing about your phone or browser is added to your record (our server's own log is separate, below). If you ask us to delete your record, the link still works, and we still count that it was tapped, but nothing says it was you.
If you send us a message asking to stop hearing from us, we record that you asked and we stop. We send one message back to confirm it, with a Subscribe button, and nothing else after that. If you change your mind, tap Subscribe or send us START, and we will message you again. If you later send us or comment one of the keywords we ask for, we take that as asking to hear from us again, and answer it.
The messages we send you
We keep what we sent you and when. The law asks us to be able to show what we sent, and it lets you see it too.
When you visit one of our websites
Like most websites, our server keeps a log of each visit to the Kerchiff app and our pages, so we can keep them secure and working: for example, to spot someone attacking them, or to find out what went wrong. For each visit it keeps:
It does not keep which page or link you opened. This log is not part of your record and is not used to work out who you are. It is deleted after 30 days.
Separately, we count how many times each page of kerchiff.com and of our sign-in and sign-up pages is opened each day, with the website that linked to it or a campaign tag in the link, if there was one. These are totals only: nothing that could recognise you is kept with them, and no cookie is used.
Our main website, kerchiff.com, is served by Cloudflare, which sees your IP address as any website host does. On its pricing page, Cloudflare tells us only which country you are in, so we can show prices in Canadian dollars in Canada; we keep nothing.
When you open one of our pages
If you open a page of ours from a button in a message we sent you, the link tells the page it was you. Then we keep, on your record:
For anyone else who opens one of our pages, we keep the same about the visit, but not who you are. To count each visitor once a day without storing anything on your phone, we make a scrambled code from your IP address, your browser and the page. The key it is made with changes every day and is deleted the day after, so the code cannot be turned back into your address. We never keep the IP address itself.
Cookies on our pages. Our pages can use one cookie to remember you between visits: a random code, nothing else, kept by your browser for 13 months. If a message from us brought you to a page, we link that code to your record, so your later visits are known to be you. While a page is trying out two versions of something, the same code means you keep seeing the same version each time you come back. Each Kerchiff account's pages have their own cookie, so no one else's pages can see it.
If you are in the European Union, the UK, Switzerland or Canada, or we cannot tell where you are, we ask first, with Accept and Reject, and nothing is remembered unless you accept. Everywhere else we tell you, and you can say No thanks. Either way, a second cookie remembers what you chose for a year, and you can change it any time from "Cookie choices" at the bottom of the page. To decide which to show, we look up the country your IP address is in, using a list kept on our own server (IP geolocation by DB-IP, db-ip.com), and do not keep it.
When you fill in a form on one of our pages
A form asks for some of: your email address, your name, your phone number, and answers to questions we choose (like your goal). We keep what you type on your record, as something you told us, so you can see it, correct it or have it deleted like any other detail, and the fact that you sent the form, from which page, and when. If our page already knew who you were (from a message we sent you, or its cookie), it goes on that record, unless that record already has a different email, since a link can be passed on to somebody else; otherwise we start a new one. If someone else in our records already has the email you typed, we keep both and note that you might be the same person, but we never join your records on an email alone, since anyone can type anyone's email.
If the form has a box to tick to hear from us and you tick it, we record that you agreed, the words you agreed to, and when. If there is no such box, sending the form counts as asking us for something, which lets us contact you about it for six months. If you told us to stop before, a form never undoes that.
If the form asks you to agree to terms, we keep that you agreed, the wording and the link you saw, and when, so it can be shown later.
When you buy on one of our pages
Our checkout's card form comes straight from Stripe: you type your card into Stripe, and we never see or store it. Stripe keeps your card on file with us as its customer, so that if you accept a one-click offer right after paying, you are not asked to type it again; nothing is charged unless you press to accept. So that you get what you bought, we may send your name, your email, what you bought, the amount and currency, the order's reference and when you bought it to the tool we use to give you access to it, like our course platform. To make sure only you can accept it, starting to pay leaves a cookie in your browser for two hours, holding a random key for that order and nothing else. We keep an order on your record: what you bought, the amount and currency, and when, with your email and name, Stripe's reference for you as a customer, anything refunded, and, if you reached the checkout through a link in one of our messages, which link it was, so we can see which of our posts led to the sale. If the checkout adds sales tax, you also type your billing address into Stripe's form, and Stripe uses it to work out the tax. Of that address we keep only the city and country, for the pop-up below; the rest stays with Stripe. Like any purchase, Stripe also tells us about the payment (see "When you buy something" below).
The "recent buyer" pop-up. Some of our pages show a small box in a corner saying that someone recently bought, like "Jane D. in Toronto, Canada bought the course, 2 hours ago". If you buy, you may appear in it: your first name and the first letter of your last name, the city and country from your billing details if Stripe has them, what you bought, and roughly when ("recently" once it is over a day old). Nothing else about you is shown, and only purchases from the last 30 days appear. Each one says "Verified by Kerchiff", and only for a payment Kerchiff recorded from the seller's own Stripe account, so you can trust it is a real sale; the link in it brings you to this notice. To keep this short version, we store your name shortened that way and your city and country on the order. If you would rather not appear, email [email protected] and we will leave you out of it for good; your purchase is not affected. Deleting your record removes you from it too.
Videos on our pages. A video on one of our pages comes from YouTube or Vimeo, but nothing is loaded from them until you press play: until then you see a picture we keep ourselves. When you press play, your browser connects to YouTube (through its "no cookie" address) or Vimeo (asking it not to track you), and they see your IP address, the name of the website the page is on (like "go.example.com", never the page's full address), and what else your browser sends, under their own privacy policies.
A video on one of our pages can instead be kept by us, and played from Cloudflare. If you open a page from a link we sent you, and it has a video kept by us, we keep on your record which video, how much of it you watched, and when. For anyone else, we count plays without keeping who you are, and nothing is saved on your device. It is removed when you erase your record.
For every visit we may also keep the name of the website that sent you to us (only its name, like "instagram.com", never the full address), and the campaign tags in the link, like "spring-sale". We use all of this to see which pages, and which parts of them, work.
When you open what you bought
If you buy a course or a download from us, you get an account in our library to open it, made with the email you bought with. For it we keep:
We use this to give you what you bought, to show you your progress, and to see which lessons and files help. We can see each buyer's progress, and we look at the totals to improve the course.
Signing in leaves a cookie in your browser for 30 days, holding a random key and nothing else. Signing out removes it. Choosing Google or Apple leaves a cookie for 15 minutes, holding a random key, so that only that browser can tell us which email you bought with. If we then ask you to confirm the email you bought with, we leave another cookie for one hour, holding a random key, so that the link we email you works only in that browser. A link we email you to make your account works for a week, and one to choose a new password for one hour.
Videos and files come from Cloudflare. We keep course videos and files with Cloudflare, in the United States and on its network around the world. When you play a video or download a file, your browser fetches it from Cloudflare, which sees your IP address and what your browser sends, as any website does. The address it is fetched from works for a few hours for a video and a few minutes for a file, and names you to nobody.
Offers in your library. Your library and lessons may show offers for other things we sell. We count how many times each is shown, in total. If you tap one, we count the tap and any purchase through it, as with the links in our messages.
Emails about what you bought. We email you after you buy, with the link to your library, and if a payment for a membership or payment plan does not go through. These go even if you unsubscribed from our other emails, because they are about something you bought.
When you review something you bought
Only people who bought can review, once for each product. We may ask you after you buy: by email if you agreed to get our emails, in your library, or in an Instagram message if you messaged us in the last day. Everyone is asked the same way, whatever we expect you to say.
For a review we keep your rating (1 to 5 stars), your words if you write any, which product it is about, and when. If you tick to show your name, your review shows your first name and the first letter of your last name, like "Sam R."; otherwise it says "A verified buyer". A review is public once it is published: on our pages and our reviews page, with "Verified buyer". We check each review before it shows, and one we have not answered in 7 days is published anyway. We only keep a review off our page if it is abusive or hateful, shares someone's private details, is not about the product, or is spam, never because it is negative, and we tell you why. Kerchiff's staff can see every review we kept off.
We may reply to your review publicly. You can update it any time: your earlier version and our reply stay visible under it, with the date you updated it, so people can see what changed. You can remove it any time, which takes it off our page with its history and our reply; we are told it was removed, not why. If your purchase is refunded, your review is removed everywhere and we email you.
Anyone can report a review. A report holds the reason chosen and anything typed in it, and nothing about who sent it. Kerchiff's staff may decide a reported review themselves, and record their decision, its reason and their name.
You sign in to your library to leave a review, so we know it is from you. A review link we send you works only for you.
When you buy something
Our payment processor, Stripe, tells us about each payment, and we keep:
We use your email address to add the purchase to your record, so we can see which post led to it. If two people in our records share that address, we do not guess which of you it was: we keep the purchase on its own and mark it to be checked.
The original message Stripe sends us also holds your name, the country on your billing details, and your card's brand and last four digits. We keep that message only for its 60 days (see below). We never see or store your full card number; Stripe handles that.
When you get our emails
You can get emails from us only if you gave us your email to hear from us: on a form on one of our pages, in answer to a question in a message, when you bought something from us (for two years after), or because you were already on our email list somewhere else and we brought that list across. Commenting on a post never adds you to our emails. Our emails and our Instagram messages each have their own "stop": stopping one does not stop the other.
For each address, we keep whether you may get our emails, why, and since when, or that you unsubscribed, that an email to it bounced, or that you marked one as spam. For each email we send you, we keep that we sent it, whether it arrived, whether you opened it, which links in it you tapped, and whether you bought something through one of those links. We use this to see which emails help and which posts brought you to us. Opens are counted by a tiny picture in the email: if your email app loads pictures, the picture tells us you opened it. We do not keep where you were or which device you used.
Every email has an unsubscribe link. Unsubscribing, a bounce, or a spam report stops our emails to that address for good, unless you sign up again yourself. We keep that stop for the same reason we keep any "stop" (see below).
Our emails are sent by Postmark, in the United States, which handles your email address and the email itself to deliver it.
When your records are joined
Sometimes we learn that two records are the same person, for example when your Instagram account and the account you paid with turn up together. Then we join them into one record, with everything on both. An email address on its own never joins two records, since anyone can type anyone's email: we keep both and note that they might be the same person. If we both had an answer from you to the same question, we use the newer one and keep the older one, so the join can be undone; it is deleted with the rest of your record.
When we add you ourselves
Sometimes we add people who did not come through Instagram or Facebook — for example, people who were already on our list before we used Kerchiff. Then your details come from us, not from you, and may include:
Labels, notes, and details
We may add labels to your record (like "bought the guide"), write short notes, and keep details you tell us or that we record (like a goal you mentioned). Each detail says who recorded it.
What we work out from the above
We keep a history of what happened and when, so we can see the path from someone finding a post to buying something. If we hold more than one email address for you, we keep each one and where it came from, and use them in this order: the one you bought with, then one we imported or added, then one you typed in a message to us. We also record which country we think you are in, because different countries have different rules about contacting people. If we are only guessing at your country, we mark it as a guess.
| What | How long |
|---|---|
| The original message from Instagram or Stripe | 60 days, then deleted automatically |
| Your record, your history, and the messages we sent you | For as long as you are a contact, or until you ask us to delete it |
| If you bought recently and asked us to delete your record: your name, email, orders and payments | Six months after your last payment, or until your subscription ends if later |
| Proof that you agreed to be contacted | At least 3 years after we last did business, because the law requires us to be able to show it |
| A record that you asked us to stop | Kept indefinitely — see below |
| A record that you unsubscribed from our emails, or that an email to you bounced or was marked as spam | Kept indefinitely — see below |
| Which of our emails you got, opened and tapped | For as long as you are a contact, or until you ask us to delete it |
| If we close this Kerchiff account: only your ID, and that you said stop | Until you ask us to delete it — see below |
| A backup copy, in case something goes wrong | Up to 30 days, then deleted automatically |
| A receipt that a message our system sent actually went out | 7 days, then deleted automatically |
| Our server's log of visits (IP address, browser) | 30 days, then deleted automatically |
| The daily key used to scramble page visitors | Deleted the day after |
| The cookie that remembers you on our pages, and its link to your record | 13 months after you were last seen, then deleted automatically |
| The cookie that remembers your choice | 12 months, then we ask again |
| Your library account, what you bought gives you, your progress and downloads | For as long as you are a contact, or until you ask us to delete it |
| Which of our page videos you watched, how much and when (only through a link we sent you) | For as long as you are a contact, or until you ask us to delete it |
| The cookie that keeps you signed in to our library | 30 days, or until you sign out |
| A link to make your library account, or to choose a new password | One week for the first, one hour for the second |
| Your review, its history and our reply | Until you remove it, the purchase is refunded, or you ask us to delete your record |
| That a review was removed | Kept, with no words and nobody on it, so the count of removed reviews stays honest |
Why we keep opt-outs forever. If you tell us to stop contacting you, we keep a permanent note of that. It sounds backwards, but it is the only way to honour it. If we deleted the record, and you contacted us again a year later, nothing would tell us you had said stop — and we would message you again. The note is what protects you.
The only thing that removes it is if you ask us to delete everything about you. That is your choice, not our policy. If we delete your record ourselves, we still keep your Instagram or Facebook ID and the fact that you said stop.
If we close this Kerchiff account. Everything we hold about our audience is deleted within 30 days of the account closing — except, for anyone who told us to stop, their Instagram or Facebook ID and the fact that they said stop. No name, no history, no messages. If the same Instagram account is ever connected to Kerchiff again, that is how we know not to message you. You can still ask us to delete even that, including during those 30 days.
You can ask for any of these at any time, free, by emailing [email protected]. We will respond within 30 days.
We will check it is really you first. We cannot tell who sent an email, and handing your history to someone pretending to be you — or deleting it because they asked — would be worse than being slow. So we will send you a short code and ask you to send it back to us in an Instagram direct message from the account in question. Only you can send from your account, which is what makes it proof.
We ask for a direct message rather than a public comment on purpose: a comment would tell your followers that you are making a privacy request. We check whether the code came from your account, and nothing else.
If you only know us through Facebook, or we only have your email, we will agree another way to confirm it is you before we act.
If we cannot confirm it is you, we will say so and take no action. You are welcome to try again.
See everything we have about you. We will send you a complete copy — your record, every event in your history, the identifiers we have linked to you, the labels, notes and details on your record, every message we sent or planned to send you, and the pages of ours you opened from them.
Get it in a portable format. The copy above is machine-readable, so you can take it elsewhere.
Correct something wrong. How we do this depends on what it is:
Delete everything. We remove your record, your history, and the identifiers linked to you from our live system straight away — including any original messages from Instagram or Facebook that mention you, and the note that you said stop if we kept one after closing an account. This is permanent and cannot be undone.
If you bought something recently, it happens in two steps. A refund, a dispute, or a subscription you are still paying for all need us to know who bought what, so:
If you have not bought anything in the last six months and have no subscription, everything goes straight away.
Some honest details about that:
Stop being contacted. You can opt out at any time, in any message we send, or by replying STOP. This takes effect everywhere, straight away. We do not need a reason. Once you have opted out, we message you again only if you start it yourself: by tapping Subscribe, sending START, or later sending or commenting one of our keywords, as described above. We cannot undo it on our own, and neither can anyone else.
Object to how we use your information. If you are in a place whose laws give you this right, you can object to us using your information to work out what to show or send you. If you object to it being used for marketing, we will stop.
We share only what is needed to run the service:
Meta (Instagram and Facebook) — for comments and messages, and your Instagram name and picture
Stripe — takes payments, and tells us about each one
The tool we use to give you what you bought, like our course platform — if you buy on one of our pages
Cloudflare — runs our main website, kerchiff.com, and keeps our course videos, the videos on our pages, and files; it sees your IP address if you visit kerchiff.com, play one of those videos, or download a file you bought
Google or Apple — only if you choose to sign in to our library with them; they tell us your email and an ID for you
Our hosting provider — where your information is stored and our servers run, in Canada
Apple (iCloud Mail) — handles our email, so anything you email us, including a privacy request, passes through it
YouTube or Vimeo — only if you press play on a video on one of our pages, and then directly from your browser
Postmark — sends our emails to you, in the United States, and tells us whether each one arrived or was opened, and if you unsubscribe
We do not sell your information. We do not share it for anyone else's advertising.
Your information is stored in Canada.
If you are in the European Economic Area or the United Kingdom, Canada is recognised as providing an adequate level of data protection, so your information can be transferred here without extra safeguards.
One exception: our email runs on Apple's iCloud Mail, so an email you send us may be processed outside Canada, including in the United States. Our emails to you, and the emails we send people who have a Kerchiff account about it, go through our email sending service, Postmark, in the United States. Course videos and files are kept with Cloudflare, in the United States and on its network around the world; your library account and progress are stored in Canada with the rest of your record.
We use plain calculations — not artificial intelligence — to work out which of our posts led to sales, and to sort contacts into simple groups. These decisions affect what we show or send you. They do not have legal effects and are not used to deny you anything.
If your information is ever exposed in a way that puts you at real risk, we will tell you and the relevant authority, as quickly as we can. We keep a record of every incident, whether or not it reaches that threshold.
Everything above is about people in our audience. This part is for people who sign in to Kerchiff: the owner of an account and anyone invited to help run it.
What we keep, and why
| What | Why | How long |
|---|---|---|
| Your email address | So you can sign in, and so we can reach you | While you have an account |
| Your password, scrambled so nobody can read it back | So only you can sign in | While you have an account |
| That you are signed in, on a device | So you stay signed in | Ends after 30 days; deleted a day after it ends |
| Failed attempts to sign in as your email, and the network (IP address) they came from, both scrambled | To stop people guessing your password, and to stop a stranger locking you out | 1 day, then deleted automatically |
| An invitation sent to your email | So you can join an account | Deleted 30 days after it is used or expires |
| A link to choose a new password, if you ask for one | So you can sign in again if you forget your password | Works once, for 24 hours; deleted 30 days after it is used or expires |
| Which accounts you belong to, and your role in each | So we know what you are allowed to do | While you belong to them |
| Which version of our terms you agreed to, and when | To show what you agreed to | While you have an account |
| Messages we sent you in Kerchiff (a connection that stopped, a test that settled, your weekly summary), whether you read them, and which you get by email or in the app | So you hear about what needs you, the way you chose | While you have an account |
| If you pay for a plan: your plan, when it renews, whether a payment is due, how much of your plan you used each month, and Stripe's reference for you as its customer | So we charge the right amount and keep your plan running | While you have an account |
| The keys from Meta and Stripe, encrypted | So Kerchiff can act for your Instagram account and your Stripe account | Until you disconnect, then deleted |
| Your Page's, Instagram account's and Stripe account's IDs and names | To show what is connected, and to route what arrives | While you have an account |
| Our server's log of visits (IP address, browser) | To keep Kerchiff secure and working | 30 days, then deleted automatically |
We never store your password as you typed it. We do not use any of this for advertising, and only our hosting provider stores it, in Canada.
Connecting your accounts
When you connect Instagram, you sign in with Facebook and choose your Facebook Page and Instagram account. Meta then gives Kerchiff a key that lets it act for that account. With it, Kerchiff:
Kerchiff never posts for you. When you connect Stripe, you choose your Stripe account and allow Kerchiff in. Stripe then gives Kerchiff a key to that account. We keep your Stripe account's ID and name, whether it is a live or a test account, and the key. With it, Kerchiff:
We keep both keys encrypted and use them only to run your account. We delete a key when you disconnect or connect again, and the Stripe key also when you remove Kerchiff in Stripe. If you remove Kerchiff in Facebook's settings, its key stops working at once, and we delete it when you disconnect. What Kerchiff already recorded, like your contacts, posts' totals and sales, stays in your account until you delete it or your account closes. We do not sell what Meta or Stripe gives us, and we do not use it for advertising.
Paying for Kerchiff. If you choose a paid plan, you type your card and billing address into Stripe's own form, on our page. Stripe keeps them, charges you and works out the tax from your address; we never see or store your card. When we show your card or your invoices, we ask Stripe for them at that moment and keep no copy. Stripe keeps its own payment records for as long as the law requires.
Emails we send you. When we email you about your account, like a link to choose a new password, a connection that stopped working, a test that settled or your weekly summary, the email goes out through our email sending service. It handles your email address and that email, in the United States. We do not track whether you open our emails or which links you tap. You choose which messages you get by email and in the app, under Settings, You; every email but a connection alert has an unsubscribe link. Connection alerts always come, because they protect your sales. To learn whether these messages help people use Kerchiff, a small share of accounts, picked at random, do not get test or weekly messages; connection alerts reach everyone.
To see or delete your account details, email [email protected]. An account owner can also remove you from their account at any time.
This service is not intended for children. We do not knowingly collect information about anyone under 13. If you believe we have, contact us and we will delete it.
If we change how we handle your information, we will update this page and change the date at the top. If the change is significant, we will tell you directly where we can.
If you are unhappy with how we have handled your information, please email [email protected] first — we would rather fix it.
You can also complain to a regulator: