Privacy

What we collect, and what we do with it

Keystone holds information about your business so it can check your plan against your results. This page says what that information is, where it is kept, who else handles it, and how to have it removed.

Last updated 4 November 2026.

Without an account

The planning workspace keeps everything in your own browser (its local storage). Nothing you type there reaches us. You can save it as a file, and clearing your browser's data removes it.

If you send the contact form, or choose to leave your email when you build a plan, we receive what you entered: your name, email, business name and the short summary shown before you send it. These messages are delivered by Web3Forms, a form service, to our inbox. We use them only to reply to you.

With an account

When you create an account, your plan is stored in a hosted database run by Supabase, so you can use it from any device and share it with people you invite. That includes your email address, your answers, your objectives, the figures you record or import, and the actions and notes your team adds. Each business can see only its own records; this is enforced in the database itself, not just in the page.

You sign in with your email and a password, confirmed the first time by a code we email you, or with LinkedIn. Passwords are stored by Supabase only as a one-way hash; nobody at Keystone can read them. If you use LinkedIn, LinkedIn tells us your name, email address and profile picture. We never see your LinkedIn password and do not post anything to LinkedIn.

If you connect QuickBooks Online, we import your profit and loss, month-end balances and invoices. The connection keys are stored where no browser can read them, and you can disconnect at any time.

If you ask Keystone to explain a figure or suggest a fix, the figures on that screen are sent to Anthropic, which provides the AI model. They are used to write that answer and are not used to train models.

What we do not do

• We do not sell your information or share it for advertising.
• We do not use advertising or tracking cookies, or analytics. What the site stores in your browser is listed on the cookies page.
• We do not publish anything about your business. Comparisons with other businesses will only ever use combined figures from businesses that agreed to take part, and only when a group is large enough that no single business can be picked out.

Experts, partners and payments

When you ask to talk to an expert, we keep your request: what you need, your ZIP code, how you want to talk and your contact details. We offer it to one professional at a time whose area and specialty fit. They see what you need and your area before deciding; your name, email and phone are shared only with the professional who accepts. A plan summary is shared only if you tick the box. Messages and files you send in a conversation are seen by you, that professional and Keystone, and are stored privately with Supabase. Notification emails are sent through Resend and never include the message itself.

If you order a paid service, Stripe takes the card payment. We never see or store your card number; we keep the amount, the date and Stripe's payment reference.

If you are a partner, we keep your listing (name, firm, contact details, specialties and the ZIP codes you cover) and the outcome of each introduction. Owners see your listing details once you accept their request.

Keeping and removing it

We keep account data while your account is open. You can remove the copy in your browser from the workspace at any time. To close your account and delete what it holds, ask us through the contact form and we remove it from the database within 30 days, apart from what the law requires us to keep. Contact form messages are kept in our inbox until we no longer need them to reply.

Questions

Use the contact form and we will reply. Keystone is based in Portland, Oregon.