Trust & legal

Last updated: 2026-07-24

Reeve keeps copies of your app's data — that only works if you can see exactly how we handle it. This page is the plain-language version: how things are encrypted, where they live, who else touches them, how long we keep them, and what we promise when something goes wrong.

How your data is protected

Every backup copy and every stored credential is encrypted with AES-256-GCM before it leaves our worker. Each customer has their own encryption key, which is itself encrypted under a master key that lives only in the server environment — never in the database, never in code. Backups of our own records are encrypted the same way, and a recovery copy of the master key is kept offline.

Everything travels over TLS. The backup key you give us can only read — we refuse keys that can write or delete, and we verify that on entry. Your users' passwords are stored hashed by your database and are unreadable to us or anyone else.

Where your data lives

Backup copies are stored in Cloudflare R2 with the EU jurisdiction setting, so they stay under EU rules regardless of where requests come from. The service itself runs on our own infrastructure — no third-party analytics, no ad tech, no trackers.

Sub-processors

These are the only outside companies that touch any of your data, and only for the purpose listed:

Cloudflare (R2) — encrypted backup storage (R2, EU jurisdiction)
Resend / Amazon SES — transactional email delivery (the emails Reeve sends you)
Paddle — payments, as merchant of record — your card data never touches Reeve at all
Google — optional sign-in only, if you choose “Continue with Google”

If we ever add a provider (for example an error-tracking service), it is listed here before it handles anything of yours.

How long we keep things

Backup copies: per your plan — 30 restore points on Care, 90 on Care Pro and Care Max; older copies are deleted automatically.
When you remove an app (or cancel): restore points and the encrypted key are kept 30 days so one click can bring everything back, then permanently deleted. Deleting your account erases everything immediately.
Our own records about your account (uptime history, activity log): kept up to 24 months, then deleted. You can download everything we hold about you, any time, from Settings.
Live chat: the chat runs on Reeve's own servers — no outside chat company is involved, which is why none is listed above. Deleting your account removes your name and email address from any chat record straight away.

Security disclosure

Found a security problem in Reeve itself? Please tell us at hello@reeve.page (see also /.well-known/security.txt). We answer fast and we don't shoot messengers.

If we ever confirm a breach affecting your data, we will tell you directly within 72 hours of confirming it — what happened, what was affected, and what we're doing. No burying it in a changelog.

Refunds

If Care materially failed you — a backup we said was verified wasn't there when you needed it, or the service was broken for a meaningful part of a billing period — write one email and we refund that period. No forms, no fighting.

The formal documents: Terms · Privacy · Data processing · Security