Kepvela

You can check every claim on your own device.

The first half of this page is tests you can run in a few minutes. The second half is the record of the checks we ran, with the version and the date of each.

Check the permissions on an Android phone.

  1. Open Settings, then Apps, then the K app.
  2. Open Permissions.
  3. Open the menu at the top right and choose All permissions.

An app that can use the internet lists "have full network access" under Other app capabilities. K Photos, K Docs, K Scan and K Audio do not list it. The permissions page shows what each app does list.

Check that the AI needs no connection.

  1. Turn on airplane mode.
  2. Open a K app and run any AI tool, such as Erase in K Photos or a transcript in K Audio.

The tool works the same as before, because it runs on the device.

Check a Windows app with Resource Monitor.

  1. Open Resource Monitor from the Start menu and choose the Network tab.
  2. Open a K app and use it.

The app does not appear in the list of processes with network activity. You can also add an outbound rule for the app in Windows Firewall.

Check this website.

Open this page's source in your browser and search it for the word script. There is none. Then open your browser's developer tools, choose the Network tab and reload the page. Every request goes to kepvela.com.

This is what we checked, and when.

Each row names the claim, how it was checked, the versions it covers and the date. A check covers the builds it names, and we repeat it on every release.

Claim How it was checked Versions Date
The four Android apps hold no internet permission. We read the permission list of each package with the tool Android's build system uses. K Photos 0.26.0 (66), K Docs 0.6.0 (19), K Scan 0.6.0 (13), K Audio 0.7.3 (17), the Google Play builds November 12, 2026
They hold no network state permission and no advertising ID permission. The same read. The same four November 12, 2026
Google's usage-logging library cannot send anything. We read each package's manifest. All three of that library's sending services are absent from it. The same four November 12, 2026
The packages carry no tracking, analytics, crash-reporting or advertising code. The release check scans each package against Exodus Privacy's public list and our own longer list. The Google Play builds and the Windows packages November 10, 2026
The Windows packages declare no internet capability. We read each package's manifest. Each declares full trust, with the webcam for K Scan and the microphone for K Audio. K Photos 0.26.0.4, K Docs 0.6.0.4, K Scan 0.6.0.4, K Audio 0.7.3.4 November 12, 2026
The Windows packages contain no other route to the network from Java. We scanned every class in each package for the ways a Java program can connect without a plain socket. The scan found none. The same four November 12, 2026
The Mac packages cannot connect. We read the entitlements of each signed package. The App Sandbox is on and there is no network entitlement. K Photos 0.26.0, K Docs 0.6.0, K Scan 0.6.0, K Audio 0.7.3, Mac packages November 12, 2026
K Scan keeps its data out of Android's backup. We read the backup rules inside the package. K Scan 0.6.0 (13) November 12, 2026

This is what has not been done.

  • No outside firm has audited the apps.
  • The source code is not public.
  • We have not published a way to rebuild the apps and compare the result with the store's copy.
  • These checks read the packages. We have not published a recording of a device's network traffic.

Check that an app came from us.

Google Play signs every app it delivers and checks the signature on each install and update. The four apps on Google Play carry this signing certificate:

97:9C:DC:B8:12:05:60:D1:83:C9:D0:08:60:BF:B5:84:BE:D5:45:1D:69:A9:5F:3F:48:78:C0:F4:21:DE:FE:88

This is the SHA-256 fingerprint of the certificate on K Photos, K Docs, K Scan and K Audio. We read it on November 12, 2026 from the copies that the Play Store installed on a test phone.

To compare it yourself, copy the app's package from your phone to a computer and open it with apksigner, the signature tool that comes with Android's developer tools. Ask it to verify the package and print its certificates.

Check a file from this site.

The press kit is the only place this site offers files to download. Its page lists the SHA-256 of each file. To compute the same number for a file you downloaded:

  • on Windows, run Get-FileHash with the file's name in PowerShell;
  • on a Mac, run shasum -a 256 with the file's name in Terminal;
  • on Linux, run sha256sum with the file's name.

The two numbers match when the file is the one we published.