Google Keep

Google Keep runs on Google's data centers, operated by Alphabet Inc., headquartered in Mountain View, California. As a US company, Google is subject to the CLOUD Act and can be compelled to produce data stored anywhere within its infrastructure, regardless of the physical server's location. There is no user option to pin storage to a specific jurisdiction for consumer Keep.

Keep encrypts data in transit and at rest on Google's servers, but Google holds the encryption keys. Unlike Gmail, Drive, Docs, Calendar, and Meet, Keep is not on Google Workspace's client-side encryption supported-apps list, so there is no end-to-end encryption option on any plan, consumer or enterprise. Google can access and read note content at any time, including for content moderation or legal requests.

Google's Keep help documentation states that Keep does not use note content for advertising, and that it is one of a short list of apps alongside Gmail, Drive, and Photos that Google excludes from content-based ad targeting. That carve-out does not insulate Keep from Google's overall ad business. The general privacy policy still allows account activity and interests across Google services to be used to personalize ads unless a user disables this through My Ad Center. Alphabet's advertising model relies on this kind of cross-service behavioral profiling. It is the same pattern found in Gmail's evaluation: content is protected, but account activity is still used for ad targeting. So it meets the bar for "shared for advertising/profiling" rather than "never shares."

Gemini is integrated directly into Keep with an "AI" button on each note for drafting, summarizing, and natural-language search. For non-Workspace accounts, a subset of Gemini chats is reviewed by human raters by default to improve the models unless the user switches off the Keep/Gemini Apps Activity toggle. However, Google retains conversations for up to 72 hours, and items already queued for human review are not pulled back. Google Workspace accounts have a stronger default: no training or human review without explicit permission.

Google Keep is entirely closed source. No component of the client or backend is published under an open license, and Google's Terms of Service prohibit reverse-engineering its services and copying, modifying, or distributing any part of its software.

Google Cloud infrastructure, which underlies Google Workspace and consumer Google products including Keep, holds ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, and SOC 2/SOC 3 certifications. These are independently audited and re-verified regularly by third-party auditors. Keep also falls under Google's Vulnerability Reward Program, an active, continuously funded bug bounty that broadly covers Google and Alphabet web properties. Together, this provides ongoing, current third-party security scrutiny, even without a standalone penetration-test report specific to Keep.

As closed-source software with no public contributor base, Keep has no documented governance model, contribution process, or code of conduct.

Keep has no purchase price, subscription, or paywall. It is part of Alphabet's advertising business, which depends on the account-wide behavioral profiling documented under 1.3. This is a "free" product whose users pay with data rather than money, the scoring rule's explicit definition for the 0-point option.

Every core Keep feature — notes, lists, reminders, labels, collaboration, Gemini drafting — is free, with no feature gate. The constraint is the pooled 15GB free storage shared across Gmail, Drive, Photos, and Keep. This pushes heavy users toward paid Google One plans, and the underlying data-monetization model scored in 3.1.

Google One's storage pricing is published with clear, fixed tiers and no hidden fees. The friction is structural rather than deceptive. Keep draws from the same 15GB pool shared across Gmail, Drive, and Photos, so the cap quietly pressures active users toward a paid upgrade even though note storage itself has no direct price. This falls short of full marks but is not a dark pattern in the pricing flow.

Keep itself has no price, but the Google One storage it depends on beyond the free tier is priced differently across at least 36 countries. It is notably cheaper in India and other emerging markets than in the US or UK. Google does not publish this as a formal purchasing-power-parity policy, and pricing has shifted over time without clear documentation of the methodology. This lands in the middle bracket rather than at N/A or full marks.

Google Takeout exports the full Keep library — note text, checklists, labels, collaborator lists, and attached images/audio — in JSON and HTML, fully open, machine-readable formats. The one limitation is that exported notes cannot be re-imported into Keep, but the export itself is complete and open.

There is no self-hosting option. Keep is a web-based service built on Google's Docs Editors suite, and it depends entirely on Google-operated cloud infrastructure for storage and sync; no downloadable server component has ever been offered.

The Android and iOS apps cache notes locally, allowing them to remain usable offline for viewing and editing. Changes sync automatically once connectivity returns. This is offline-with-sync behavior, not a fully local-first architecture.

Keep is available on the web, Android, and iOS, plus a Chrome browser extension and Wear OS companion. All of these are closed, proprietary platforms — there is no native Linux client, no F-Droid listing, and no BSD support — so they do not meet the "open platform" bar despite spanning multiple platforms.

Keep inherits system-level accessibility tooling from Android (TalkBack, Android Accessibility Suite) and iOS (VoiceOver), but Google does not publish a WCAG conformance statement or accessibility documentation specific to Keep itself.

Google Keep is developed and operated by Google LLC, a wholly owned subsidiary of Alphabet Inc., one of the largest companies in the world by market capitalization — squarely Big Tech.

No ownership change occurred in the review period; Google remains a wholly owned subsidiary of Alphabet Inc.

Google publishes AI principles and privacy commitments, but the record is mixed. The CNIL's €325 million fine in September 2025 specifically targeted consent-design practices during account creation on the same Google account system that Keep operates within. Public policy language exists, but regulatory findings contradict parts of it in practice.

Google publishes annual environmental reports, a mark of transparency, but the substance has deteriorated. Google's greenhouse gas emissions rose 18% year-over-year between 2024 and 2025, driven by AI data center expansion, while electricity demand has risen 250% since 2019. Google admitted its climate goals are "getting harder" to achieve and quietly removed its net-zero commitment from its public website. The 24/7 carbon-free energy goal for 2030 remains on the books, but it is trending in the wrong direction. This applies to the same infrastructure Keep runs on. Annual reporting exists, but the underlying trend contradicts the stated commitment.

Google Keep launched publicly on March 20, 2013, making it 13 years old as of this evaluation.

There is no public contributor community, forum, or roadmap for Keep since it is closed, proprietary software. But Google has kept shipping meaningful updates: real-time collaboration (2014), pinning (2016), Docs integration (2017), and Gemini-powered drafting and natural-language search (2025-2026). This is active vendor development even without community participation.