Privacy policy

Who we are

HeyKemosabe is run by There's Always Money in the Banana Stand, LLC, a Georgia limited liability company in the United States (“we”, “us”). This policy covers the HeyKemosabe iPhone app, its Apple Watch app and the website heykemosabe.com. Questions go to admin@heykemosabe.com.

What we collect

• Account data. Your email address and a scrambled form of your password (never the password itself), or the identifier Sign in with Apple gives us. Your username and profile picture, if you set them.
• Your location. While a workout you started is recording, the phone sends your precise GPS position to our server throughout the workout, with speed, heading and altitude. We do not collect your location when no workout is recording.
• Workout data. Distance, pace, time, steps and motion, heart rate when a Bluetooth heart rate sensor is connected, and the phone’s battery level and signal.
• What you tell Kemosabe. Your three prompts (who you are as an athlete, your plan and goals, today’s workout), the messages you type or speak, and your voice recordings with their transcripts. These can include health information, such as an injury, how you feel or what you ate, if you choose to say it.
• What Kemosabe says to you, and how each spoken line ended: heard to the end, skipped, or cut short.
• Routes and waypoints you upload or create, including the original route files.
• Crew messages. When someone sends you a message from your live page, we keep the name they typed, their message, and their voice recording if they sent one.
• Device data. The app version, the kind of device and its operating system, and a token for sending push notifications. Our servers keep logs of requests, including IP addresses, to run and protect the service.
• The waiting list. If you join it, your email address and the page you joined from.
• Website data. On the public pages of heykemosabe.com, the sign-up and sign-in pages and crew pages, we use Google Analytics and PostHog. PostHog session replay records what you do on the page, including what you type into forms, except passwords. A cookie remembers which version of the homepage you saw. These tools never receive a share link, a username or a workout id.

How we use it

To run the workout and let Kemosabe speak during it: he reads your plan, your messages and your live numbers, including where you are on your route, to decide whether there is anything worth saying. To look up the weather where you are. To show your live page to the people you choose to share it with. To keep your history so you can look back at it. To send the code that resets your password. To measure what the service costs and keep each account within its limits. To find and fix problems and to make Kemosabe better, which means we read workouts, messages and what Kemosabe said.

We do not sell your data, we do not share it for advertising, and we do not show ads.

Kemosabe is an AI, and AI companies process your data

Kemosabe is not a person. What he says is written by AI language models run by other companies. To write it, we send them your prompts, your messages, the transcripts of your voice recordings, your recent workout numbers and your current position and route. Your voice recordings are sent to an AI model that turns speech into text, and Kemosabe’s lines are sent to one that turns text into speech.

We reach these models through OpenRouter, a service that passes each request to the company running the model. Our OpenRouter account is set to use only providers that do not train their models on the data we send. That setting is about training; it does not mean a provider keeps nothing, and each provider may hold requests for a time under its own terms, for example to prevent abuse.

When you ask Kemosabe a question during a workout, he may search the web or read a web page to answer. The search words he chooses go to a search provider through OpenRouter.

Who else receives it

A workout is private unless you publish it live. Each time you turn on live publishing from the Start or Controls screen, the app asks you first. Once it is on, anyone with your crew page link can see your real-time GPS location on a map, your live numbers, the whole conversation with Kemosabe, including your own messages and voice notes, and can send you messages. The page stays public, during and after the workout, until you turn it off. If you choose a username, your crew page has a readable address that other people can guess. The map on that page is drawn by Google Maps in the viewer’s browser.

After every workout we email a summary of it to you and to up to two people you add in Settings, usually a coach. You choose for each person what it holds: your stats, Kemosabe’s summary, your voice notes and the whole conversation, your exact words or a rewrite by Kemosabe, whether they can play your recordings, and whether the email links to a private replay of the whole workout (your route on a map, your numbers and the whole conversation, with its recordings), which opens even when the workout is not published. Anyone holding one of these emails can read it and open what it links to, so forwarding it shares it. A replay link stops working when you remove that person or turn their playback link off. Each person can unsubscribe with one click, and you can turn the emails off at any time. The summary and the rewrite are written by an AI model, as described above.

Beyond that, your data goes only to the companies that run the service for us, for that purpose: Heroku, owned by Salesforce, which hosts our server and our database (Heroku Postgres) in the United States; Amazon Web Services, which stores audio, route files and pictures (Amazon S3) and sends our email (Amazon SES); OpenRouter and the AI companies behind it, described above; Open-Meteo, which receives your position to return the weather; Apple, for Sign in with Apple, push notifications and the maps in the app; and Google Analytics and PostHog for the website, described above.

Two services receive your data only when you ask: Strava, if you connect your Strava account, gets the workouts you upload to it; Apple Health gets a workout when you tap Save to Apple Health. Once there, their own terms and privacy policies apply.

We may disclose data when the law requires it, to protect someone’s safety, or to a buyer of the business, who would be bound by this policy.

How long we keep it

We keep your workouts, messages, recordings and routes for as long as your account exists, unless you delete them sooner. When you delete your account from the app’s Settings, we delete your account, your workouts, your messages, your voice recordings, your routes and waypoints, your prompts and your crew page, remove your files from storage and revoke Sign in with Apple. Our database host keeps continuous backups for disaster recovery; copies of deleted data in them expire on the host’s own schedule, and we never restore them to bring an account back. Records of what each AI request cost are deleted with the account.

Your choices

• Read and change what Kemosabe knows about you: the three prompts, in the app or on the web, with every earlier version kept until you delete your account.
• Leave out what you do not want stored: Kemosabe needs no health details, and you decide what to say.
• Keep a workout private: live publishing is off unless you turn it on, and you can turn it off at any time.
• Delete your account and everything in it from the app’s Settings.
• Ask us for a copy of your data, a correction or a deletion, at admin@heykemosabe.com. We answer within 30 days. Depending on where you live, the law may give you more rights; we honor them.

Security

Data travels encrypted between the app, the website and our server. Access to production data is limited to the people who run HeyKemosabe. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

Age

HeyKemosabe is only for people 18 and older. We do not knowingly collect data from anyone younger. If you believe someone under 18 has given us data, write to us and we will delete it.

Changes

When this policy changes in a way that matters, we will say so in the app or by email and update the date at the top.

Contact

There's Always Money in the Banana Stand, LLC, Georgia, USA. Write to admin@heykemosabe.com.