Privacy policy — kayems.

Training on your device

The app stores your training profile, goals, availability, plans, workouts, notes, activity timing, distance, pace and recorded GPS routes in a local database. These records support your plan, run recording and progress calculations. Core local training does not require a cloud account.

Location access is used to record your route and calculate running metrics. Background access supports recording when the app is not visible or your screen is locked, subject to operating-system limits. You can decline or change location permission in your device settings and use manual run entry. Declining background access limits recording to the explained foreground mode.

Ordinary recording does not send GPS route samples, private notes or your complete training plan to our social database. Files you export or share, and any device backup service you use, can create copies outside the app. Full training backups include sensitive routes and history; store them securely. App-created training backups exclude account sessions and Strava credentials.

Optional accounts and sharing

When you choose a cloud feature, the app establishes an account identifier with Supabase. An initial account can exist without an email address; linking and verifying an email lets you recover it. Authentication processes your account identifier, email when provided, sign-in/session information and technical connection information to authenticate you, deliver account messages and protect access.

Cloud features store the public username and display name you choose, account identifiers, friend requests and relationships, blocks, reports and ranking submissions. Your device’s permission to upload results is separate from your account’s public visibility. New profiles created by the current app start private; public sharing requires an opt-in.

Ranking submissions contain the activity identifier and date, distance, active duration, recording source and qualifying best-effort times. They do not contain GPS coordinates, private notes or the full training plan. Public names and qualifying results are visible to other participants when you join public rankings. Other people may copy information they can see, so avoid using private contact information in a public name.

Friend and block records contain the involved account identifiers and relationship state. We do not read your device’s address book. Choosing not to use accounts or public sharing does not prevent local training.

Connecting Strava

Connecting Strava authorizes activity uploads. We receive your Strava athlete identifier and authorization credentials, which server functions use to maintain the connection and upload activities you select or permit through auto-upload. Stored provider credentials are encrypted and kept outside client-readable database tables.

An upload sends the run’s GPS coordinates, elevation when recorded and timestamps through our integration to Strava. We keep upload identifiers, processing status and retry information to track delivery and avoid duplicates. The social database does not store a copy of the route. We do not import your Strava activity history.

Strava stores the uploaded activity under its own privacy policy and your Strava visibility settings. A route can reveal places you visit, including your home or workplace. Review those settings before uploading.

You can turn off auto-upload or disconnect in You → Strava. Wait for confirmation; if disconnecting fails, retry or contact us. You can also revoke kayems. access from your Strava account. Disconnecting or deleting kayems. does not remove activities already stored by Strava; manage those in Strava.

Reports and support messages

Community reports include the concern and the involved accounts. Report evidence can include the public names shown at reporting time and moderation decisions. The app’s owner uses this information to investigate abuse, act on reports and handle appeals. Reports and case evidence are not published as community content.

If you email kayems@halfwoods.com, we receive your email address, message and any attachments you choose to send. ImprovMX forwards this mail to the operator’s Gmail inbox. We use it to answer questions, troubleshoot problems, handle privacy requests and review community concerns.

Please keep passwords, sign-in codes, government identity documents, full training backups and private routes out of your first message. If more information is necessary, we will explain what is needed and how to provide it.

Service providers and other disclosures

Supabase: account authentication, cloud database and integration functions, including the infrastructure used for account email. See its privacy information and subprocessor list.
Strava: your optional connected account and uploaded activities. Strava is responsible for its own service and privacy settings.
ImprovMX and Google/Gmail: forwarding, delivery and storage of messages you send to support. See ImprovMX’s policy and Google’s policy.
GitHub Pages: hosting these website pages and processing website connection information. See GitHub’s privacy statement.

Requests to these services expose technical information such as IP address, request time, browser or client information and response/error information. Providers may retain operational and security logs. That is separate from optional public rankings and from the local training database.

We may disclose information when required by law, or when reasonably necessary to protect accounts, investigate abuse or establish, exercise or defend legal rights. We limit such disclosures to the relevant purpose.

We do not sell personal information or share it for cross-context behavioural advertising. The app has no advertising or analytics SDK, and these pages do not load analytics, advertising, remote fonts or tracking scripts. They contain no account form and set no application cookies. Following a link to another provider takes you to that provider’s service and policy.

Why and where information is processed

We use information to provide the features you request, authenticate accounts, deliver chosen uploads and sharing, answer support requests, moderate public content and keep the service secure. We do not use your private training history or routes for advertising.

Where a legal basis is required, necessary account and service processing supports performance of the service you request; optional location collection and public or Strava sharing rely on your consent where required. Security, abuse prevention and handling routine inquiries support our legitimate interests in operating a safe service, subject to your rights. Processing required by law relies on the applicable legal obligation. Where fitness information requires explicit consent under applicable law, that consent is required before the relevant cloud processing.

The operator is in Canada, and the configured Supabase project is hosted in the United States. Providers can also process information in other countries where they and their subprocessors operate. Those countries may have different privacy laws, and information may be accessible to their courts or authorities. Applicable transfer requirements and safeguards, including contractual safeguards where required, must be met for the service to be offered in your region. Contact us for information about the arrangements relevant to your data.

How long information is kept

Local training: stays on your device until you delete it, replace it through a restore or remove the app’s data. Copies you export and device backups are controlled separately by you and the service storing them.
Accounts and shared results: account, profile, relationship and ranking records are kept to provide the cloud account and its features until removed or the cloud account is successfully deleted. Deleting a run only from your device does not retract an earlier ranking submission.
Strava connection and upload records: credentials are retained to support your authorized connection, and upload identifiers/statuses support processing, retries and duplicate prevention. Successful disconnect removes the active connection; successful cloud-account deletion removes its owned records. Strava retains its own copy of uploaded activities under its policy.
Reports, appeals and support: retained as needed to investigate and resolve the matter, handle related appeals, prevent repeated abuse and meet applicable legal obligations. We consider whether a case remains open, whether evidence is still needed and whether a legal retention requirement applies. You can request deletion or ask about a specific case. In-app report records associated with a deleted account are removed through account deletion.
Technical logs and backups: retained by the relevant provider for operation, security, recovery and applicable legal requirements. Their retention is separate from live app records. Deleting a live record does not necessarily remove every backup or log copy immediately.

We retain information only for the purposes described here and applicable legal requirements. When it is no longer needed, we delete it or remove identifying information. We do not promise one universal deletion deadline for independent providers or user-created copies. Contact us for the retention information relevant to a particular request.

Your controls and deletion

Export training: use You → Local data → Export full backup. A run summary also offers route export.
Stop new ranking uploads: turn off device sharing. This does not hide information already public.
Leave rankings: use You → Community → Public profile → Leave public rankings and wait for confirmation. This hides your public profile/results and stops new submissions from this device.
Delete local history: use You → Local data → Delete all local training data. This does not delete the cloud account, previously submitted ranking totals or Strava activities.
Delete your cloud account: use You → Account → Account actions → Delete cloud account. Successful deletion removes the cloud identity and its owned profile, friend, block, report, ranking and integration records. Local training remains unless separately deleted.

If an online action fails or deletion cannot be confirmed, retry or email us. Signing out, clearing device sign-in or uninstalling the app is not confirmation that a cloud account was deleted. We may need to verify ownership before providing account information or acting on a request. Do not send passwords or verification codes to support.

Withdrawing permission or consent stops the affected future processing; it does not make earlier lawful processing unlawful or automatically erase information already shared. You can continue using local training when an optional cloud feature is disabled.

Teen users

kayems. is intended for people aged 13 and above. A store age rating is not proof of age or permission to process a teenager’s information. Eligibility to use cloud features also depends on local law and the consent required for the feature.

Where guardian authorization or verifiable parental consent is required, it must be obtained before the relevant cloud processing. A checkbox or simply reading this policy does not provide that verification. Do not use a cloud feature that requires guardian consent until that process has been completed. Local training does not require an account.

We do not currently request a date of birth or guardian identity documents through these website pages. If you believe a child has provided personal information without the required permission, contact us so we can investigate and delete information where required. Any added age or guardian-verification process will explain the information it uses before collecting it.

Privacy rights

Depending on where you live and which laws apply, you may have rights to access or obtain a copy of personal information, correct it, request deletion, restrict or object to processing, receive portable data and withdraw consent. These rights can be subject to identity verification and legal exceptions. We will explain any limitation that applies to your request.

Send requests to the contact below. Include the email associated with your cloud account, if any, and what you would like us to do. We cannot retrieve local-only training history remotely. You can also raise a concern with your local privacy regulator, including the Office of the Privacy Commissioner of Canada, an applicable provincial authority, or the data protection authority where you live.

Training recommendations and ranking calculations are automated product features. They are not used to make legal or similarly significant decisions about you.

Security

The app uses encrypted network connections, operating-system credential storage and database access controls. Provider credentials are kept out of training backup files. We limit access to cloud information to providing and protecting the service. No security measure can eliminate every risk; protect your device, email account and exported backups.

Contact and policy changes

For privacy questions, access, correction, deletion or a complaint, contact 17988117 CANADA CORP., the operator of kayems., at kayems@halfwoods.com.

We will update the date on this page when this policy changes and provide additional notice or obtain consent when required. A material new use of information will be explained before it begins.