Kaayko ("we," "our," or "us") operates kaayko.com (the "Services"), which include:
Paddling Out: AI-powered paddle condition forecasts and water location discovery
Kaayko Store: Invite-only store for apparel and merchandise
Forge: An open-source, local-first AI workstation. Forge runs on your own machine and sends us nothing; kaayko.com only hosts its gallery pages
Kortex: Smart links and link analytics
Alumni pages formerly hosted under /karma now live at kaay.school, which is operated separately.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information. By using our Services, you consent to the data practices described here.
Key Point: We keep only what an order genuinely needs, we say exactly how long we keep it, and we do not sell or share it.
Information We Collect
Information You Provide
Purchase Information: Email address, phone number (optional), and shipping address through Stripe's secure payment processing.
Order Data: When you buy from the store we record your name, shipping address, email address, phone number (if given), the items ordered, the amounts paid, and any sales tax collected. This is what it takes to ship your order, handle a return, and keep the records the law requires. There is no account and no saved profile; nothing is kept "for next time".
Payment Data: Card details go directly to Stripe inside Stripe's own secure form and never reach Kaayko's servers. We store Stripe's reference IDs for the payment, not your card.
Location Queries: When using Paddling Out, you may provide location coordinates or lake names.
Paddle Ratings: Anonymous condition ratings submitted through Rate Your Paddle and the Paddle Trainer. We store a device fingerprint to prevent duplicate submissions (one rating per device per spot per day), not to identify you. If you allow location access when rating, GPS proximity to the spot is recorded as a quality signal.
Communications: If you contact us, we may retain your email address and message content.
Cookies: We set no first-party tracking cookies. Third-party cookies are set only by Stripe on Store and checkout pages (fraud prevention) and by PostHog on the Kortex app (product analytics). Your Paddling Out preferences live in your browser's local storage, not cookies.
IP Addresses: Collected for fraud prevention and rate limiting. Not linked to personal identity.
Kortex links and QR scans
Kortex makes QR codes and short links for people who never sign in. What we keep, exactly:
When someone scans or taps a link: the time, device type, operating system, browser, country, the referring page if any, campaign tags, and the address we forwarded to. The visitor's IP address is turned into a keyed hash before anything is written; the raw address is discarded once the country has been looked up on our own servers. No cookie is set on a redirect.
Search and social crawlers fetching a link are not counted as scans.
Free workspaces are identified only by an access code. We store a salted hash of the code, never the code. If you attach an email address for recovery, we keep the address for delivery and a hash for lookup. Static QR codes are drawn in your browser and store nothing with us.
Reports, appeals and support requests keep the message you write and the email you choose to give, plus a keyed hash of your IP for rate limiting.
Audit log: every change to a link and every reviewer action is recorded with a keyed IP hash, never a raw address.
The sample workspace on the Kortex page contains simulated scans only.
Payment Information
We do not store credit card information. All payment processing is handled by Stripe, Inc. Card details are transmitted directly to Stripe under their privacy policy.
How We Use Your Information
Order Fulfillment: Processing purchases, shipping, and order tracking.
Service Improvement: Analyzing usage to enhance user experience and ML model accuracy.
Paddle Score Calibration: Anonymous ratings are used to improve forecast accuracy per location.
Customer Support: Responding to inquiries.
Legal Compliance: Complying with applicable laws and regulations.
Fraud Prevention: Detecting and preventing fraudulent transactions.
Data Retention
Order Data
Order Records: Stored in Firebase Firestore. Your contact details and shipping address are automatically removed from the record two years after the order; the transaction itself (items, amounts, tax, Stripe reference IDs, order status) is kept for as long as tax and accounting law requires us to keep it, and then deleted. This runs on a monthly schedule — it is not a promise, it is a job.
Order Emails: Copies of confirmation and shipping emails are deleted within 90 days of sending.
Deletion Requests: Email us and we will remove your contact details from any order record immediately, subject to the transaction record we are required to keep.
Paddle and Weather Data
Location Queries: Processed in real-time and cached temporarily (up to 3.5 hours). Not linked to personal identifiers.
User Ratings: Stored indefinitely as anonymous training data. No account or personal info is attached.
Analytics
Product Analytics (PostHog): Aggregate, pseudonymous usage on the Kortex link-management app only — page views and in-app navigation. It is not loaded on the public Paddling Out pages or the Store. Retained under PostHog's data policy.
Server Logs: API request logs retained for 30 days.
Shopping Bag: The store keeps the contents of your bag in your browser's local storage (key kaayko_cart) so it survives a page reload. It never leaves your device until you check out.
Kortex scan data
Dashboards and exports show at most 30 days of scan detail (7 on the free tier); lifetime totals stay on the link.
Scan records are marked to expire 30 days after they are written. Scheduled deletion of expired records is not yet enabled, so older records currently remain in our database until it is; they are not used for anything else. Ask us and we will delete a workspace's records.
A free workspace that is not opened with its code for 365 days has its links switched off, not deleted; opening it with the code restores them.
Third-Party Services
We do not sell your personal information. We share data with third parties only as needed to operate:
Stripe: Payment processing. Stripe.js loads on Store and checkout pages and sets its own cookies (__stripe_mid, __stripe_sid) for fraud prevention
Google Cloud Platform (Firebase): Hosting, database, and authentication
Google Cloud (us-central1): Hosting, functions and the database for Kortex run in Google Cloud's us-central1 region. Email for every product is delivered by Zoho Mail over SMTP from one Kaayko mailbox; a copy of each message is held in our database for 90 days so delivery can be checked and retried.
PostHog: Product analytics on the Kortex link-management app (aggregate usage only). It sets its own cookies / local storage on Kortex and is not used on the public Paddling Out pages or the Store
WeatherAPI.com: Real-time weather data for Paddling Out. Your location query (coordinates or place name) is sent to fetch conditions; no personal identifiers accompany it
Google Fonts: Typefaces are loaded from fonts.googleapis.com / fonts.gstatic.com, which means your browser makes a request to Google when pages load
GitHub: The Forge Gallery page lists images directly from the public Forge repository via api.github.com and raw.githubusercontent.com
OpenStreetMap: Map tiles on Paddling Out load from tile.openstreetmap.org, so your browser requests them directly. Place-name search and reverse geocoding are proxied through our own server to Nominatim (also OpenStreetMap), so your query reaches them without your IP address
U.S. Geological Survey: Lake and reservoir geometry for searches inside the United States comes from the USGS National Hydrography Dataset (hydro.nationalmap.gov), queried by our server, not your browser
We may also disclose information if required by law, court order, or to protect our rights and safety.
Your Rights
You have the right to:
Access: Request a copy of the personal data we hold.
Correction: Request correction of inaccurate data.
Deletion: Request deletion of your data.
Marketing: We do not currently send marketing email. If we ever do, every message will carry an unsubscribe link.
Data Portability: Request your data in a machine-readable format.
To exercise any of these rights, contact help@kaayko.com.
Cookies & Local Storage
The public Kaayko site (Paddling Out, home, About) sets no first-party cookies. What we keep is a small set of your own preferences in your browser's local storage — it stays on your device and is never sent to our servers:
Preferences: your unit choice (°F/mph vs °C/km/h), your card-style choice, your boat type, your saved favorite lakes, and your locked “my area” for search. One nuance: your boat type is included in forecast requests (so scores can adjust to your craft) but it is not stored on our servers and is not linked to you.
“You’ve seen this” flags: small markers so one-time notices and guided tours don’t reappear (e.g. this storage notice, the search and rating tours), and, if you were given store access, a flag that remembers it.
Ratings you submit: a local copy of paddle ratings you make, so they can sync and so you rate a spot once per day.
Firebase Auth (Kortex / creator apps only): sign-in state is held by Firebase Auth in IndexedDB, not traditional cookies.
Third-party cookies appear only on specific pages: Stripe (__stripe_mid, __stripe_sid) on Store and checkout pages, and PostHog product-analytics storage on the Kortex app. These are described under Third-Party Services above.
You can clear browser storage at any time through your browser settings — doing so simply resets your preferences.
No method of transmission over the internet is 100% secure. We cannot guarantee absolute security.
Children's Privacy
Our Services are not intended for individuals under 13. We do not knowingly collect personal information from children. If we become aware we have, we will delete it promptly.
California (CCPA) & EU (GDPR)
California residents and EU individuals have additional rights under CCPA and GDPR respectively, including the right to know, delete, and opt out. We do not sell personal information.
To exercise these rights, email help@kaayko.com with "Privacy Request" in the subject line.
Changes to This Policy
We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page. Continued use of the Services constitutes acceptance of the updated policy.