Privacy policy

In effect from October 3, 2026.

Kehai's apps send your location and everything else they record to the Kehai server you sign in to, and to nobody else. Someone you know runs that server. It might be you. I wrote Kehai, and none of your data comes to me.

What this policy covers

It covers the Kehai apps for Android, iPhone, Wear OS, Apple Watch, Garmin, Amazfit, Pebble, and computers, this website, and the push relay I run at server.kehai.org.

It does not cover the Kehai server you sign in to. Whoever runs that server holds your data and decides how long to keep it. If that is not you, ask them.

What the apps collect

The apps send these to your Kehai server:

• Your location. Kehai collects your precise location in the background, including when the app is closed or not in use. That is how your family sees where you are and hears when you get home, and how Kehai records your trips and notices a crash while you drive. Each location comes with its time, accuracy, speed, and your phone's battery level.
• Your account. Your username, your display name, and the contact details and picture you choose to add.
• Movement. Whether you are still, walking, or driving, and your step count. The app uses this to leave GPS off while you are still.
• Places, trips, and driving. The places you name, and your stays and trips. With the driving report on, also counts of speeding, hard braking, quick starts, and phone unlocks while driving.
• Activities. The runs, rides, and other activities you record, with their route, and heart rate from a watch or strap you connect.
• Health history, only if you turn it on. Heart rate, sleep, weight, body fat, blood pressure, blood oxygen, heart rate variability, respiratory rate, and body temperature, read from Health Connect on Android or Apple Health on iPhone.
• Safety events. SOS alerts, check-in timers, and detected crashes, with where and when they happened.
• Your device. Its model, system version, the app's version, and which permissions the app has, so your family can see why a phone stopped reporting.

The motion and pressure readings around a detected crash stay on your phone. They go to your server only if you choose to send them.

The apps contain no advertising and no analytics. They send nothing to me.

Who can see it

• The groups you join. You choose what each group sees of your location, history, activities, steps, and health. You can pause sharing or turn it off for a group at any time.
• The people you name for alerts. A crash or SOS alert shows them where you are, whatever your group settings.
• A parent, for a child's account that the parent manages.
• Whoever runs your server. The server stores your data, so its administrator can reach it.
• Anyone you send a share link to, for as long as the link lasts.

Kehai does not sell your data or give it to advertisers or data brokers. It stays on your server.

Health data

Kehai reads health data only after you grant each kind in Health Connect or Apple Health, and uses it to show you your health history and activity stats. A group sees only the summary you allow it. The data is kept on your Kehai server, is not used for advertising, and goes to nobody outside that server.

On Android, Kehai can save heart rate, resting heart rate, sleep, and weight from a watch you connect into Health Connect, if you allow it. On iPhone, the phone app writes nothing to Apple Health; Kehai on Apple Watch saves the workouts you record there, unless you turn that off.

You can turn health history off and delete what your server holds from the app's settings.

Other services involved

• Push notifications. Alerts reach your phone through Apple's or Google's push service, or a UnifiedPush app you choose on Android. Every alert is encrypted so that only your phone can read it. These services see that a message was sent, when, to which device, and how large it was.
• My push relay. Apple delivers to an app only through its publisher, so alerts for the iPhone app from the App Store pass through a relay I run at server.kehai.org. It forwards the encrypted message and cannot read it. It sees what the push services see, and which Kehai server sent the message. It logs how many messages it forwarded and nothing about them.
• Maps and addresses. Your phone loads its maps from your Kehai server, never from a map provider. Your server fetches map data from OpenStreetMap services and may ask one for the address at a location. That request comes from your server and carries no account or device.
• Watch makers' apps. Messages to a Garmin, Amazfit, or Pebble watch travel through that maker's phone app, under its own privacy policy.
• App stores. Apple and Google may send me anonymous crash and usage reports from the apps if you have agreed to share them in your phone's settings.

Keeping and deleting your data

Your server keeps your data for as long as its history settings say, and you choose how far back each group can see. In the app you can delete stays and trips from your timeline, and delete your health history. Signing out removes your account from that device.

To delete your whole account, ask whoever runs your server. Deleting an account removes its location history, activities, health history, and alerts from that server. I cannot do this for you, since I have no access to your server.

Children

A parent creates and manages a child's account on the family's own server, and controls what it shares. No data about children, or anyone else, comes to me.

Security

The apps talk to your server over an encrypted connection and warn you before sending a password over one that is not. Alerts are encrypted to your phone. How well the server itself is protected depends on whoever runs it.

This website

This site sets no cookies and has no analytics. The web server and Cloudflare, the network in front of it, log each request with the address it came from, the page, and the time.

Changes

When this policy changes, I post the new version here with its date.

Contact

Ask about this policy on the project's issue tracker. For data on a Kehai server, ask the person who runs it.