Privacy Policy

This Privacy Policy explains how Karvos LLC ("Karvos," "we," "us," or "our") collects, uses, shares, and protects personal information when you use Remmy, our AI accountability and fitness coach, and our websites, including textremmy.com (together, the "Service"). The Service is intended only for adults in the United States. Section 8 is our Consumer Health Data Privacy Policy, and Section 9 contains additional disclosures for California residents.

1. Information we collect

Information you give us

• Contact details: your phone number, or the Apple ID email address you text from, and your name.
• Your messages to Remmy and their content.
• Profile and fitness information you share: your age, birthday (month and day), height, weight, sex or gender, goals, obstacles, activity level, workout schedule, time zone, step goals, and calorie targets.
• Health and body information you share: weight changes, food and nutrition logs, workouts, and any health conditions, injuries, or medications you mention.
• Photos, screenshots, and videos you send, including the audio in videos, and links you send.
• Reminders you ask for, and emails you send to support.

Remmy does not currently process voice messages. If you send one, he will ask you to type instead.

Information created as you use the Service

• Records of your coaching: conversation history, notes Remmy keeps about what you have told him, check-ins, streaks, and logs.
• Information about the photos and videos you send: AI-generated descriptions of them, and digital fingerprints ("hashes") of photos, used to recognize a photo that has been sent before.
• Account details: subscription and trial status.

Information from others

• From Stripe: your subscription status and billing details, which may include your name and email address. We never receive your full card number.
• From our messaging provider: delivery information and technical details about messages.

Information collected automatically on our website

• Device and browser type, IP address, pages visited, and the referring page, collected through cookies and similar technologies set by our website host. See Section 10.

2. How we use information

• to provide the coaching Service, including personalized replies, calorie and macro estimates, targets, check-ins, reminders, recaps, and tips;
• to remember what you have told us, so that Remmy can hold you to it later;
• to analyze photos and videos you send, including checking whether a workout photo was copied from the internet;
• to process payments, manage trials and subscriptions, and send billing notices;
• to respond to you and provide support;
• to keep people safe, including recognizing crisis messages and enforcing our 18-and-over requirement;
• to secure the Service and prevent fraud and abuse, including limiting free trials to one per number;
• to debug, maintain, and improve the Service; and
• to comply with law and enforce our Terms.

We do not sell personal information, use it for targeted advertising, or use it to make decisions that produce legal or similarly significant effects about you.

3. How we share information

We share personal information only as described here.

Service providers that process it on our behalf, under contract, and only to run the Service:

Others we may share with:

• Apple and wireless carriers, which carry messages between you and Remmy.
• Our authorized team. Some operational alerts about accounts, such as billing or safety events, are sent to our team and include the member's phone number.
• Professional advisers, such as lawyers and accountants, under confidentiality obligations.
• Authorities, when required by law or legal process, or when needed to protect someone's safety or our rights.
• A successor organization in a merger, acquisition, financing, or sale of assets, under this Policy.
• Anyone you direct us to share with.

We do not sell or rent personal information, share it for cross-context behavioral advertising, or share it with third parties for their own marketing.

4. How AI is used

Remmy's replies and his analysis of your photos and videos are produced by AI models provided by OpenAI, which processes this information on our behalf. Under the terms that apply to our account, OpenAI does not use it to train its models. It may keep it for a limited period, generally up to 30 days, to monitor for abuse. AI output can be wrong. See our Terms of Service.

5. How long we keep information

• While you are active: we keep your information while you use the Service, because remembering what you told us is the point of the Service.
• After 12 months of inactivity: if you do not message Remmy for 12 months, we delete your account data or permanently de-identify it.
• When you ask us to delete it: text Remmy "delete my data" and reply DELETE when he asks you to confirm. He will cancel any subscription and permanently delete your profile, messages, notes, logs, and media records. You can also email [support email], and we will complete the deletion within 30 days.
• What we keep after deletion:
  • a one-way, irreversible fingerprint of your phone number, used only to limit free trials to one per number;
  • payment records that Stripe and we must keep for tax, accounting, and legal purposes;
  • information we need to keep for legal claims or obligations; and
  • data in routine backups, until it is overwritten in the normal backup cycle.
• Photos and videos: we do not keep our own copies of the files. We store a link to the file held by our messaging provider, an AI-generated description, and a fingerprint. Video files are deleted from our servers as soon as they are analyzed. Our messaging provider retains media under its own policies.
• Cancelling is not deleting: cancelling your subscription or texting STOP does not delete your data, so you can pick up where you left off. Ask us to delete it if you want it gone.

6. Your rights and choices

Wherever you live in the United States, you may ask to:

• access your information, or get a copy of it;
• correct it;
• delete it; or
• withdraw your consent to our processing of your health information, which ends the Service.

How to make a request. Text Remmy, or email [support email]. We verify requests by confirming control of the phone number on your account, and may ask for more information if needed. An authorized agent may make a request for you with your signed permission.

Timing. We respond within 45 days, which we may extend once by 45 days if we tell you why.

No discrimination. We will not treat you differently for exercising your rights.

Appeals. If we deny your request, you may appeal by replying to our decision with "Appeal." If we deny the appeal, you may contact your state attorney general.

Stopping messages. Reply STOP to stop messages at any time.

7. Security

We use reasonable administrative, technical, and physical safeguards, including encryption in transit, access controls, and reputable providers. Standard SMS messages are not end-to-end encrypted and pass through carriers and our messaging provider, so please do not send anything you are not comfortable sending by text. No system is perfectly secure. We will notify you of a security breach affecting your information as required by law.

8. Consumer Health Data Privacy Policy

This section applies to "consumer health data" as defined by Washington's My Health My Data Act, Nevada's SB 370, and similar laws. We apply it to all members.

What we collect:

• body measurements (height, weight, and changes in weight);
• age and sex;
• fitness activity, including workouts, steps, schedules, check-ins, and workout photos and videos;
• nutrition information, including food logs, meal photos, and calorie and macronutrient data and targets;
• any health conditions, injuries, or medications you mention; and
• conclusions Remmy draws from this information, such as your calorie target, activity level, and progress.

Where it comes from. Directly from you, and from analyzing what you send.

Why we collect and use it. Only to provide the coaching you request: to log what you send, calculate your targets, track your progress, send your check-ins and reminders, and remember what you have told us. We also use it for safety, support, and security.

Your consent. We collect and use consumer health data only as necessary to provide the Service you requested by texting Remmy. We will ask for your separate consent before collecting or sharing it for any other purpose.

Who we share it with. Only the service providers in Section 3 that process it for us: OpenAI, Linq, Supabase, Replit, and Google Cloud Vision (workout photos only). We do not sell consumer health data. We do not share it with third parties for their own purposes. We do not use it for advertising. We do not use geofencing.

Your rights. You may:

• confirm whether we collect, share, or sell your consumer health data;
• access it, including a list of every third party and affiliate we have shared it with;
• withdraw your consent; and
• have it deleted, including by our service providers.

To make a request, text Remmy or email [support email]. We respond within 45 days, as described in Section 6. If we deny your request, you may appeal by replying with "Appeal." If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint, or the attorney general of your state.

9. California privacy disclosures

If you are a California resident, this section applies to you, in addition to the rest of this Policy.

Notice at collection. In the past 12 months, we have collected the following categories of personal information:

Sources, purposes, and retention. These are described in Sections 1, 2, and 5.

No selling or sharing. We do not sell or share personal information, as those terms are defined in the California Consumer Privacy Act, and have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Sensitive personal information. We use and disclose it only to provide the Service you requested and for other purposes the law permits, and not to infer characteristics about you. We do not offer a separate right to limit its use, because we do not use it for anything that right would cover.

Your rights. You have the rights to know, access, correct, and delete your personal information, and not to be discriminated against for using them. See Section 6 for how to make a request.

Shine the Light. We do not share personal information with third parties for their direct marketing purposes.

Do Not Track and Global Privacy Control. Because we do not sell or share personal information, or use it for targeted advertising, there is nothing for these signals to switch off. If that ever changes, we will honor Global Privacy Control.

10. Cookies and website analytics

Our website is hosted by Framer, which may use cookies or similar technologies needed to deliver the site and to measure traffic in aggregate. We do not currently use advertising cookies or tracking pixels. If we add them, we will update this Policy first. The messaging Service itself does not use cookies.

11. Children

The Service is only for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that a member is under 18, we close the account, cancel any subscription, and delete their information, keeping only what we need to prevent them from signing up again.

12. United States only

The Service is intended only for people in the United States, and we store and process information in the United States.

13. Changes to this Policy

We may update this Policy. For material changes, we will notify you by text or on our website before they take effect, and we will ask for your consent where the law requires it.

14. Contact

Karvos LLC
[mailing address]
[support email]