The short version, about what you write.
Your conversations with Kip, your Field Notes and check-ins, your Trail Tales, the letters you write to other explorers, and short notes Kip makes so he can remember you from one conversation to the next. We keep it for you, for Kip, and for anyone you share it with, and use it for nothing else. If you delete your account, everything you haven't shared with other explorers is permanently deleted after 30 days.
Kip reads your writing so he can reply, except letters, which only you and the explorer you wrote to ever read. Nobody at Inner Isles reads it unless you let us: by sharing a conversation when you report a problem with it (for two weeks, and you can stop sooner from your Account page), by showing us a letter someone sent you, or by turning on "Help Test Kip" there. We keep a record every time we look.
Your conversations, Field Notes, letters and Kip's notes are encrypted in our database. Our server holds the key, because Kip has to read your words to answer them.
We sometimes use AI to check conversations for problems. It tells us what went wrong, not what you wrote.
Anthropic's Claude writes Kip's replies. OpenAI makes search data from Kip's notes, turns speech into text, and makes pictures from your photos. Neither trains its models on what we send, and both delete it within 30 days unless it's flagged for misuse.
Our monitoring and analytics see which account did what, never what you wrote, unless you've turned on "Help Test Kip". Brevo sends our emails.
Only what you share. Trail Tales and Lodge posts go where you address them, a letter goes to the one explorer you write it to, and Kip may quote a few lines of a signed tale you've shared with the whole club, with your first name. If you leave, what you've shared stays with the club, and letters stay with the people you wrote them to. Ask us and we'll take your name off it.
Posted notice · The Front Desk
In effect
Privacy Policy
What we keep, who can read it, and how to take it back
What Inner Isles collects and why, who helps us run the club, how long things are kept, and what you can do about it.
Inner Isles is run by Inner Isles LLC, based in Texas, USA, at innerisles.club. This policy covers the website, the app, and conversations with Kip, including the first conversation someone has with Kip before they join.
Your account: your name, email address, password (stored only as a one-way hash), time zone, and pronouns if you add them. If you add a location to your profile, we look it up to place you on the club's map. Photos you upload for your profile or Explorer Portrait.
What you write and make: your conversations with Kip and any documents you attach to them, Field Notes, check-ins and Expedition logs, Trail Tales with any videos you record and our transcripts of them, letters you write to other explorers, your answers to the guidance questionnaire, the details of your Adventures, Treks and Explorer Identities, and posts in the Lodge. When you dictate, the recording is turned into text and then thrown away.
What Kip keeps about you: short notes Kip makes as you go so he can remember you between conversations, summaries of longer conversations, and search data made from those notes so Kip can find the right one later.
Before you join: if you talk to Kip before joining, your first name, your email address and the conversation.
How you use the site: the pages you visit and buttons you press, your browser and device, and your IP address. We record sessions to see where the site is confusing, with all text and every form field hidden, so a recording shows what you did, never what you wrote or read.
Payments: Stripe handles them. We never see your full card number.
We use cookies that keep you signed in and protect your account, and one analytics service, PostHog. There are no advertising cookies and no advertising or social media tracking on the site.
To run the club: your account, Expeditions, the Lodge, and the emails you've asked for.
So Kip can reply to you and remember you.
To take payment and manage your membership.
To keep the service working and safe: fixing errors, stopping abuse, protecting accounts.
To make Kip better. We look at counts and patterns, not your words. Sometimes we use AI to check conversations for problems, such as Kip breaking one of his own rules; the check tells us what went wrong, not what you wrote.
We don't sell your information, we don't use it for advertising, and we don't let anyone train AI models on it.
Kip reads your writing so he can reply, except letters between explorers, which he never reads. Nobody at Inner Isles reads it as a matter of routine. A person reads your writing only when:
you report a problem with a Kip conversation and choose to share it, in which case the Crew (the people who run Inner Isles) can read that one conversation for 14 days, or until you stop sharing it from your Account page. We keep a record every time a shared conversation is read;
someone writes you a letter and you choose to show it to the Crew, in which case they can read that one letter and no other. We keep a record every time a shown letter is read;
you turn on "Help Test Kip" on your Account page, until you turn it off;
you wrote it to us, such as the note you can leave when you fly home early from an Expedition, or a report of a post in the Lodge;
the law requires it, or someone's safety is at serious risk.
Conversations with Kip before joining are handled the same way: nobody at Inner Isles reads one unless the visitor chooses to share it. We keep Kip's one-line reason for how he answered them, as the club's own record.
Your conversations with Kip, your Field Notes and check-ins, the notes Kip keeps, your questionnaire answers, your Explorer Identity reflections and the letters explorers write to each other are encrypted in our database. Encryption doesn't lock us out entirely, because Kip has to read your words to answer them, so our server holds the key. Trail Tales and Lodge posts, which you write to share, are not encrypted.
These companies process information for us. Each gets only what it needs for its job.
Anthropic (Claude) writes Kip's replies, letters and summaries. It receives your conversations with Kip, the notes Kip keeps about you, the Field Notes and check-ins he reads, and your questionnaire answers. Anthropic's commercial terms don't allow it to train its models on what we send. It deletes what we send within 30 days, or keeps it for up to 2 years if it's flagged for breaking Anthropic's usage policy. Processing may happen outside the United States.
OpenAI makes search data from the notes Kip keeps and from Trail Tale passages, turns speech into text (dictation and Trail Tale videos), and makes pictures from your photos: your Explorer Portrait, your icon, and Expedition group photos that combine your party's pictures. OpenAI doesn't train its models on what we send through its API. It may keep inputs and outputs for up to 30 days to watch for misuse, and keeps nothing from transcription.
Hetzner (Germany) hosts our server and database, and Laravel Forge manages the server.
Cloudflare protects the site from attacks and bots, speeds it up, and stores uploaded files such as photos, videos and chat attachments. It sees every visitor's IP address.
Backblaze (United States) keeps backup copies of uploaded files. When a file is deleted, its backup copy is gone within 90 days.
Laravel Nightwatch alerts us to errors and slow pages. It receives your name, email and account ID, your IP address and technical details of the request, never the text you write, and keeps them for 90 days.
Langfuse (Amazon Web Services, Oregon, United States) tracks what Kip's replies cost and when they fail. It receives the account and conversation each reply belongs to, and counts such as length and cost, not the words, unless you've turned on "Help Test Kip". Langfuse doesn't train models on our data.
PostHog (Amazon Web Services, Virginia, United States) is our analytics. It receives the pages you visit and what you click, your name, email and account ID, and session recordings with all text hidden. Recordings are kept for 30 days.
Mapbox turns a profile location into a place on the map and draws map images.
Google Fonts supplies the site's typefaces and sees your IP address when a page loads them.
Brevo (European Union) sends our emails, including the letters Kip writes you, and our newsletters. It holds your name, email address and membership status, and a copy of each email it sends.
Stripe (United States) takes payments. It receives your name, email and payment details, and also acts on its own account for fraud prevention and legal compliance.
Our server and database are in Germany. Some of the companies above keep information in the United States or the European Union, and AI processing may happen in other countries. Where information leaves the country it was collected in, it's covered by each company's data processing terms.
Your account and what you've written: while your account is open.
When you delete your account: it closes immediately and our emails stop. After 30 days your account and everything you haven't shared with other explorers (your conversations with Kip, Field Notes and check-ins, the notes Kip kept, your photos and your attachments) are permanently deleted. Backup copies made before then are deleted within 90 days.
What stays after deletion: Stripe keeps the payment records it's required to keep. Brevo keeps your contact marked as deleted and unsubscribed, so we never email you by mistake. PostHog keeps the record of your past visits, with your name and email. What you shared with other explorers, your Trail Tales and your posts in the Lodge, stays with the club, so the conversations around it still make sense, and the letters you wrote stay with the people you wrote them to. Videos in your Trail Tales are deleted; their transcripts stay in their place. Ask us and we'll take your name off anything you shared, or remove something personal to you.
A conversation with Kip before joining: 12 months after the last message, the conversation is deleted along with your name, email and Kip's reason. You can delete it yourself at any time from the end of the conversation.
A conversation shared with a report: readable by the Crew for 14 days, or until you stop sharing it.
Your account export: the file is deleted after 7 days.
The companies in section 5 keep information as described there.
Download a copy of your writing and account from your Account page.
Correct your details, delete your account, stop sharing a conversation, or turn "Help Test Kip" off, from the same page.
Unsubscribe from our emails with the link in any of them.
Ask what we hold about you, ask us to correct or delete it, or object to how we use it, by emailing [email protected].
Depending on where you live (the EU, the UK, or some US states), you may have further rights, including to complain to a data protection authority. We answer every request within 30 days.
Inner Isles is for adults. You must be 18 or older to use it. If we learn that someone under 18 has an account, we delete it.
Everything travels over encrypted connections. Private writing is encrypted in our database, access to members' writing is limited as described in section 4, and every reading of a shared conversation or a shown letter is logged. No system is perfectly secure; if something goes wrong that affects you, we'll tell you.
We may update this policy from time to time. If a change matters, we'll tell members by email or with a notice on the site, and update the date at the top.