Privacy Policy

Skipper is made by Manoa, Inc. ("we", "us"). This policy explains what the Skipper app and this website collect, why, and who else ever sees it. It's written to be read, not to be survived.

Location

Skipper is a driving tour. Location is the whole mechanism: it's how the app knows you're coming up on Emerald Bay and starts talking before you've passed it.

While you're using the app, and not otherwise

Skipper asks for location access only while the app is in use ("When In Use"). It does not ask for, and is not built to receive, background location. Background location is switched off in the app's build configuration, so the app cannot track you when it isn't open. If you leave Skipper running on a mount for the drive, that's the app being used; close it and the location stops.

Your location stays on your phone

This is the part worth being specific about, because "we use your location" usually hides the interesting detail. In Skipper's case the detail is short: your position is never sent to our server at all. Not a precise reading, not a blurred one. Your phone holds the route and the trigger points, watches where you are, and decides on its own when the Skipper should start talking.

• Planning a drive. You tell the Skipper where you'd like to go, in words. He can only offer places from a list we curated in advance, and what travels to our server is the identifier of a place you picked, not a reading from your GPS. We send those endpoints to Google's Routes API to compute the road route, and we store them with your drive so you can replay it.
• Driving it. Nothing. The drive plays entirely on your phone against the route it already holds, which is also why it works with no signal.
• The map. Your position is drawn on the map on your device. The map itself is rendered by the Google Maps SDK built into the app. Google receives what it needs to draw a map (device and app diagnostics, a device identifier, and usage data), and because the map follows along while you drive, the area it draws is necessarily the area you're in. We don't hand Google your account or a separate feed of your position.

Being straight with you: our server still sees your IP address on any request your phone makes, the way every server does, and PostHog turns an IP into a city-level guess (below). That's a coarse, ordinary thing, but it isn’t nothing, and we’d rather say so than let you find out.

Motion

Your speed and heading come from the same location updates described above, and iOS draws on the device's motion sensor to produce them, which is why the app asks for motion access. It's used on your phone, in the moment, so a story starts at the right time at 55 mph instead of after you've gone past. We don't collect it and it isn't sent anywhere.

Planning a drive is a conversation, and that part is an AI

You plan a drive by talking to the Skipper in the app. He's a real AI model, and we'd rather name it than let "powered by AI" do the work: each time you send a message, what you have typed, and what he said back earlier in that conversation, goes to Anthropic, who run the model that writes his reply. He is also handed the list of curated places he's allowed to offer you.

What does not go with it is the interesting part:

• Not your location. The model is never given your position, and it is not given coordinates for any place either: only names and identifiers. It cannot react to where you are, because it is never told.
• Not your account. The planning request is sent without your credentials, on purpose, so a conversation is never linked to a signed-in identity. You don't need an account to have it.
• Not your IP address. Our server calls Anthropic, not your phone, so what Anthropic sees is our server, not you.

Nobody keeps the conversation, including your phone. There is no transcript table in our database and we don't log what you write. On your phone it is held in the app's memory while the screen is open, and re-sent each turn so the Skipper remembers what you just said; it is never written to storage. Close the app and it is gone, from both ends. What survives is the drive you decided to make.

Anthropic handles that text under their own terms as our processor. Being straight with you: once text leaves for a third party, our promise about it is a promise about us, so the honest advice is the same as for any chat box. Tell him where you'd like to drive; don't tell him your secrets.

Your account

Planning a drive works without an account. Creating and saving one needs it. If you make an account, we store:

• Your email address and a display name.
• Your password, stored as a hash, never as plain text, and not readable by us, if you set one. Most accounts have no password at all: see below.
• Session records, which include your IP address and your device's browser/app identification string. This is how you stay signed in and how we can tell a session apart from an attacker's.

You sign in with a six-digit code we email you. There is nothing to remember and, unless you choose otherwise, no password on your account at all. You can set one in the app under Settings if you would rather have a way in that doesn't depend on an email arriving. There is no sign-in with Google or Apple: those aren't configured.

We send exactly two kinds of email, and only when you ask for them: your sign-in code, and a password reset if you have set a password and forgotten it. The same kind of code confirms it's really you before we delete your account. There is no marketing email, because there is no marketing list.

Drives and credits

A drive you create belongs to you. We store its label, its start and end points and their names, the route geometry, how long and far it is, and which stories were selected to ride along it, enough to show it to you again later.

Credits are kept as a simple running ledger: a record for the free credits granted to your account, and one for each drive that spends one. It's append-only, which is a technical way of saying we add rows rather than rewrite history.

What stays on your phone

Where you've driven. Your position, your speed, and which stories actually played on a given drive are worked out on your phone and never sent to a server. That's a deliberate design decision, not an oversight we haven't got to yet: where you've been driving is yours, and we can't see it because we never asked for it.

Drives you download for offline playback are stored on your phone too. Delete the app and they're gone.

Analytics and crash reporting

We use PostHog, a third-party product-analytics and crash-reporting service, to see which parts of the app people actually use and to catch crashes so we can fix them. This is first-party product analytics, not advertising, and not a data broker. Through PostHog we collect:

• which screens you open, and a small number of anonymous usage events;
• crash and error reports (what failed and where) along with basic device and app-version information;
• an approximate, city-level location that PostHog derives from your internet (IP) address.

This data is not linked to your account: we don't tell PostHog who you are, so it's tied to an anonymous per-device identifier, not your email. We don't record your taps or your screen, there's no session replay, and we don't sell or share this data. Your location and what you type to the Skipper are never part of it.

What we don't do

We don't run ads, and there's no advertising identifier in the app, so there's nothing to opt out of. We don't sell or share your personal information, and we never have. We don't build a marketing profile on you, and there's no marketing list.

Who else touches your data

These are the services that run Skipper. They handle data on our behalf, to do their job:

Neon

Hosts our database: your account, drives, and credit ledger live here.

Google

Google Cloud runs our server. Google's Routes API computes the road route between the two endpoints you pick for a drive. And the Google Maps SDK inside the app draws the map; see The map above for what that involves.

Anthropic

Runs the AI model the Skipper talks with while you plan a drive. Receives what you type in that conversation and nothing else: no location, no account, not your IP. See Planning a drive above.

Cloudflare R2

Stores the narration audio files. Audio is private and served through short-lived signed links.

Resend

Sends our two transactional emails: your sign-in code, and a password reset if you have set a password. Your address is passed to them only for those messages.

PostHog

Product analytics and crash reporting (US region). Receives the anonymous usage events, screen views, crash reports, device information, and IP-derived approximate location described above, never linked to your account.

Apple

Distributes the app through the App Store.

Worth separating the two AIs, because they work very differently. The Skipper's narration (every story you hear on the road) is written and voiced before you ever press play, in our studio, in advance, and stored as an audio file. Nothing about you or your drive is sent to the AI services that write and voice it. On the drive itself there is no AI listening to you or reacting to where you are; there's a recording, and your phone decides when to play it. The planning conversation is the live one, and it is described in full above.

Where the stories come from

These are sources we read, not places your data goes: Wikipedia, Wikidata, Macrostrat, and Google Places. They're credited, with their licenses, in the app under Settings → Sources & Licenses.

Deleting your account

You can delete your account from the app, in Settings. It is immediate and total: no grace period, no thirty-day tombstone, no "we'll keep it in case you come back". Deleting removes:

• your user record, your sessions, and your sign-in credentials;
• every drive you've made: the actual rows, not a flag that hides them;
• your entire credit ledger.

Any credits you have left are forfeited. Credits are never refunded, not on deletion, and not when you delete a single drive. If you have credits you care about, spend them first.

The narration audio itself isn't deleted, because it was never yours: every rider hears the same recording of Emerald Bay. It contains nothing about you.

You can also email us to ask what we hold on you, or to have it corrected or deleted, at the address below.

Nevada residents

We're a Nevada company, and Nevada law (NRS 603A) gives Nevada residents the right to tell an online service not to sell their covered information. We don't sell your information, not to anyone, not for anything, so there's nothing here for us to stop doing. If you'd like that answered in writing anyway, that's a fair thing to ask: email hello@skipper.fm, our designated request address, and we'll confirm within the 60 days the law allows.

How long we keep things

Your account and drives are kept until you delete them or ask us to. Sessions expire on their own. Planning conversations aren't kept at all; there's nothing to expire. Server request logs are kept for a limited period by our hosting provider for operating and debugging the service; they record that a request happened, not what you typed. The anonymous analytics and crash data held by PostHog is retained per our PostHog project's settings.

Children

Skipper isn't directed at children, and we don't knowingly collect personal information from children under 13. Kids are extremely welcome in the back seat; the account just isn't theirs. If you believe a child has given us information, email us and we'll delete it.

Changes

If this policy changes, we'll update it here and move the date at the top. If a change is significant, we'll say so in the app rather than hope you re-read this page.

Contact

Questions, requests, or a correction to something above: hello@skipper.fm. Manoa, Inc., a Delaware corporation, 1810 E Sahara Ave STE 75994, Las Vegas, NV 89104, USA.