22 knots, tier-2 spot
The experienced rider
A confident intermediate on a matched kite size sees a go. The conditions sit inside the band their recorded outcomes favor.
Cold-start safe by defaultPersonalization grows only with evidenceWeather and safety gates always win
The invariant
Personalization is bounded. The physics gates always win.
Personal preference modulates the recommendation. It never rewrites the physical result and never bypasses a safety gate.
01
Same weather, different advice
The same wind, read for the person
The same wind can be ideal for one rider and unsuitable for another. Goable can account for declared skill and equipment while keeping environmental safety rules fixed.
22 knots, tier-2 spot
The newer rider
A beginner with lighter gear sees borderline on the same window. Same physics, a recommendation read for their declared skill and their history.
The fixed part
The safety threshold
Add lightning within range and both riders get the same answer: no-go. The environmental safety rule does not move for anyone.
02
Safety invariant
Hard gates always win
Personalization can never invert a verdict or bypass a gate. When a hard gate fires, the personal and archetype signals are dropped entirely: a brand-new beginner and a five-year veteran both see no-go when there is lightning. These four layers run in strict order.
1
Hard physics gates
Lightning proximity, hazardous air quality and severe-storm conditions always force the unsafe verdict. They fire before any personalization runs. A brand-new beginner and a five-year veteran both get no-go on a storm cell.
2
Calibrated physics score
The authority for the meteorological and physical decision. Personalization modulates the recommendation within the band the physics permits. It can never overturn an unsafe verdict.
3
Archetype blend
Between 5 and 29 outcomes, the archetype cell is the secondary signal. A cell activates only once it holds enough distinct users (at least 10) to be an anonymous aggregate.
4
Per-user fit
The individual model, bounded to a documented weight schedule. It shifts a borderline call within limits; it never bypasses a gate.
03
Cold-start ladder
From generic verdict to personal fit, one outcome at a time
A new user has no behavioral signal, and you cannot show them a useless answer for weeks. Personalization ramps in stages. Until a stage unlocks, the calibrated score is shown unchanged.
| State | Evidence available | What the user sees |
|---|---|---|
| No history | 0 recorded outcomes | The calibrated physics score and verdict, identical for everyone. personalization_weight is 0. |
| First sessions | 1 to 4 outcomes | The user is placed in an archetype cell (activity, declared skill, spot-difficulty tier). If that cell is active, its aggregate is the secondary signal. No per-user model influence yet. |
| Evidence building | 5 to 29 outcomes | The per-user model begins to influence the blend. Its weight ramps from 0 at 5 outcomes toward full weight at 30. |
| Established | 30 or more outcomes | The per-user model carries full weight in the personal-versus-archetype blend. The physics score and safety gates remain the authority. |
| Safety event (any state) | A hard gate fires | Hard unsafe, no personalization. Lightning, hazardous air or a severe-storm marker forces no-go. Personal and archetype outputs are dropped and personalization_weight resets to 0. |
04
What you send
Outcomes, not inferred intent
The model learns from the outcomes you record. A booking or an attendance is a choice signal: it tells you what a user did, not whether the conditions were physically suitable. The physics score remains the measure of suitability; personalization only learns preference on top of it.
The request
Activity, spot, time window, and an optional user_profile (declared experience, owned gear, weight, risk tolerance). The pseudonym identifies the user without revealing who they are.
The outcomes you record
The model learns patterns from recorded outcomes the tenant sends, such as attendance, cancellation or post-session feedback. You decide which events you report.
Training consent
Each request carries training_consent, and it defaults to off. Goable still computes a decision when it is off; it just does not add that request to the per-user training set. The user opts in.
05
What you get back
Four distinct fields, one decision record
The response keeps the physics, the personal fit, the safety layer and the final suggestion separate, so a booking flow can read exactly what drove the answer.
score + verdictThe unpersonalized physical result on a 0 to 100 scale, with the same verdict /v1/score produces (unsafe, not_feasible, poor, marginal, fair, favorable, excellent). This is the physics, identical for everyone.
decision.personal_scoreThe individual fit in a 0 to 1 range. Null until the user has enough outcomes for a per-user model to influence the result.
decision.safety_notesThe hard-gate layer. When a gate fires the recommendation is no-go and the personal and archetype outputs are dropped.
decision.recommendationThe final suggestion the UX shows: go, borderline or no-go. Personalization modulates it within the band the physics permits and never inverts an unsafe verdict.
Example response
POST /v1/decision -> 200 OK
{
"score": 78,
"verdict": "marginal",
"decision": {
"recommendation": "go",
"personal_score": 0.82,
"archetype_score": 0.61,
"personalization_weight": 0.6,
"n_outcomes_seen": 20,
"safety_notes": [
{ "severity": "info",
"code": "no_gate_triggered",
"description": "No safety gate fired for this window." }
]
},
"degraded_mode": false
}Here the physics verdict is marginal, and a strong personal fit (0.82) lifts the recommendation to go within the band the physics allows. A hard gate would have forced no-go instead, with the personal and archetype scores dropped.
06
Privacy and isolation
Personal data, handled as personal data
Personalization stores per-user model weights, which makes it personal data under GDPR. Erasure is a hard requirement, and it cascades across every store that holds the pseudonym.
Pseudonymization
The tenant sends a stable pseudonym derived by hashing its own user id with a tenant-held secret. Goable never sees the real user id. All behavioral storage is keyed by pseudonym.
Tenant isolation
A tenant's per-user models and cohort signals are scoped to that tenant. One tenant's personal data is not used to personalize another tenant's users.
Right to erasure
DELETE /v1/decision/user-data/:pseudonym removes the per-user model, anonymizes the audit and run records tied to the pseudonym, and returns a deletion receipt so you can prove the request without re-storing the pseudonym.
Tamper-evident, retained where permitted
Records are tamper-evident and retained only where legally permitted. After a deletion the per-user model is gone; what remains is a deletion receipt with no personal identifier, plus anonymous aggregates above the anonymity thresholds.
07
Technical method
How the blend is built
Per-user model
A small multilayer perceptron: input 17, hidden 16, output 1, with sigmoid activations (305 parameters). It maps the request context and the user's history to a fit probability in a 0 to 1 range.
Blend schedule
The personal weight follows a fixed, documented schedule: 0 below 5 outcomes, then a linear ramp to full weight at 30. Below 5, the archetype cell or the plain score carries the answer.
Training vs serving
We begin learning after a few recorded outcomes: the nightly retrain fits a model once at least 3 examples exist, warm-starting from the prior night's weights. But we do not let personal learning influence a live recommendation until the minimum evidence threshold is met (5 outcomes), and full weight arrives only at 30.
Archetype cells
The cold-start prior. Same architecture, trained on aggregated data for an (activity, archetype, spot-tier) cell. A cell activates only once it holds at least 10 distinct users, so it is an anonymous aggregate by construction.
Three kinds of signal, three anonymity postures
- Personal signal (per pseudonym): the user's own model. It personalizes only that user's recommendations and is deleted on erasure.
- Archetype cell (cold-start blend): an anonymous aggregate that activates at a minimum of 10 distinct users. This is the privacy threshold we publish.
- Recent cohort signal: an aggregate, community-context observation gated at a lower internal floor (at least 2 distinct pseudonyms and at least 3 observations). It never exposes an individual, and the low floor is an internal analytics bar, not a marketed privacy guarantee. Below it, the surface returns nothing.
Natural-language reasoning, generated last
Explanations are generated last from the structured decision record and cannot alter the score or the safety result. Hard gates are resolved before the reasoning step runs at all. The narrative is optional: it needs the tenant's own model key, and without one the response falls back to a deterministic template. See how explanations stay grounded.
08
Access
Gated by evidence, not by plan
POST /v1/decision is available on every plan, Free included. What changes over time is not the plan but the evidence. Four capability levels stack up:
1. Generic calibrated score
The unpersonalized physics score and verdict, from the first call, with no key required.
2. Personalization data ingestion
Send a pseudonym and record outcomes (opt-in). The per-user model starts to learn on the nightly retrain.
3. Archetype and personal fit
Once the evidence threshold is met, the archetype and per-user signals influence the recommendation. This is gated by accumulated evidence, not by plan. A full personal model is not instantly available on any plan.
4. Natural-language explanation
The optional narrative sentence. It requires your own model key (BYOK); without one, the score and blend still run and the text degrades to a template.
Activation curve
Per-user models retrain nightly; archetype cells populate as they reach their anonymity floor. A freshly seeded vertical (kite or ski-touring) typically takes a few months to reach archetype-blend coverage on its main spot tier.
09
Try it