Last updated:
The short version.
This policy covers the Trailtold mobile app and this website. Trailtold is operated by a small independent team, not a large company. If something below changes, we'll change this page and update the date at the top.
When you create an account you give us an email address and a password. These are held by our authentication service, which we run ourselves; passwords are stored hashed and we never see them in readable form. Your account is identified internally by a random user ID, and that ID — not your email — is what's attached to everything else below.
If you choose Sign in with Apple or Sign in with Google instead, that company confirms who you are and passes our authentication service your name and email address — with Apple, that can be a private relay address if you choose to hide yours. You don't create a Trailtold password in that case, and Apple or Google never tells us your password for their service. Everything else on this page applies the same way.
A display name that you choose. This is public: it appears next to anything you post. Your email address is never shown to other people.
Notes and other contributions you write about places, ratings and reviews you leave on tours, and the moderation actions you take (following someone, blocking someone, reporting a post). Contributions are reviewed before anyone else can see them.
If you subscribe or buy a park pack, the payment itself is handled entirely by Apple or Google. We never see your card number. We useRevenueCat, a third-party service, to keep track of what you're entitled to; RevenueCat receives your random user ID and the purchase and receipt data from the app store. RevenueCat publishes its own privacy documentation for the data its SDK handles.
This is the important one, so here is precisely how it works. While a tour is running, the app asks the operating system for your position so it can tell when you've reached a stop and start the right audio. That position is handed straight to the part of the app that plays narration, on your device, and is never transmitted. There is no field in any request the app makes to our servers that carries a latitude or longitude, and the location library the app uses has no way to send positions anywhere — it only reports them to the app on your phone. Location access is requested only as "while using the app", and only while a tour is actually active — nothing tracks you between tours or after you close the app.
The app doesn't keep a history of where you've been, either. While a tour runs it holds only your most recent position, in memory, to check whether you've reached a stop; nothing is written to storage, and it's gone when the tour ends.
Because no coordinates leave the device, we declare location as not collected on the App Store and Google Play data forms, which define "collected" as transmitted off the device. The map-data requests described below do leave your device, to our storage. They are framed by the park you're viewing rather than by your GPS position, so they never carry your coordinates — but we won't pretend they reveal nothing: if you're walking that tour, the park they name is where you are. Once you download an offline pack, they stop entirely.
The app contains no analytics SDK, no advertising SDK, and no crash-reporting SDK. We don't build a profile of your behavior, we don't sell or rent data to anyone, and we don't participate in any ad network. We do not track you across other companies' apps or websites, so Apple's App Tracking Transparency prompt does not apply to Trailtold.
We don't ask for or collect your contacts, photos, microphone, calendar, health data, or advertising identifier.
Audio. When you play a tour or download an offline pack, your device fetches the audio files from our content storage. Those requests carry no account information — they're anonymous, and they are not linked to your profile. As with any request to any server on the internet, the receiving server can see the IP address it came from and which file was asked for. We don't use those requests to identify you or to reconstruct where you've been.
Map tiles. The map draws from our own storage: a single map-data file per park, which your device reads directly. Those requests carry no account information and are not linked to your profile. As with the audio, the receiving server can see the IP address the request came from and which park's file was asked for. No third-party map service is involved, and no other company receives your IP address or the area you are looking at.
Transitional note for older app builds. App versions released before the bundled map shipped still draw their on-screen tiles from the MapLibre demo server (demotiles.maplibre.org), which — like any server you request tiles from — sees your device's IP address and the requested map area. Updating the app to the current version moves map drawing entirely onto the bundled style and our own storage. This paragraph will be removed once those older builds are out of circulation.
When you download an offline pack, the same map-data file is stored on your device and the map reads it from there instead — so a downloaded tour shows the same map with no signal at all, and makes no map requests to us either.
Map data comes from OpenStreetMap contributors under the Open Database License. Park information comes from the National Park Service and is in the public domain.
We keep the list of third parties as short as we can. Today it is:
| Who | What they handle |
|---|---|
| Apple / Google | App distribution and all payment processing for purchases. If you use Sign in with Apple or Sign in with Google, that company also confirms your identity and shares your name and email address with us. |
| RevenueCat | Purchase and subscription status, keyed to your random user ID. |
| Amazon Web Services | Hosting for our servers, including our authentication service. |
| Supabase | Hosting for our database, where your account data and posts are stored. |
| Cloudflare | Hosting for this website, storage/delivery for audio and pack files, and storage for our encrypted database backups. |
Every party in this table is a service provider acting on our behalf. There is no longer any third party the app talks to directly for maps — that row was removed when the app began serving its own map data. We don't sell your personal information, and we don't share it for advertising.
Public inside the app: your display name, your published contributions, and your reviews. Not public: your email address, your password, and your purchase history.
Your account data stays until you delete it — see below. Our servers keep ordinary operational logs (things like IP address, request path and timestamp) so we can debug problems and detect abuse. Those log files are size-capped and rotate, so the oldest entries are overwritten as new ones arrive rather than being kept indefinitely.
Some log lines do include your account's random user ID — for example when a purchase message from the app store can't be processed, or when part of an account operation fails. So while we don't use logs to build a profile of your behavior, we won't claim log entries are anonymous: until they rotate away, some of them can be associated with an account.
One identifier deliberately survives deletion, in order to enforce it. When you delete your account we keep your random user ID and the date it was deleted — one opaque identifier and a timestamp, nothing else. No email address, no display name, no content, nothing that ID was ever attached to.
We keep it because a store subscription outlives the account that bought it. Deleting your Trailtold account doesn't cancel an App Store or Google Play subscription — only the store can do that — so the store keeps sending us renewal messages carrying your old ID, every billing period, for as long as the subscription lives. With no record that the account is gone, each of those messages would create a fresh entitlement keyed to that ID, putting back the identifier we told you we had erased. Keeping the bare ID is what makes the erasure stick — the same principle as an unsubscribe list. The only read we ever perform against it is "has this ID been deleted?", so the message can be dropped. It is never used to serve, profile, re-identify, or contact anyone, and it is never joined back to user data.
You can delete your account from inside the app: Profile → Delete account. It's immediate and permanent, and it removes your profile, your contributions, your reviews, your follows and blocks, and your login itself.
Cancel a subscription before you delete. Deleting your Trailtold account does not cancel an App Store or Google Play subscription — only the store can do that — so if you delete first, the store keeps charging you for an account that no longer exists. Deleting also forfeits your purchases: they cannot be restored onto a new account. The full list of what is and isn't removed is on theaccount deletion page.
Trailtold isn't directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child has created an account, contact us and we'll remove it.
Traffic between the app and our servers is encrypted with HTTPS. Sign-in tokens are stored in your device's secure storage (the iOS Keychain or the Android Keystore). No system is perfectly secure, and we won't pretend otherwise — but we keep the amount of data we hold small on purpose, which is the most effective protection available to us.
If the app or our data handling changes in a way that affects anything above, we'll update this page and the date at the top before the change reaches you.
Questions about privacy, or a request about your data:[email protected]. For anything else, see support.