Trailmates
Privacy Policy
What the app collects, why it collects it, who else sees it, and how to get it back or have it deleted.
Last updated 5 September 2026
This policy covers the Trailmates mobile app and this website. Trailmates is operated byTrailmates (“Trailmates,” “we,” or “us”), who is responsible for the information described here. It applies to everyone who uses Trailmates, wherever they live.
The short version. Trailmates holds what you type into it and the photos you upload. There is no analytics SDK, no advertising SDK, and no tracking of any kind in the app (not switched off, but never installed). Your device’s location is never sent to us or stored. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. There is no advertising here to serve.
What we collect, and why
The categories below use the labels the California Consumer Privacy Act asks for, so this can be compared against other apps’ disclosures. Everything listed comes from you: we do not buy personal information, and we do not obtain it from data brokers.
| Category | What that means here | Why we collect it |
|---|---|---|
| Identifiers | Your email address, your name, and an account identifier. | Creating and securing your account, and letting other hikers know who they are talking to. |
| Customer records | Your profile: avatar and photos, a short bio, stated experience level, and the general area you hike in. | It is what somebody reads before deciding whether to hike with you. All of it is optional except your name. |
| Internet or network activity | The hikes you post or join, your messages, reactions and read receipts, reviews you leave, reports you file, and who you have blocked. | Running the app: the board, the approvals, the group chat, the review history, and acting on safety reports. |
| Geolocation data | The point you pin when you post a hike. Never your device’s own location, which is covered below. | Showing a hike on the map so people can find it. A pinned area is not an address. |
| Visual information | Photos you upload to your profile or to a hike. | Displaying them in the app, and screening them before they become visible to others. |
| Device identifiers | A push notification token for each device, if you allow notifications. | Delivering the notification. It identifies a device, not a person, and is deleted with your account. |
We do not collect sensitive personal information as that term is defined under state privacy law: no government identifiers, financial accounts, precise geolocation, race, religion, health, biometrics, or the contents of mail. Messages you send inside a hike’s group chat are visible to that group and to us for safety purposes; they are not scanned for any other reason and never for advertising.
What we deliberately do not collect
- Your device’s location is never stored or sent to us. The app asks for location permission for two things, centering the map on you and helping you drop a pin when you post a hike, and both happen entirely on your device, only while the app is open. There is no background location and no live location sharing during a hike. Declining the permission costs you a convenience, not a feature.
- No emergency or next-of-kin contact. The app used to hold one and it was removed, because it was the only information in the app belonging to somebody who never agreed to be in it.
- No analytics, advertising, tracking, or fingerprinting. No such SDK is installed, so there is no behavioral profile of you to sell, share, or leak.
- No payment information. The app is free and takes no payments.
- No contacts, photo library, calendar, or health data. Choosing a photo to upload gives the app that photo, not your library.
We do not sell or share your information
We have not sold personal information, and we have not shared it for cross-context behavioral advertising, in the preceding twelve months, and we do not do so now. Because we do not, there is no “Do Not Sell or Share My Personal Information” link on this site. There would be nothing behind it. We also do not sell or share the personal information of anyone under 16.
Who else receives it
Other users see your profile, the hikes you post, and what you write in a chat you are part of. Beyond that, information goes only to the service providers the app needs to function. Each is bound to use it solely to provide their service to us:
| Service provider | What it receives | Why |
|---|---|---|
| Supabase | Accounts, all app data, and uploaded photos. | The database, authentication and file storage the app runs on. Everything you enter into Trailmates is stored here. |
| OpenAI | The title, description and photos of a hike you post. | Automated screening for prohibited content before a hike becomes visible. Only the post is sent, never your identity, your messages, or your profile. |
| Expo, and through it Apple and Google | A device push token, and the text of the notification. | Delivering push notifications to your device. |
| Mapbox | The area of the map you are looking at. | Drawing the map. This happens whether or not you have granted location permission. |
| Apple or Google | Your name and email address, if you choose to sign in with them. | Sign-in only. Apple lets you hide your real address behind a relay address, and the app works normally if you do. |
We will also disclose information where we are legally required to (a subpoena, court order, or lawful request) or where we believe in good faith that it is necessary to prevent serious harm to someone. If Trailmates is ever acquired or merged, information would transfer as part of that transaction, and you would be told before it did.
How long we keep it
Your account data is kept while your account exists. A hike stops being listed once it expires, but its record remains available to the people who were part of it. Reviews stay on a profile, because a review history that could be cleared on demand would be worthless to the next person relying on it.
Reports are the one deliberate exception to deletion, and it is worth being plain about: if you file a report and later delete your account, the report survives but your identity as the reporter is erased from it. Cascading it away would empty the safety queue of exactly the reports that mattered most.
Deleting your account
You can delete your account from inside the app. It is immediate and permanent rather than a request we process. It removes your profile, the hikes you posted, your participation in others, your messages, your push tokens, and the photos you uploaded: the files themselves, not just the rows pointing at them. It cannot be undone, and we cannot restore it for you.
Your rights
There is no single federal privacy law covering an app like this one, so your rights depend on your state. Rather than checking where you live, we extend the following to everyone:
- Know and access: what we hold about you, and a copy of it.
- Delete: see above; you can do this yourself, immediately, in the app.
- Correct: most of it you can already edit directly in the app.
- Portability: a copy in a machine-readable format.
- Opt out of sale, sharing, targeted advertising, and profiling: nothing to opt out of, because none of it happens.
- Non-discrimination: exercising any of these changes nothing about how the app works for you. There is no paid tier to lose.
To exercise a right, write to info@trailmatesapp.co from the email address on your account, which is how we verify a request without asking you for more information than we already hold. We respond within 45 days and will tell you if we need a further 45. An authorized agent may act for you with your written permission. If we deny a request, you may ask us to reconsider by replying, and residents of several states have a statutory right to that appeal.
If you are in California and are unsatisfied, you can complain to the California Privacy Protection Agency or the California Attorney General. Residents of other states may complain to their own Attorney General.
Security
Access to data is enforced at the database itself, per row and per user, rather than only in the app, so a bug in a screen cannot expose something that screen was never meant to show. Traffic is encrypted in transit. No system is perfect, and if a breach occurs we will notify affected users and the authorities each state requires, within the time that state allows.
Children
Trailmates is for adults. You must be at least 18 to hold an account, and we do not knowingly collect personal information from anyone under 13, as the Children’s Online Privacy Protection Act uses that age. If we learn that an account belongs to someone under 18, we will delete it. A parent or guardian who believes their child has created an account can write to us and we will remove it.
Where your information is held
Trailmates and its service providers operate in the United States, and your information is stored and processed there. If you use the app from outside the United States, you understand that it is processed in a country whose privacy laws may differ from your own.
Changes
If this policy changes in a way that affects you, the date at the top changes and we will say so in the app before the change takes effect.
Questions about this document go to info@trailmatesapp.co.