Trailborn privacy policy

> This document has not been reviewed by a lawyer.

Document version: 2026-08-29 Effective: 29 August 2026

Who processes your data

The data controller is Michał Mijalski, an individual running the Trailborn project under the name Forest Nap Studio.

• postal address: ul. Południowa 54, 42-229 Częstochowa, Poland
• email: forestnapstudio@gmail.com

Trailborn turns your everyday movement into territory on a map. This document says what reaches us, why, who we pass it to and how long we keep it. It describes the app as it actually behaves in version 1.1.21.

Age

Trailborn is intended for people aged 16 and over. When you create an account you confirm with a single checkbox that you are at least 16 and have read the terms and this policy. We do not ask for a date of birth; we store the declaration itself and use it for two things: to avoid creating an account for someone under 16, and to configure advertising correctly. Accounts created before 16 September 2026 gave a birth year, which we keep for that purpose only. We do not infer age from your phone settings or from how you use the app.

What we process

Account. Your Google account identifier, the email address attached to it, your nickname, colour, character appearance, age declaration (a birth year only for accounts created before 16 September 2026) and app settings (language, theme, units, notifications, animation speed).

Steps and floors — three sources. With your explicit consent we read your step and floor counts from:

• Health Connect on Android, if you connect it;
• the Health app (HealthKit) on iPhone, if you grant access in the system dialog; we read steps and floors climbed only, write nothing, and HealthKit data is never used for advertising or profiling, never sold and never shared with any third party;
• your phone's motion sensor, if you turn the step counter on. That is a separate source and a separate permission (`ACTIVITY_RECOGNITION`), which we request only after you press "turn on the step counter", with an explanation directly above that button.

Steps and floors are converted into metres, which is what you spend discovering roads. Daily totals go to our server, not the sensor trace. History from the phone counter stays on the device for 30 days and is then deleted. Daily totals are kept for as long as your account exists — without them we cannot show statistics or detect the same activity being counted twice.

We do not read heart rate, sleep, weight or any medical records. We never write anything back to Health Connect or to the Health app. We do not sell health data, use it for advertising or ad profiling, or pass it to insurers or credit assessment.

Location. We store only your last position, overwritten on every change. We do not keep a continuous GPS trace.

We do store which road segments you claimed and when — that is game state, without which the map does not work. Claimed roads indicate the areas where you play. In route privacy settings you can switch on incognito mode; it shifts future routes, while territory claimed earlier stays where it was.

Messages. Team chat messages are visible to members of your team. They disappear automatically after 24 hours. You can delete your own message within 24 hours of sending it; a team administrator can delete any message.

Reports and moderation. If you report content, or somebody reports yours, we store: who reported it, what it concerns, the chosen reason, your optional comment and a snapshot of the reported message — chat disappears after 24 hours, so without the snapshot a moderator would receive an empty case. We also store the moderator's decision and any appeal.

Blocks. We keep your list of blocked players until you remove a block.

Diagnostics. At sign-in we record the app version, device model, system version, interface language and the country code from your device settings. On a crash we record the error and its technical context. We do not record your IP address.

Fair play. We check whether activity is physically possible (step cadence, floor counts, daily limits) and reject data entered by hand in a health app. On first launch the app creates a random installation identifier and stores it in the system's secure storage; it exists only so the same steps cannot feed two accounts. It is not a device identifier and nothing about you can be recovered from it.

Trailborn Plus and payments. Purchases are not available in the current version. If we enable them, we will store only the fact and period of an active subscription, and Google Play will handle payment — we will not receive your card number or any other payment details.

Advertising. Advertising in Trailborn is entirely voluntary: you watch an advertisement when you choose to claim a chest for it. There are no banners and no full-screen advertisements. The app always requests non-personalised advertisements from Google AdMob. AdMob may use the advertising identifier and technical device data to serve the advertisement, cap frequency, produce aggregate reports and prevent abuse.

To grant your chest after an advertisement, Google sends us a confirmation. We do not pass your account identifier for this: our server issues a single-use, random token valid for 15 minutes, which expires once spent. Google does not learn whose advertisement it was.

Notifications. If you enable them we store your device's push token. When you disable them the token is deleted from the server and from the device. Achievement, settled-steps and daily-reminder notifications are created locally on the device.

What is publicly visible

Another player who taps your nickname sees: your nickname, colour, character appearance, total distance and territory, the number of achievements unlocked, the items and accessories you wear, and the teams you belong to.

They do not see: your email address, health data, last position, daily activity, birth year, or whether the account is suspended.

Map tiles show claimed roads in the owner's colour, but carry no player identifiers.

Legal bases

• Contract (GDPR art. 6(1)(b)) — the account, map, territory, teams, rankings, achievements and chat.
• Explicit consent (GDPR art. 6(1)(a) and art. 9(2)(a)) — step and floor data from both sources, location, notifications and advertising privacy choices. You can withdraw any of these in device or app settings; withdrawal does not affect what we did lawfully beforehand.
• Legitimate interest (GDPR art. 6(1)(f)) — crash diagnostics, account security, protection against cheating, and moderation of user content.

Providing data is voluntary, but without an account and a step source the game cannot work — there is nothing to count metres from.

Who we pass data to

We do not sell data.

| Who | Why | What reaches them | |---|---|---| | Google (sign-in) | account sign-in | Google account identifier | | Google AdMob | chest-for-advertisement | advertising identifier, technical device data, single-use verification token | | Expo | push notification delivery | push token, notification content | | Hetzner Online (Germany) | game servers and database | everything described above, stored in Germany | | Contabo GmbH (European Union) | road and world map database | only the map area our game server asks about; no account data and no steps | | OpenFreeMap / OpenMapTiles | map basemap | tile requests from your device: your IP address and the map area you are viewing | | OpenStreetMap Foundation (Nominatim) | place search | the text typed into place search and our server's address |

Place search is called by our server, not your phone, so your IP address does not reach Nominatim.

The basemap is fetched by your device directly from OpenFreeMap's servers, so your IP address and the part of the map you are looking at reach them. We do not pass them your nickname, account or steps.

Google and Expo may process data outside the European Economic Area, on the basis of the European Commission's standard contractual clauses.

How long we keep data

These periods match what the code actually deletes.

| Data | Period | |---|---| | Account, profile, territory, gear, achievements | until the account is deleted | | Team chat messages | 24 hours | | Crash reports | 7 days | | Walk processing jobs (full request and response) | 14 days | | Activity synchronisation batches | 180 days | | Activity security events | 180 days | | Advertising events | 90 days | | Sign-in telemetry (country, language, version, model, system) | 90 days | | Closed moderation reports and appeals | 180 days after the decision | | Single-use advertisement verification tokens | 15 minutes, deleted after a day | | Expired sessions | 7 days after expiry |

A moderation report is not deleted while an appeal on it is still open.

We do not keep backups. Data exists only in the production database.

Deleting your account

Delete it in the app: Settings → Account and data → Delete account, with two confirmations. You can also request deletion without installing the game, at https://forestnap.com/delete-account/.

Once deletion is confirmed we remove your profile, sessions, step and floor data, personal territory, achievements, gear, chests, push token and the data stored on your device. Team events and the shared world history may remain in anonymised form so that other players' maps and rankings do not fall apart — without your nickname and without your identifier.

An ordinary sign-out clears the phone's step history, the Health Connect cursors, the installation identifier and the push token from the device. Claimed territory stays on the device under your account, so signing back in finds your map.

Your rights

You have the right to: access your data, rectify it, erase it, restrict processing, port it, object to processing based on legitimate interest, and withdraw consent at any time.

We do not take decisions about you based solely on automated processing that would produce legal effects. Fair-play checks may flag activity as implausible, but decisions to suspend an account are taken by a person and can be appealed.

Requests: forestnapstudio@gmail.com. We answer without undue delay and within one month at the latest.

You also have the right to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

Changes

We will announce material changes in the app. The version of this document you accepted is stored with your account together with the date.