# Trailborn Privacy Policy Effective date: 28 August 2026 The data controller is Michał Mijalski, the creator of Trailborn. Privacy contact: forestnapstudio@gmail.com. Trailborn turns your everyday movement into ground on a map. This document says what reaches us, why, who we pass it to and how long we keep it. ## What we process **Account.** Your Google or Apple account identifier, nickname, character appearance and app settings (language, theme, units, notifications). **Health data.** With your explicit consent we read step and climbed-floor counts from Health Connect (Android) or HealthKit (iOS). Steps and floors become metres, and metres reveal roads. We keep daily step and floor totals for as long as your account exists — without them we cannot show statistics or detect the same activity being counted twice. We do not sell health data, do not use it for advertising or ad profiling, and never pass it to insurers or to credit scoring. We do not read heart rate, sleep, weight or any medical records. **Location.** We store only your latest position, overwritten each time it changes. We do not keep a continuous GPS trail and cannot reconstruct your movements. We do store **which road segments you claimed and when** — that is game state, and the map does not work without it. Claimed roads indicate the areas you play in, and in team modes they are visible to other players. Route privacy settings let you hide where your roads are from other players and from rankings; the server still needs your position to match activity to nearby streets. **Messages.** Team chat messages are visible to members of your team. They disappear automatically after 24 hours, and you can delete your own sooner. Announcements from the developer are one-way and contain none of your data. **Diagnostics.** On sign-in and on a crash we record the app version, device model, OS version, interface language and the country code from your device settings; a crash also sends the error and its technical context. **We do not record your IP address.** **Fair play.** We check that activity is physically possible (step cadence, floor counts, daily limits) and reject data typed into a health app by hand. We derive a cryptographic hash from your device's health data source identifier so the same steps cannot feed two accounts. The identifier cannot be recovered from the hash. **Trailborn Plus.** Purchases are not available in the current test build. If Trailborn Plus goes on sale, we will store only the fact and period of an active subscription. Google Play or the App Store will process the payment — **we will not receive your card number or other payment details**. An active Trailborn Plus entitlement will disable rewarded adverts. **Advertising.** Advertising in Trailborn is entirely optional: you watch an advert only when you choose to take a chest for it. The app requests non-personalised adverts from Google AdMob. AdMob may use the device's advertising identifier and technical data to serve adverts, cap their frequency, produce aggregate reports and prevent abuse. Where required, Google may show a consent form after onboarding. If privacy options are available in your region, you can reopen them under Settings → Ad privacy. **Notifications.** If you enable them, we store the device's push notification token to send team chat messages, team events and announcements from the developer. Achievement, settled-step and daily-reminder notifications are created locally on the device. ## Legal bases - **Contract** (Art. 6(1)(b) GDPR) — running your account, the map, territory, teams, rankings and achievements; once sales are enabled, the subscription too. - **Explicit consent** (Art. 6(1)(a) and Art. 9(2)(a) GDPR) — health data, location, notifications and required advertising privacy choices. You can withdraw any of these in your device or app settings; withdrawal does not affect processing already carried out lawfully. - **Legitimate interest** (Art. 6(1)(f) GDPR) — crash diagnostics, account security and protection against cheating. ## Who we share with We do not sell data. We use the following providers, each only as far as running the game requires: | Who | Why | What reaches them | |---|---|---| | Google (Sign-In, Play Services) | signing in | your Google account identifier | | Google AdMob | chest-for-advert | device advertising identifier, technical device data | | Expo | delivering push notifications | notification token, notification content | | Hetzner Online (Germany) | servers and database | everything described above, stored in Germany | | Contabo GmbH (server in the European Union) | road and world map database | only the map area our game server asks about; no account data and no steps | | Mapbox (USA) | map background | map tile requests from your device: your IP address and the area of the map you are looking at | | OpenFreeMap / OpenMapTiles | fallback map background | map tile requests from your device, when the Mapbox background is unavailable | | OpenStreetMap Foundation (Nominatim) | place search | **the text you type into place search** and the Trailborn server address | Place search is called by our server, not by your phone, so your IP address never reaches Nominatim. The map background is fetched by your device directly from Mapbox's servers, so your IP address and the part of the map you are viewing reach them. We do not pass them your nickname, your account or your steps. Google, Expo and Mapbox may process data outside the European Economic Area, under the European Commission's standard contractual clauses. Only what your chosen game mode implies is publicly visible: nickname, colour, character appearance, claimed roads and ranking position. ## How long we keep it - Account and game progress — until you delete your account. - Team chat messages — 24 hours. - Crash reports and diagnostics — 12 months. - Backups — rotated and deleted within 30 days. When you delete your account we erase your profile, sessions, health data, personal territory, achievements and inventory. Team events may remain in anonymised form so shared rankings and the world map stay intact. Signing out only ends the session on that device and **deletes nothing**. Account deletion is a separate, irreversible option in Settings. ## Your rights You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interest. Write to forestnapstudio@gmail.com — we answer within 30 days. You may also lodge a complaint with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or the authority in your own country. ## Children Trailborn is not intended for children under 13. Where the age of independent consent is higher, a guardian's consent is required. We do not direct advertising at children and do not knowingly collect data from anyone below that age; if we learn that we have, the account is deleted. ## Security Traffic is encrypted over HTTPS, sessions use expiring tokens, administrative access is restricted and password-protected, and backups are encrypted. ## Changes We will announce material changes in the app before they take effect. The effective date at the top always identifies the current version.