Trailhead — Privacy Policy

Last updated: July 22, 2026

Overview

Trailhead is a wilderness route-planning app for hiking and trail running in New Zealand. We are committed to protecting your privacy. This policy explains what data the app accesses, how it is used, and your rights. Using Trailhead requires a free account — you sign up with a username and password only; no email address is required — and your saved data syncs to the cloud so it follows you across devices.

Data We Collect

You sign up with a username and password only — we do not ask for or store an email address. The following account data is stored on our behalf by Supabase (our authentication and database provider):

• Username — identifies your account for sign-in (held as a synthetic internal address; no email is collected)
• Saved routes — routes you explicitly save while signed in
• Favourites — huts, campsites and places you mark as favourites
• Home base — the home address you optionally save (for the dashboard's Home routing shortcut), so it follows you across devices
• Preferences — app settings synced across your devices
• Basic usage & subscription status — last active time, number of app opens, and whether your account is on a trial or subscription

Payment for a subscription is processed by Stripe (on the web) or the Apple App Store / Google Play (in-app purchase). We store only your subscription status and, for web payments, a Stripe customer reference — never your card details.

We do not sell or share account data with anyone. You can delete your account and all associated cloud data at any time from the app (Account → Delete account) or by emailing joshlees1@gmail.com.

Location Data

The app requests access to your device's GPS location to:

• Center the map on your current position
• Display your pace, heading and altitude on the trip dashboard, and your position during navigation
• Calculate distances to tracks, huts and campsites
• Provide compass navigation to a chosen destination

Your live GPS location is processed entirely on your device. It is never sent to our servers and is not stored beyond the current session. The one deliberate exception is the home base address you choose to save: because you asked for it to sync across your devices, that single saved address is stored with your account (see "Data We Collect"). The app functions without location access — you can deny the permission and use the map manually.

Device Sensors

The app may access device motion sensors (accelerometer, gyroscope, compass) for the trip dashboard's heading and compass features. This sensor data is processed on-device only and is not stored or transmitted.

Data Stored on Your Device

The app stores the following locally on your device using browser storage (localStorage, IndexedDB, Cache API):

• Saved routes — route start/end/waypoints you explicitly save
• Favourites & preferences — places you mark and your app settings (synced to Supabase only if you sign in)
• Compass target — your chosen navigation destination
• Map tile cache — cached map images for faster loading and offline use
• POI cache — cached campsite and service data
• Weather cache — cached weather data from Open-Meteo

You can clear all locally stored data at any time by clearing your browser's site data for this app.

Third-Party Services

The app makes direct requests from your browser to these third-party services:

• OpenStreetMap — map tiles and place search (Nominatim) — OSM Privacy Policy
• Open-Meteo — weather forecasts — Open-Meteo Terms
• RainViewer — live weather radar overlay tiles
• BRouter (brouter.de) — foot route calculation
• LINZ, CARTO & Esri — basemap tiles (topographic, satellite) — Esri Privacy Policy
• CDNs (unpkg, cdnjs, Google Fonts) — delivery of the app's code libraries and fonts
• Supabase — account authentication and cloud sync (only if you sign in) — Supabase Privacy Policy
• Google — OAuth sign-in only (only if you choose "Sign in with Google") — Google Privacy Policy

Track, hut and campsite data from the Department of Conservation (CC-BY 4.0) and OpenStreetMap (ODbL) is bundled with the app as a static dataset — the app makes no runtime calls to DOC for it.

These services may log your IP address and the coordinates/queries you request. We have no control over their data practices — please review their policies.

Cookies & Tracking

Trailhead does not use analytics, advertising, or any tracking technologies. We do not use Google Analytics, Facebook Pixel, or any similar services. If you sign in, Supabase stores an authentication token in your browser solely to keep you signed in.

Children's Privacy

The app is not directed at children under 13 and does not knowingly collect data from children.

Your Rights (GDPR / CCPA)

You may request access to, correction of, or deletion of your account data (username, saved routes, favourites, home base, preferences, usage and subscription status) at any time — from the app (Account → Delete account) or by emailing joshlees1@gmail.com. Deletion removes your account and all associated cloud data.

Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top will reflect any changes.

Contact

For questions about this privacy policy, contact us at: joshlees1@gmail.com