NavTrail — Privacy Policy

Effective date: 2026-06-19 (updated for v1.2 — optional accounts, cloud backup & public usernames; previously 2026-05-19).
Public version hosted at: https://navtrail.app/privacy

This privacy policy explains what data the NavTrail app collects, how that data is used, who else processes it, and how long it is kept. It exists to comply with Romanian and EU data-protection law (Regulation (EU) 2016/679 — "GDPR") and applicable app-store publishing requirements.

If you have a question about your data or want to exercise any of the rights listed at the bottom of this document, email contact@navtrail.app.

1. Who is the data controller?

NavTrail is operated by Constantin, an individual developer based in Bucharest, Romania. This is a hobby / non-commercial project — there is no registered company behind it at the time of writing. Contact: contact@navtrail.app.

A Romanian version of this policy is available at https://navtrail.app/privacy-ro.

2. The short version

• No name, email, or phone is required to use the app. You sign in anonymously on first launch — the app generates a random user ID that lives on your device until you delete the app or wipe it.
• Creating an account is optional. If you want to back up your data and restore it on a new device, you can turn your anonymous identity into an account with an email + password — that is the only time we collect an email address. Without an account, nothing changes from before.
• Location data is collected only when you use a location-aware feature (recording a GPS track, sharing your position with convoy members, posting a hazard or SOS). Background location is requested only if you choose to broadcast to a convoy.
• No analytics, no advertising, no third-party SDKs beyond Firebase Cloud Messaging (for SOS notifications). The app has no Crashlytics, no Facebook SDK, no AppsFlyer, no anything-like-that.
• Map tiles, routing requests, and address searches are sent to third-party services (OpenStreetMap, OpenTopoMap, OSRM, Photon, Esri/ArcGIS, OpenFreeMap) — those providers can see the coordinates you query. See § 5 for the full list.
• You can delete all your data at any time — instantly and yourself, from inside the app (Settings → Personal data → Delete account and all my data, or the Account & backup screen). If you have already uninstalled the app, email contact@navtrail.app instead. See our data-deletion page and § 9.

3. What data the app collects

3.1 Account

• A randomly-generated anonymous user ID (UUID), created by Supabase Auth on first launch. By default no email, password, phone, or name is required or collected.
• Optionally, an email address + password — only if you choose to create an account (to back up and sync your data across devices). Your existing anonymous user ID is preserved when you convert. Your password is never visible to us: it is sent to Supabase Auth, which stores only a salted hash. Email confirmation is required before an account becomes active.
• A Firebase Cloud Messaging (FCM) registration token — a long device-specific string Google issues to allow us to push you SOS notifications. Linked to your user ID in our database.

3.2 Location

The app collects precise location (GPS coordinates + altitude when available) only when:

• You record a GPS track — stored on your device. If you have an account, it is also backed up to your private cloud storage so you can restore it on another device (see § 3.3). Without an account, tracks stay on-device only.
• You post a POI (camping spot, water spring, etc.), hazard report, or SOS alert — the location of that single post is uploaded to Supabase so other users in the area can see it on the map.
• You join or create a convoy and enable position sharing — your live position is broadcast to the other convoy members (max 12 people who all share a 6-character convoy code). See § 6 for the convoy detail.

The app never collects location passively in the background unless you have explicitly joined a convoy and granted background-location permission. Even then, broadcasting auto-stops after 2 hours of foreground-screen-off use to limit battery and data drain.

3.3 Cloud backup of your tracks & lists (optional — requires an account)

If — and only if — you create an account (§ 3.1), the app backs up your personal data so you can restore it on a new device:

• Your recorded GPS tracks — summary stats plus the full track as a compressed GPX file stored in a private Supabase Storage bucket only you can read.
• Your packing inventory (item names, weights, checked state) and vehicle-maintenance records (category, odometer, date, free-text notes).

This data is private to your account (enforced by Row-Level Security) — it is never shown to other users. It is removed when you delete the record or your account (§ 9). Anonymous (no-account) users back up nothing.

3.4 User-generated content

• An optional public username (3–20 characters) — if you set one, it is shown on the POIs, hazards and SOS alerts you create, in place of your anonymous ID, and is readable by anyone using the app. You choose it when creating an account (or later, while it is still unset); leaving it blank shows "Anonim" instead.
• POI names + descriptions (≤ 800 chars)
• Hazard descriptions (≤ 280 chars, optional)
• SOS descriptions (≤ 280 chars, optional) and contact_hint (≤ 80 chars, optional — typically your own phone number if you choose to share it)
• Convoy nicknames (≤ 8 chars, visible only to other members of your convoy)
• Moderation reports you file against other users' content

3.5 Map / routing / search queries

When you pan the map, search for a place by name, or ask for turn-by-turn navigation, the device sends the relevant coordinates or search text to third-party map providers (§ 5). These queries do not include your anonymous user ID. The providers can, however, see the IP address your device connects from.

3.6 What the app does NOT collect

• Your real name or phone number. Your email address is collected only if you voluntarily create an account (§ 3.1) — or if you put contact info in an SOS contact_hint.
• Photos, microphone audio, contacts, calendar, or any other personal data on your device.
• Analytics events, ad identifiers, or behavioural telemetry.
• Web-browsing history. Crash logs are NOT collected by us (app-store pre-launch testing runs its own diagnostics outside this scope).

4. Why each piece of data is collected (lawful basis)

Under GDPR Art. 6:

No data collection is based on a contract (Art. 6(1)(b)) — there is no paid subscription — and none of it falls under the "vital interest" or "public task" bases.

5. Third parties that receive your data

NavTrail does not sell your data and does not share it for advertising. Data passes to the following service providers strictly to make the app work:

5.1 Supabase (primary backend)

• What: Anonymous-auth records, account email addresses, POIs, hazards, SOS alerts, convoy memberships, FCM tokens, moderation reports, and — for account holders — backed-up tracks, inventory and maintenance records plus the GPX track files in private Storage.
• Where: EU region (Frankfurt, Germany). Operated by Supabase Inc.
• Why: Our database, authentication server, and Realtime push channel.
• Privacy policy: https://supabase.com/privacy.

5.2 Firebase Cloud Messaging (push notifications)

• What: Your FCM registration token + the contents of any SOS notification we send your way.
• Where: Google global infrastructure. Operated by Google LLC.
• Why: Deliver heads-up notifications when another user posts an SOS in your geohash cell.
• Privacy policy: https://policies.google.com/privacy.

5.3 OSRM routing

• What: Latitude/longitude of your current position and your chosen destination, sent over HTTPS for route calculation.
• Where: router.project-osrm.org (community-operated demo server).
• Why: Calculate turn-by-turn driving routes.
• Privacy policy: https://routing.openstreetmap.de/about.html.

5.4 Photon (Komoot) — geocoding

• What: The text you type into the search bar, plus your current position as a bias (to rank nearby results higher).
• Where: photon.komoot.io — operated by Komoot GmbH.
• Why: Convert "Cabana Padina" into a map coordinate.
• Privacy policy: https://www.komoot.com/privacy.

5.5 OpenStreetMap tile servers

• What: Map-tile requests ({z}/{x}/{y} URL segments) — these effectively reveal which map regions you are looking at.
• Where: a/b/c.tile.openstreetmap.org (OpenStreetMap Foundation, UK).
• Why: Render the standard online map style.
• Privacy policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy.

5.6 OpenTopoMap, CyclOSM, Esri/ArcGIS World Imagery, OpenFreeMap

• What: Same shape as § 5.5 (tile requests revealing the regions you view) for the alternative map styles.
• Where: Various community-operated servers + Esri (ArcGIS).
• Privacy policies:
  • OpenTopoMap: https://opentopomap.org/about
  • CyclOSM: https://www.cyclosm.org/
  • Esri: https://www.esri.com/en-us/privacy/overview
  • OpenFreeMap: https://openfreemap.org/

5.7 What no third party receives

• None of the third-party services above receives your anonymous user ID.
• None of them receives the contents of POIs / hazards / SOS posts (those stay between your device and Supabase).
• None of them receives any contact information you may have entered in an SOS contact_hint.

6. The convoy feature in detail

This deserves its own section because it is the only feature that uses background location, and it is the only feature where your real-time position becomes visible to other people.

6.1 How it works

• You explicitly create or join a convoy by entering a 6-character code shared by the convoy owner (think "AirDrop for off-road groups"). Convoys are capped at 12 members.
• Before background broadcasting starts, the app shows an in-app disclosure dialog explaining what's about to happen, and then asks your device for the background-location permission.
• While broadcasting, a persistent notification appears showing "Convoy active — your position is being shared" with a one-tap "STOP SHARING" button.
• Broadcasting automatically stops after 2 hours of cumulative foreground-screen-off use, even if you forget you joined.

6.2 What flows where during a convoy

• Your live position (lat/lon/heading) is sent every ~5 seconds to Supabase Realtime Broadcast and immediately relayed to the other convoy members. It is not stored — there is no database row written for any single position ping.
• Your convoy membership (anonymous user ID + nickname + color) is stored in a database row for the lifetime of the convoy. Convoys auto-expire 12 hours after the last activity (last position broadcast or heartbeat) and are then deleted server-side.

6.3 Who can see your position

• Only other members of the same convoy. Membership is gated by the 6-character code and enforced by Supabase Row-Level Security.
• The convoy owner can kick any member, immediately revoking their ability to see other members' positions.
• Any member can leave the convoy at any time, immediately stopping their broadcasting and removing them from the others' maps.

6.4 How to stop

• Tap the persistent notification's "STOP SHARING" button — instant.
• Open the app → MENU → Convoy → LEAVE CONVOY — instant + removes your membership row.
• Disable the app's background-location permission in your device's Settings → Apps → NavTrail → Permissions — at the OS level, instant.
• Force-quit the app — the foreground service stops, broadcasting stops. The system will not relaunch it.

7. How long data is kept

8. International transfers

• Supabase data — including account emails and your backed-up tracks, inventory, maintenance and GPX files — is hosted in Frankfurt, Germany (EU). No transfer outside the EU/EEA happens for the primary backend.
• Firebase Cloud Messaging operates on Google's global infrastructure. Google relies on Standard Contractual Clauses (Art. 46 GDPR) for transfers outside the EEA — details in their privacy policy.
• The third-party tile / routing / geocoding services listed in § 5 are operated by entities in the EU (Komoot — Germany; OpenStreetMap Foundation — UK + community mirrors) and the US (Esri). Each request is a transient HTTP call; nothing about you persists with those providers beyond their own server logs.

9. Your rights under GDPR

You have the right to:

• Access the data we hold about you. Email contact@navtrail.app with the anonymous user ID visible in the app's Settings → About screen. We'll send a JSON export within 30 days.
• Rectification — correct anything that's wrong. POIs and SOS alerts you created are editable / deletable directly in the app. For other corrections, email us.
• Erasure / "Right to be forgotten" — delete everything yourself, instantly, from inside the app: Settings → Personal data → Delete account and all my data, or the Account & backup screen. This removes your account and all personal data (cloud backups, devices, convoy data, your hazard/SOS posts and the moderation reports you filed) immediately; your community POIs are kept but anonymized (de-linked from you). If you have uninstalled the app, email contact@navtrail.app instead and we will complete it within 30 days. Full details: our data-deletion page.
• Restriction of processing — same email; tell us which processing you want paused.
• Object to processing based on legitimate interest — same email.
• Data portability — request your data export under "Access" above; the format will be machine-readable JSON.
• Withdraw consent at any time, where consent was the basis (e.g. revoke the notification or background-location permissions in your device's Settings).
• Lodge a complaint with the Romanian data-protection authority (ANSPDCP — dataprotection.ro) if you believe we've mishandled your data.

10. Children's privacy

NavTrail is not directed at children under 16 and we do not knowingly collect data from them. If you believe a child has used the app and you'd like their data removed, email contact@navtrail.app.

11. Security

• All network traffic is over TLS 1.2+ (HTTPS). Plain HTTP is disabled at the OkHttp + manifest level.
• Database access is gated by Row-Level Security policies on every table, so a compromised anon-auth token cannot read other users' data beyond what the in-app UX exposes.
• Anonymous user IDs are random UUIDs — they cannot be reversed into PII because no PII was collected to begin with.
• The Supabase publishable API key shipped in the APK is intentionally public; it grants no privileges beyond what RLS allows.
• If you create an account, your password is never stored or seen by us — Supabase Auth keeps only a salted hash, and email confirmation is required before the account activates.

This said, no system is perfectly secure. If you discover a vulnerability, please email contact@navtrail.app rather than posting it publicly so we can fix it before bad actors notice.

12. Changes to this policy

Material changes (new third parties, new data categories, changed retention) will be announced in the app's release notes and reflected in the "Effective date" at the top of this document. Continued use of the app after a change implies acceptance of the new policy. If a change is significant enough that it requires fresh consent (e.g. adding analytics — which we won't), the app will prompt you in-app.

The current version always lives at https://navtrail.app/privacy.