Privacy Policy
Wild Trails collects only the data needed to run live GPS checkpoints and save your game history. We do not run ads or sell location data.
We do not sell, rent, or share your personal details or GPS history with data brokers.
We only read your location while you are in an active game.
You can delete your account and all stored game data at any time from your profile.
01. Data Controller & Contact
For the purposes of the General Data Protection Regulation (GDPR) and applicable European data protection legislation, Wild Trails is operated as an open-source outdoor navigation initiative:
Formal Data Subject Access Requests (DSAR) or regulatory inquiries under GDPR Articles 12 to 15 may be submitted through our Data Privacy contact form above.
02. Information We Collect
person Account Information
When you create an account, we collect your email address and login credentials (handled through Supabase Auth). You can also set a call-sign / display name and avatar to show on team rosters and public template leaderboards.
location_on Geolocation & Telemetry Data (GPS)
To run the game outdoors, we ask for access to your device's GPS location:
- Waypoint Detection: During an active game, we check your coordinates to see when you come within 35 meters of a checkpoint.
- Co-Op Team Sync: In co-op games, the Field Team's coordinates are shared in real time with the Base Team so they can work out bearings and solve clues.
- Leaderboard Verification: Speed and time between checkpoints are checked on the server to prevent GPS spoofing on public template leaderboards.
notifications_activeBackground Location Disclosure (Mobile Client)
On iOS and Android, Wild Trails asks for Background Location permission. This runs only while a game is active so your phone can play a sound, vibrate, and notify you when you come within 35 meters of a checkpoint while your phone is in your pocket. Background tracking stops as soon as you finish, leave, or end the game.
camera_alt Photos & User-Uploaded Media
If you upload reference photos for visual landmark spotting or checkpoint curation, photos are stored in secure cloud storage buckets protected by Row-Level Security policies. We do not inspect photos for advertising or facial recognition.
03. Legal Bases for Processing (GDPR Article 6)
We process your personal information under the following legal bases:
- Performance of a Contract: Processing your account, active GPS coordinates, and mission state is necessary to deliver the game service and enable real-time navigational gameplay.
- Legitimate Interests: We have a legitimate interest in safeguarding our infrastructure, detecting automated cheating/spoofing on leaderboards, and maintaining service reliability.
- Consent: Where required (such as background location and push notifications on mobile devices), we request your explicit consent through operating system permission dialogs, which you can revoke at any time in device settings.
04. Authorized Infrastructure Subprocessors
We use the following infrastructure providers to run the app under GDPR Data Processing Agreements (Article 28):
| Subprocessor | Role & Processing Purpose | Data Location | Transfer Safeguards |
|---|---|---|---|
| Supabase Inc. | PostgreSQL database, user authentication tokens, active game telemetry, and secure mission media storage with Row-Level Security. | EU (Frankfurt / Ireland) | EU Data Residency • GDPR DPA |
| Vercel Inc. | Application hosting, serverless API execution, edge routing, global CDN delivery, cookieless aggregated web traffic analytics, and Core Web Vitals speed performance insights. | Global Edge / EU | EU-US DPF • Standard Contractual Clauses |
| Google Cloud (Vertex AI & Gemini API) | Generative spatial course synthesis and AI Game Master riddle inference (Hugin & Munin). Zero training on player prompts. | EU / USA | Google Cloud DPA • SCCs • No Model Training |
| Push Notification Relays (Apple APNs & Google FCM via Expo) | Transmission of proximity arrival notifications, haptic cues, and tactical mission alerts to mobile devices. | USA / EU | Apple & Google DPA • Anonymous Push Tokens Only |
Note on Public Cartographic Data: Geospatial tiles and terrain datasets provided by Maanmittauslaitos (National Land Survey of Finland, CC BY 4.0) and OpenStreetMap (ODbL) are public geographic reference materials. They do not receive or process player personal data, accounts, or telemetry, and are therefore not GDPR subprocessors. Full cartographic attributions appear in our website footer and Terms of Service.
05. Your GDPR Rights & Self-Service Account Deletion
Under the GDPR, you have the following rights over your personal data:
- Right of Access: View your stored stats, game history, and badges in your Ranger Dossier.
- Right to Rectification: Update your call-sign and preferences at any time in profile settings.
- Right to Erasure ("Right to be Forgotten"): Permanently delete all data we hold about you.
To delete your data immediately, open your Ranger Profile, scroll to the Danger Zone, and click "Delete Account". This permanently removes your profile, login credentials, and location history from our database.
You also have the right to lodge a complaint with your national supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).
06. Cookies & Local Storage
Wild Trails uses strictly necessary session cookies and local storage tokens to manage authentication state and remember your client-side interface preferences (such as your chosen topographic tile layer or audio volume).
We do not use third-party behavioral tracking cookies, advertising pixels, or cross-site tracking scripts.
07. Changes to this Policy & Privacy Questions
We may periodically update this Privacy Policy to reflect app enhancements or evolving regulatory standards. When modifications occur, the "Last Updated" date at the top of this document will be updated.
For privacy inquiries, data subject access requests, or questions regarding our geolocation disclosures, please reach out to: