TrailSync ("the app", "we", "us") is a real-time group location-sharing app. This policy explains what data the app collects, why, where it is stored, how long it is kept, who else can see it, and what control you have over it — including how to delete your account.
Contact for any privacy question or request: lunkeybolt@gmail.com
Summary
- The core of the app is sharing your live location with a crew you choose to join. That is its purpose, and it is the most sensitive data we handle.
- You can be in several crews at once. While you are, the same position is shared with every one of them at the same time — not only the crew shown on your screen.
- Your location is stored as a single current position that is overwritten on each update. We do not keep a location history or movement log.
- Location, chat, and walkie-talkie data for a crew are deleted when the crew ends or expires — and in a crew with no end date, walkie-talkie clips are deleted once they pass a fixed age (currently 7 days).
- Chat messages are encrypted before they leave your device.
- If your crew uses Ride Mode, searching for a destination sends what you type — and your approximate location — to Google so it can suggest places, and the route chosen is shared with your whole crew.
- We use no advertising, no analytics, and no crash-reporting SDK. We do not sell or share your data with data brokers.
- We never see your card or payment details. Subscriptions are handled entirely by Google Play.
Who this policy covers
Anyone who uses TrailSync, including guest users who continue without an account (an anonymous identity with a randomly generated display name), and registered users who sign in with email/password or Google Sign-In.
What we collect, and why
Account and profile data — stored in Google Cloud Firestore under your account record:
| Data | Why we need it |
|---|---|
| Display name, marker/avatar | So crew members can identify you on the map and in chat |
| Account creation date | Account housekeeping and inactive-account cleanup |
| Crews you have joined, muted, or have active | To show you your crews and respect your notification choices |
| Notification token | To deliver push notifications |
| Subscription tier, trial state, expiry, billing status | To unlock paid features you have purchased |
| Crews you have silenced walkie-talkie auto-play for | So an incoming clip is announced rather than played aloud, in the crews you chose |
Your email and password are held by Google Firebase Authentication — never visible to us. We do not collect date of birth, phone number, postal address, contacts, photos, health data, advertising identifiers, or device model.
Location data — the sensitive one. What is collected: latitude, longitude, GPS accuracy, speed, heading, device battery percentage, and a timestamp — only while you are a member of an active crew and have granted location permission.
Updates are sent at most every 5 seconds while moving and every 30 seconds while stationary, skipped if you've moved under ~10 metres, with a 2-minute heartbeat regardless. Positions with GPS accuracy worse than ~50 metres are discarded rather than sent.
On Android, a foreground service with a persistent notification keeps location sharing running while the app is not on screen, and resumes after a restart while a crew is active.
Who it goes to — please read this carefully. You can belong to several crews at the same time, and your position is sent to every crew you are currently in, simultaneously. The crew displayed on your map is only the one you are looking at; it does not limit who receives your location. Every member of every crew you have joined can see where you are. If you no longer want a crew to see your position, leave that crew — switching to a different crew on screen does not stop sharing with it.
Retention: your position is written to a single record per crew that is overwritten by each new update — there is no stored trail, route log, or past-locations archive. When you leave a crew — or are removed from it — your position record in that crew is deleted immediately, while sharing continues normally with any other crew you are still in. When a crew ends or expires, the entire crew's location data is deleted. Battery level is deleted alongside it.
If your subscription ends and your plan allows fewer crews than you are in, we remove you from the oldest ones you joined and delete your position in them. We notify you when this happens.
Chat messages are stored in Firebase Realtime Database, scoped to the crew. Message contents are encrypted on your device before being sent, using AES-256-GCM, with the key derived from the crew's invite code and held only in memory.
Honest limitation: this is not end-to-end encryption in the strict sense — the crew's invite code (the key material) is also stored on our servers so people can join by code. Our automated systems never combine the two; the server-side function that sends chat notifications handles only the encrypted blob. Sender ID, display name, timestamp, and message type accompany the ciphertext unencrypted. Deleting a message replaces its content with a tombstone.
Walkie-talkie messages are recorded only while you hold push-to-talk, then compressed and uploaded to Firebase Storage under the crew's folder. Walkie-talkie audio is not encrypted the way chat text is — treat it as private-to-the-crew rather than cryptographically sealed. Clips remain available for the life of the crew and are deleted when the crew ends or expires. In a crew with no end date — possible on the highest paid tier — clips are instead deleted once they pass a fixed age, currently 7 days; the walkie-talkie screen shows the current window, and it is the same value the server enforces.
Leaving a crew does not withdraw what you already sent. Walkie-talkie clips and chat messages you posted stay with the crew for the rest of its life, so the conversation remains intelligible to the people still in it — the same as with most group messaging. They are deleted when the crew ends or expires, or sooner if you delete your account.
Ride Mode — destination search and routes. Available on the higher paid tiers. When a crew's organiser plans a ride, three things can leave the device. Searching for a destination sends the text they type, and their approximate position, to Google Places so it can suggest nearby places — the position only biases results toward where they are (roughly 50 km) and is not stored by us. Picking a suggestion sends that place's identifier to Google to retrieve its coordinates and name. Calculating the route sends the start and destination coordinates to Google Routes, once per ride, from the organiser's device only — members send nothing. Your device's language setting accompanies these requests so results come back in a language you can read.
Choosing a point on the map instead sends nothing to Google and involves no search. The organiser types their own label for it if they want one; we do not look up an address for a point you picked.
The chosen route — start and destination coordinates, the destination's name, and the line itself — is saved on the crew record and is therefore visible to every member of that crew. It is deleted when the ride ends, and with the crew when the crew ends or expires. We keep a small shared cache of place coordinates and names so the same well-known place is not looked up twice; it holds only the place's own details — no account identifier, no record of who searched for it, and no search text. Whether you personally joined or skipped a ride is remembered only on your phone and never sent to us.
Notifications — we store a push token per device to deliver chat, walkie-talkie, SOS, and safe-zone alerts via Firebase Cloud Messaging.
On-device settings — theme, map toggles, the walkie-talkie confirm-before-sending toggle, the chat send sound, whether you joined or skipped a ride, and local caches never leave your phone.
Analytics and crash reporting: none. No analytics SDK, no crash-reporting SDK, no advertising SDK, no tracking pixels. We do not build behavioural profiles.
Who else receives data
We do not sell your personal data or share it for advertising. Data is processed by:
| Provider | What it handles |
|---|---|
| Google Firebase | Accounts, profiles, crews, locations, chat, walkie-talkie audio, push delivery, server logic |
| Google Maps | Renders the map you see |
| Google Places | Suggests destinations as a ride organiser types, and returns the coordinates of the one they pick (Ride Mode only) |
| Google Routes | Calculates the route between the start and destination a ride organiser chooses (Ride Mode only) |
| Google Play Billing | All subscription purchases, renewals, and refunds |
| Google Play Integrity (via Firebase App Check) | Confirms requests come from the genuine app on a genuine device — a pass/fail token only, carrying no account identifier, location or content. Android only |
Your data is also shared, by design, with the other members of any crew you join — that is the purpose of the app. During a ride, they also see how far ahead of or behind them you are along the route. We may disclose data if required by law or to protect someone's safety.
Where data is stored
Google Cloud infrastructure, primarily the Southeast Asia (Singapore) region. Google may process data in other jurisdictions under its own international-transfer safeguards.
How long we keep data
| Data | Retention |
|---|---|
| Live location | Overwritten continuously; held once per crew you are in and shared with all of them at once; deleted on leaving that crew, and with the crew when it ends |
| Chat messages | Deleted when the crew ends or expires; leaving a crew does not remove what you already sent |
| Walkie-talkie recordings | Deleted when the crew ends or expires; in a crew with no end date, deleted once they pass a fixed age (currently 7 days). Leaving a crew does not remove what you already sent |
| Ride route (start, destination and its name, the line to follow) | Held on the crew record while the ride is on; cleared when the ride ends, and deleted with the crew |
| Cached place coordinates and names (no user identifier, no search text) | Kept so the same place is not looked up twice |
| Crew record, membership, invite code | Deleted when the crew ends or expires |
| Profile and account | Kept while your account exists — see Deleting your account below |
| Guest (anonymous) accounts | Deleted after 15 days of inactivity if not in any crew |
| Subscription records | Kept while the account exists, with one exception for refunded purchases (below) |
| Free-trial record (a one-way hash of your sign-in identifier, and the date) | Kept after the account is deleted, so one free trial cannot be claimed repeatedly (below) |
Crew cleanup runs automatically roughly every six hours. Crews on the highest paid tier can run without a fixed end date; their location and chat are kept while the crew is active, while walkie-talkie clips are deleted once they pass the fixed age above so audio does not accumulate indefinitely. If the subscription lapses, the crew is given a normal end date and cleaned up as usual.
Your rights and choices
Deleting your account
In the app: open Settings → Danger zone → Delete account. You will be shown exactly what will be removed and asked to type DELETE to confirm. Deletion is immediate and permanent — there is no undo.
If you cannot open the app: email lunkeybolt@gmail.com from the address on your account and we will delete it for you. We aim to action such requests within 30 days.
What deletion removes: your profile, display name, marker and settings; your live location; your membership of every crew; and, for crews you created, the whole crew — its locations, chat messages and walkie-talkie recordings — for all its members, because a crew cannot continue without its organiser.
Where that has a limit: in a crew you only joined, the chat and walkie-talkie messages you already sent stay in that crew after you delete your account, still carrying the sender ID and display name you used (not encrypted). We cannot remove them without destroying other people's conversation — they are deleted with the rest of the crew when it ends or expires. Ask the crew's organiser to end the crew sooner if needed.
One thing we keep, and why: if you have ever received a refund, we retain the opaque Google Play purchase token for that transaction so the same refunded purchase cannot be redeemed twice by deleting and recreating an account. On deletion we remove the account identifier from that record — it is no longer linked to you.
The other thing we keep: when your account is given its one free trial, we store a one-way hash (SHA-256) of the identifier your sign-in provider uses for you — for Google sign-in, the account id Google gives us, not your email address — together with the date. A one-way hash cannot be turned back into that identifier; it can only be compared against the same identifier presented again. This record is not deleted with your account, on purpose: it is the only thing that stops one free trial being claimed over and over by deleting the account and signing up again. It is not linked to your profile, is never used to identify you, contains no email address or name, and is used for nothing else. Signing in with a different account gives you a different hash, and we make no attempt to connect the two.
Your subscription is separate. Deleting your TrailSync account does not cancel a Google Play subscription — that belongs to your Google account, and we cannot cancel it on your behalf. Cancel it in Google Play, or Google will keep charging you. The app warns you about this before you confirm.
Without contacting us, you can also: leave a crew (position deleted immediately), revoke location or microphone permission in device settings, mute or disable notifications, delete your own chat messages, or uninstall the app.
Access, correction, portability, objection
You may request a copy of your data, correction, deletion, or restriction of processing, and object to processing, by writing to lunkeybolt@gmail.com. We may need to verify your identity first.
Legal bases (EEA/UK — GDPR)
Performance of a contract (accounts, crews, chat, subscriptions); consent (location and microphone access, revocable any time); legitimate interests (security and abuse prevention).
For users in India
We process personal data under the Digital Personal Data Protection Act, 2023. You may withdraw consent, seek correction or erasure, and nominate another person to exercise your rights in the event of death or incapacity, by writing to lunkeybolt@gmail.com.
Children
TrailSync is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided personal data to us, contact lunkeybolt@gmail.com and we will delete it. Because the app shares live location, a minor should use it only with a parent/guardian's knowledge and in a crew of people known to them.
Security
Data in transit is encrypted using TLS. Chat content is encrypted on-device before transmission (see its stated limitation above). Access requires Firebase authentication. Location, chat, and walkie-talkie data are deleted on crew end rather than accumulated. No system is perfectly secure.
Payments
Subscriptions are sold through Google Play Billing. We never receive your card number, bank details, or UPI ID — payment happens entirely inside Google Play. What reaches our servers is an opaque purchase reference used solely to confirm your subscription. Refunds and billing disputes are handled by Google Play under its own terms.
Permissions the app requests, and why
| Permission | Why |
|---|---|
| Location (precise + background) | Share your position with your crew — the core function |
| Microphone | Record push-to-talk walkie-talkie messages |
| Notifications | Chat, walkie-talkie, SOS, and safe-zone alerts |
| Foreground service | Keep tracking and walkie-talkie playback alive reliably on Android |
| Run at startup | Resume location sharing after a restart while a crew is active |
| Manage own calls | Deliver an incoming walkie-talkie message with call-like priority |
| Ignore battery optimisation (optional) | Stop the system from killing background tracking |
Every sensitive permission is requested at the point of use, and you can decline or revoke it. Declining location permission means the app cannot perform its main function.
Changes to this policy
If we change this policy we will update the "Last updated" date above, and give notice in the app for changes that materially affect how we handle your data.