Privacy Policy

1. Introduction

Welcome to Traileasy. We are committed to protecting your personal data and your right to privacy. This Privacy Policy explains how we collect, use, share, and protect your information when you use our hiking trail planning service at traileasy.com.

2. Data We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Password (securely hashed — we do not store or can ever see your plain-text password)
• A unique user identifier
• Authentication timestamps (when your account was created, last sign-in)

If you sign in with Google, Google shares your email address and basic profile information with us as part of the OAuth authentication flow.

2.2 Itinerary & Trip Planning Data

When you use the service, we store the content you create:

• Itinerary names and descriptions
• Day-by-day plans including start/end locations, accommodation selections, and notes
• Calculated hiking routes with distance, duration, and elevation data
• Booking status for accommodations
• Reviews you write after a trip: your ratings, your notes, the name you choose to show and your pacing answers (how the pace felt and which days were hard), how the trail compared with what you expected, how far ahead you booked a stay, plus the optional "About your hike" answers (who you hiked with, your experience and your fitness)

2.3 Collaboration Data

When you share an itinerary or invite collaborators:

• Email addresses of people you invite
• Collaboration roles (editor or viewer)
• Invitation tokens (stored securely as hashes)

2.4 Feedback & Requests

When you submit feedback or a trail request:

• Your feedback text or trail request details
• Your email address (if you voluntarily provide it)
• The page URL and your browser's user agent string (collected automatically)

2.5 Usage & Analytics Data

We collect information about how you interact with the service:

• Pages visited and features used (e.g., creating itineraries, downloading GPX files, selecting accommodations)
• Searches in the website's trail picker that match no trail: the words typed, so we know which trails to add next. Searches that look like an email address or phone number are not recorded
• Device type, browser information, and screen size
• Anonymous session identifiers, linked to your account when you sign in
• Session replays: a reconstruction of your interactions with the web app (clicks, scrolling and navigation), recorded for a sample of sessions and used to diagnose usability problems

2.6 Technical & Security Data

• Error messages and technical diagnostic information when something goes wrong
• Your IP address (used temporarily for rate limiting and abuse prevention)

2.7 Local Storage

We store the following in your browser's local storage (not transmitted to third parties):

• Your language preference
• Temporary session data (e.g. OAuth return URL) — cleared after use

3. How We Use Your Data

We process your personal data based on the following legal grounds under GDPR Article 6:

4. Third-Party Services

We use the following third-party services to operate Traileasy. Each service receives only the data necessary for its function:

5. Data Sharing & Public Features

• Share links: When you share an itinerary via its share link, anyone with the link can view it in read-only mode. The link contains a randomly generated token — your personal information is not exposed in the URL.
• Collaboration: When you invite someone to collaborate, their email address is stored and an invitation is sent via email.
• Example itineraries: Pre-made example itineraries are publicly visible and contain no personal data.
• Reviews: A review you publish is public on Traileasy's website, in the planner and in the app, under the name you chose, or as "Anonymous hiker" when you post anonymously. It shows your ratings, your notes and the month you hiked, and for a stay also the nights you stayed and how far ahead you booked. On the website, your notes can show translated into the page's language, with your original text available. Your "About your hike" answers (who you hiked with, your experience and your fitness) only help match your review to hikers planning a similar trip and are never shown publicly. Stay ratings you give in the app during your trip, and a star you tap in a review email, count without your name in that stay's hiker rating, even before you post a review.
• GPX export: You can download your routes as GPX files. These contain route coordinates and waypoint names only.

We do not sell your personal data to third parties.

6. Data Retention

• Account data: Retained until you delete your account.
• Itinerary data: Retained until you delete it or delete your account. A deleted itinerary is kept for 14 days so it can be restored on request, then permanently removed.
• Collaboration invitations: Expire after 7 days. Records are retained for security audit purposes.
• Feedback & trail requests: Retained indefinitely to help us improve the service.
• Analytics data: Usage analytics are stored on Traileasy's own infrastructure in the EU. Session replays are retained according to PostHog's retention policy, and web analytics according to Google Analytics' policy.
• Error logs: Retained according to Sentry's data retention policy.
• Rate limiting data: Temporarily stored for a sliding window of minutes.

7. Your Rights Under GDPR

As an individual in the European Union, you have the following rights regarding your personal data:

• Right of access (Art. 15) — Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — Request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18) — Request that we limit how we process your data.
• Right to data portability (Art. 20) — Receive your data in a structured, commonly used format.
• Right to object (Art. 21) — Object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — Withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint — File a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by GDPR.

8. International Data Transfers

Some of our third-party service providers process data outside the European Economic Area (EEA), specifically Google services (Analytics, OAuth, Firebase), Resend and Anthropic in the United States. These transfers are protected by:

• The EU-US Data Privacy Framework (for certified US companies)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where available

9. Cookies & Local Storage

We do not use traditional HTTP cookies for our own tracking purposes. We use browser local storage for functional purposes only:

• Language preference — to remember your selected language across visits.
• Authentication tokens — to keep you signed in during your session.
• Temporary session data — cleared after use (e.g., pending actions during signup flow).

Third-party analytics services (PostHog, Google Analytics) may use their own cookies or local storage mechanisms for session tracking. Please refer to their respective privacy policies for details.

10. Children's Privacy

Traileasy is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically to stay informed about how we protect your data.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: