Privacy

Draft — to be reviewed before launch.

What we collect

• Your email address, to sign you in, confirm your account, send password reset links and the emails you choose to get. Nobody else can see it. Your password is stored only as a one-way hash by Supabase; nobody, including us, can read it.
• Your display name, which is public.
• Whatever you add to your profile: a photo, home town, blurb, activities, fill-in-the-blanks and adventure goals. Organizers of groups you're in or have asked to join can see it; if you are a page admin or page manager of a listed group, anyone can; other members of your groups can only if you choose to share it. Any section you hide is seen by you only. Photos are re-encoded, with location and camera details removed.
• What you do on the board: groups you join, events you RSVP to, posts you write, reports you send.

What we don't do

• No advertising, and we never sell or share your data.
• No analytics or tracking scripts. The only cookie is the one that keeps you signed in.
• No phone number, birth date or location tracking.

Who can see what

Group pages and events are public. Member lists, who's going to an event, members-only addresses and discussion boards are visible only to that group's members. These rules are enforced by the database itself.

Deleting your account

You can delete your account from your profile page. Your profile, memberships and RSVPs are removed straight away and your sign-in record within 24 hours. Posts you wrote stay, marked “deleted user”.

Where data lives

Data is stored with Supabase (database and sign-in) and the site runs on Railway. Emails are sent through Resend.