Privacy Policy

Northbay Labs, Inc. (“we”, “us”) is the developer of Trailmark and is the data controller for the personal data described in this policy. We are registered in the United States.

This policy covers the App and https://example.com. It does not cover third-party services you choose to connect to the App, which are governed by their own policies.

The categories below use the same names Apple uses in the App Store’s privacy labels, so you can compare this policy against the App’s listing on the App Store directly.

What we never collect: we do not collect your payment card details (Apple handles all in-app purchases), your contacts, your health data, your browsing history outside the App, or your precise background location.

Apple groups data into three treatments on the App Store product page. This is how our disclosures map onto them:

We use personal data only for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each purpose is given in the final column.

We do not use your personal data to train machine learning models, and we do not make decisions about you by automated means that produce legal or similarly significant effects.

iOS asks for your permission before the App can use any of the following. Every one of them is optional, you can change your answer at any time in iOS Settings → Trailmark, and declining does not stop the rest of the App from working.

We use a small number of service providers to run the App. Each one is contractually bound to process data only on our instructions, to protect it to the standard described in this policy, and not to use it for their own purposes. We do not permit them to sell it.

Each of these SDKs publishes a privacy manifest describing the data it collects, and those manifests are included in the App’s privacy report as required by Apple.

“Tracking” means linking data collected in this App with data from other companies’ apps, websites or offline properties for advertising or advertising measurement, or sharing it with a data broker.

Trailmark does not track you and does not display third-party advertising. We do not access the Identifier for Advertisers (IDFA) and we do not share your data with data brokers.

We do not sell your personal information, and we never have. We share it only in these situations:

• Service providers — the processors listed in section 7, acting only on our instructions.
• At your direction — when you explicitly share content or connect the App to another service.
• Legal requirement — where we are compelled by valid legal process. We review every request, reject overbroad ones, and notify you unless we are legally prohibited from doing so.
• Safety — where disclosure is necessary to prevent imminent harm or to investigate fraud or abuse of the App.
• Business transfer — if the App or our company is acquired, data may transfer to the acquirer under this policy. We will tell you before your data becomes subject to a different policy, and you will be able to delete your account first.

You can delete your account and its data from inside the App, without contacting us and without visiting a website:

1. 1.Open Trailmark
2. 2.Go to Settings → Account
3. 3.Tap Delete Account and confirm

Your account is deactivated immediately and your personal data is permanently erased from our live systems within 30 days, and from encrypted backups within 35 days. We retain only what the law requires us to keep — principally purchase records for tax purposes — and anonymised statistics that cannot identify you.

If you cannot access the App, email privacy@example.com from your registered address and we will complete the deletion for you.

Cancelling a subscription is separate. Subscriptions are billed by Apple and must be cancelled in iOS Settings → your name → Subscriptions. Deleting your account does not automatically cancel an active subscription.

Wherever you live, you can ask us to:

• Access a copy of the personal data we hold about you
• Correct data that is wrong or incomplete
• Delete your data — see section 11
• Export your data in a portable, machine-readable format
• Restrict or object to a particular use of your data
• Withdraw consent at any time, where we relied on consent

Email privacy@example.com and we will respond within 30 days. We will not charge you, and we will never treat you differently for exercising a privacy right.

If you are in the EEA or the UK and you believe we have not handled your data properly, you may complain to your local supervisory authority. We would appreciate the chance to resolve it first.

If you live in California, Colorado, Connecticut, Virginia or another state with a comprehensive privacy law, you have the rights listed above, plus the right to opt out of the sale or sharing of your personal information and of profiling for targeted advertising.

We do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we do not engage in targeted advertising — so there is nothing to opt out of. If that changes we will publish a “Do Not Sell or Share My Personal Information” link here before it takes effect.

You may designate an authorised agent to make a request for you. We will verify your identity by confirming control of the email address registered to your account.

The App is rated 4+ and is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, email privacy@example.com and we will delete it promptly.

• All traffic between the App and our servers is encrypted with TLS 1.2 or higher.
• Data at rest is encrypted on our servers, and credentials are stored in the iOS Keychain on your device.
• Passwords are stored only as salted hashes; nobody at Northbay Labs, Inc. can read them.
• Access to production data is limited to staff who need it, protected by multi-factor authentication and logged.
• We review our dependencies and infrastructure regularly for known vulnerabilities.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant regulator without undue delay and, where required, within 72 hours.

We are based in the United States and our servers are located in the United States. If you use the App from elsewhere, your data will be transferred to and processed there.

For transfers out of the EEA or the UK we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), together with technical measures including encryption in transit and at rest. You can request a copy of the safeguards we use by emailing privacy@example.com.

We update this policy when the App changes. When we do, we revise the “Last updated” date at the top and keep the previous version available on request.

If a change materially affects how we use your data, we will notify you in the App or by email before it takes effect, and where the law requires it we will ask for your consent.