Skip to main content

Privacy policy

Last updated: 2026-08-19.

What we collect

Account data — your email, display name, password hash (managed by Supabase Auth), avatar, optional bio, and public handle. If you are subject to our age gate, we also store your date of birth and the timestamp it was verified, plus the version and timestamp of the Terms of Service and Privacy Policy you accepted, kept as proof of consent and re-collected whenever we change either document.

Adventure data — anything you log: vehicles, gear, adventures, locations, service records, pets. You own this. We never sell it.

Social and community data — if you use the public profile, groups, marketplace listings, comments, or follows, that content is visible to whoever the feature says it is visible to (for example, your profile-visibility setting).

Billing data — paid plans exist but checkout is not live yet; we have not enabled Stripe or any other payment processor in this deployment. Once it is live, subscribing will store your Stripe customer and subscription IDs and invoice records (amounts, dates, status). Your card details will go straight to Stripe and never touch our servers.

Connected-app data — if you link MuscleBuddy, we store the recovery and nutrition data it shares under the scopes you approved. If you instead grant MuscleBuddy read access to AdventureOS, we store which scopes you granted and when, never the access token MuscleBuddy uses, which is only ever kept as a one-way hash.

Credentials — if you add a certification (WFR/WFA, an avalanche level, a dive card, a pilot certificate, a medical, an inspection, and the like), we store its name, issuing body, identifier, and dates, plus a scanned card or other evidence file if you attach one. A credential is private by default; it appears on your public profile only if you explicitly mark it shared, and even then your profile-visibility setting still decides who can reach it.

Organization asset custody — if you belong to an organization that owns gear (a club trailer, radios, rental equipment), we store who currently holds each item, when they checked it out, when it is due back, and any condition notes recorded at handover.

Organization catalog and location claims — if an organization claims stewardship of a reference catalog entry or an official claim on a location, we store which organization made the claim, its review status, and any evidence it submitted in support.

Operational data — error logs and anonymous usage metrics (page views). If you accept the "Analytics" cookie category, Google Analytics (GA4) also collects this on our behalf; it never runs otherwise. If you accept the "Advertising" cookie category, Meta Pixel collects page views and device/browser details to measure our ad campaigns; it never runs otherwise, and neither runs while it is not configured for this deployment.

How we use it

To run the service: serve your data back to you when you sign in.

To improve the product: anonymous, aggregated usage trends inform what we build next.

To contact you about your account: sign-up verification, password resets, and magic-link sign-in emails, sent by Supabase Auth, our identity provider, rather than by us directly.

Who we share with

This list is illustrative of the kinds of parties we share with, not a closed enumeration — any provider we add gets added here before it goes live. Today it includes:

Supabase — database, authentication, file storage. They do not access your data except as needed to provide the service.

Vercel — hosts the web app.

Railway — hosts the API server.

Stripe — will process payments for paid plans once checkout goes live. We have not enabled Stripe or any other payment processor in this deployment; when we do, we will never see or store your card details.

Google — if you sign in with Google OAuth, your account ID is shared with us by Google; we share nothing back. Separately, if you enable push notifications, Google Firebase Cloud Messaging relays the notification (its title, body, and target page) to your browser on our behalf.

Google Analytics (GA4) — only if you accept the "Analytics" category in the cookie banner, and only while a GA4 property is configured for this deployment. When active, it receives the pages you view, an IP-derived, coarse location, and technical details about your browser and device, used in aggregate to understand which pages and features get used. Rejecting, or never being asked because it is not yet configured, means it collects nothing about you.

Meta Pixel — only if you accept the "Advertising" category in the cookie banner, and only while a Meta Pixel is configured for this deployment. When active, it receives the pages you view and technical details about your browser and device, used to measure and improve our ad campaigns on Facebook and Instagram. Rejecting, or never being asked because it is not yet configured, means it collects nothing about you.

Resend — delivers transactional email we send directly, such as billing receipts and account-deletion confirmations. This is separate from the account emails Supabase sends on our behalf (verification, magic-link, password reset).

MuscleBuddy — only if you connect it, and only the scopes you approve in each direction. Disconnecting stops all future sharing; it has no effect on data already exchanged before you disconnected.

Sentry — error monitoring. When enabled, crash reports from your browser or our server, including a sample of performance traces, are sent to Sentry for diagnosis. Not currently active in this deployment.

GitHub — if you submit an in-app bug report, its description and technical context (page, module, severity, your display name and account ID, viewport, app version, browser user agent) are mirrored into our issue tracker for triage. Your browser’s recent console output is never included in that mirror; it stays in our database only.

Cloudflare — bot protection (Turnstile) on the sign-in, sign-up, magic-link and password-reset pages. Cloudflare receives your IP address and the browser signals needed to score the challenge.

Open-Meteo — weather and elevation lookups. We send the coordinates of places you or your followed locations reference, including an hourly scan of places you follow for severe-weather alerts, to get back conditions and elevation. Open-Meteo requires no account or API key and receives no other account data.

NHTSA (U.S. Department of Transportation) — if you decode a vehicle by VIN in the OffRoad module, the VIN is sent to NHTSA’s public vPIC API to look up year, make, model, and other specs.

OpenStreetMap Foundation — location maps are rendered from OSMF’s map tile servers, which receive your IP address and the map area you are viewing.

OpenBeta — nothing about you. Our server reads OpenBeta’s public, openly licensed climbing route catalog on a schedule to populate route listings. The requests carry no account data, and nothing you enter is sent to OpenBeta.

National Avalanche Center — nothing about you. If you log a backcountry, sidecountry, or touring Snow session near a US forecast zone, we look up that zone’s public avalanche danger rating on your behalf. The request carries only the location’s coordinates, no account data, and the Center receives nothing you enter.

Spypoint — if you connect a Spypoint trail camera in the Hunt module, your Spypoint account credentials authenticate a sync that pulls your camera photos and metadata into AdventureOS. Spypoint receives only what its own sync API requires to authenticate and fetch that data; disconnecting stops future syncs.

Aviation Weather Center (National Weather Service) — nothing about you. If you look up a METAR/TAF weather briefing in the Sky module, we request the current conditions for the airport identifier you entered on your behalf. The request carries no account data, and the Center receives nothing you enter beyond that identifier.

We do not sell, rent, or share your data with any party other than those listed above.

How long we keep it

Retention windows, by category. Anything not listed here is kept for as long as your account exists and deleted when it does — see “Delete” under Your rights.

Account, adventure and social data — kept for as long as your account exists.

Offline cached API responses, used to replay a mutation you made while offline so it cannot double-execute — 30 days from when we cached them, swept daily.

MuscleBuddy OAuth handshake state, the short-lived authorization codes and link requests either direction of the MuscleBuddy connection generates mid-flow — kept only until they expire, whether or not the flow ever completed, swept daily.

Billing records, meaning Stripe invoice history and webhook-processing records — kept indefinitely, for accounting and fraud-prevention obligations.

Audit logs — kept indefinitely, as the record of security-relevant account actions.

Connected recovery and nutrition data from MuscleBuddy — kept for as long as the connection is active, and deleted immediately when you disconnect it.

The crons that enforce the swept windows above are recorded in this repository’s data retention register, apps/server/src/lib/retention-register.ts, which is checked in CI to name every job that bulk-deletes data.

Children’s privacy

AdventureOS is not directed to children, and we do not knowingly collect personal information from anyone under 13. Sign-up requires a date of birth, and an account that fails that age check is blocked outright rather than created and restricted. If we learn that we have collected information from a child under 13, we will delete it. If you believe a child under 13 has an account or has otherwise provided us information, email privacy@adventureos.net and we will investigate and remove it.

Your rights

Access — your adventure data is visible throughout the app wherever you logged it: vehicles and gear in your library, sessions and adventures in each module.

Export — download a complete, machine-readable copy of your account from Settings → Privacy & data while signed in.

Delete — erase your account from Settings → Privacy & data while signed in. Deletion removes your profile, adventure data, connected-app grants and sign-in identity immediately; it is not reversible and there is no grace period. Content other members are reading — comments, articles, marketplace listings, group events — stays up credited to “Deleted user” rather than being removed from their threads.

Correct — edit your name, handle, avatar, bio and profile visibility from Settings → Profile. For anything else that is wrong, email privacy@adventureos.net.

Cookies

AdventureOS sets what it needs to sign you in and remember your preferences, and runs Google Analytics (GA4) only if you accept the "Analytics" category and Meta Pixel only if you accept the "Advertising" category — both off by default, and off for good once you reject them or send a Global Privacy Control signal. The Cookie Policy at /cookies is the full account, and you can change your choices there or from the Cookie preferences link in the footer.

Contact

Privacy questions: privacy@adventureos.net.