Privacy policy
Last updated: 2026-11-01.
Who we are
AdventureOS is operated by Garrett Makes It, LLC (“we”, “us”), which decides how the personal data described here is used: in GDPR terms, the controller. This policy covers the AdventureOS web app and its API.
For privacy questions or to exercise any right below, write to privacy@adventureos.net.
What we collect
Account data — your email, display name, password hash (managed by Supabase Auth), avatar, optional bio, and public handle. If you are subject to our age gate, we also store your date of birth and the timestamp it was verified, plus the version and timestamp of the Terms of Service and Privacy Policy you accepted, kept as proof of consent and re-collected whenever we change either document.
Adventure data — anything you log: vehicles, gear, adventures, locations, service records, pets. You own this. We never sell it.
Social and community data — if you use the public profile, groups, marketplace listings, comments, published trip reports (your chosen route, gear, photos and pet names, and a consenting companion’s display name only), or follows, that content is visible to whoever the feature says it is visible to (for example, your profile-visibility setting).
Billing data — paid plans exist but checkout is not live yet; we have not enabled Stripe or any other payment processor in this deployment. Once it is live, subscribing will store your Stripe customer and subscription IDs and invoice records (amounts, dates, status). Your card details will go straight to Stripe and never touch our servers.
Connected-app data — if you link MuscleBuddy, we store the recovery and nutrition data it shares under the scopes you approved. If you instead grant MuscleBuddy read access to AdventureOS, we store which scopes you granted and when, never the access token MuscleBuddy uses, which is only ever kept as a one-way hash.
Credentials — if you add a certification (WFR/WFA, an avalanche level, a dive card, a pilot certificate, a medical, an inspection, and the like), we store its name, issuing body, identifier, and dates, plus a scanned card or other evidence file if you attach one. A credential is private by default; it appears on your public profile only if you explicitly mark it shared, and even then your profile-visibility setting still decides who can reach it.
Safety plans — if you file a safety plan on an adventure, we store the emergency contact you name: their name, email address, phone number, and how they relate to you. They have no account here, and we never match them to one. We also store the check-in times you commit to, when you checked in, and the notes you write for your contact, which may include health details, such as a medical condition, if you choose to write them. We first email your contact once, with your name and the adventure’s title, asking them to confirm they agree to be your emergency contact; until they do, we send them nothing else. If you miss a check-in and they have confirmed, we email your contact the adventure’s name, the missed check-in and your last one, your planned route including its waypoints’ coordinates, your notes, the phone number you gave for them, and the display names of the members who have accepted a place on the adventure. So if you accept a place on someone else’s adventure, your display name can appear in that email.
If someone named you as their emergency contact, write to privacy@adventureos.net to ask what we hold about you or to have your details removed from their plan.
Adventure invitations: if you invite someone to an adventure by email address because they have no account yet, we store that address, the role you offered and when you sent it, and we email that address an invitation through Resend carrying your name, the adventure’s title and a link to sign up, when you invite them and each time you resend it. Only you and the adventure’s organizers see the address. When someone signs in with that verified address, the invitation becomes an invite they can accept or decline, and the stored address is deleted.
If someone invited you to an adventure by email, write to privacy@adventureos.net to have that invitation removed.
Organization asset custody — if you belong to an organization that owns gear (a club trailer, radios, rental equipment), we store who currently holds each item, when they checked it out, when it is due back, and any condition notes recorded at handover.
Organization catalog and location claims — if an organization claims stewardship of a reference catalog entry or an official claim on a location, we store which organization made the claim, its review status, and any evidence it submitted in support.
Catalog link clicks — when you follow a merchant link from the gear catalog, a gear suggestion or an article while signed in, we record which link you followed, where it was shown, when, and your account. We use it to count how often each link is followed. It is in your export, and when you delete your account the record stays only as an anonymous count.
Operational data — error reports (sent to Sentry, described under Who we share with) and anonymous usage metrics (page views). If you accept the "Analytics" cookie category, Google Analytics (GA4) also collects this on our behalf; it never runs otherwise. If you accept the "Advertising" cookie category, Meta Pixel collects page views and device/browser details to measure our ad campaigns; it never runs otherwise, and neither runs while it is not configured for this deployment.
Campaign attribution — if you accept the "Analytics" cookie category before you sign up, we keep the campaign link that first brought you here (its utm_ tags or an ad click id, the site you came from by name only, and the page you landed on) and store it with your account when you sign up. Without that consent nothing is kept.
Bug reports and feedback — if you send one from the app, we store your report text, the page and module you were on, your viewport size, the app version, your browser’s user-agent string and a redacted sample of recent console messages. The copy in our issue tracker carries a reference number, not your name or account ID.
Push notifications — if you turn them on, we store your browser’s push subscription until you turn push off or delete your account, and each notification’s title, body and target page passes through the push service your browser uses (see Who we share with).
Testimonials — if you choose to send us a quote after a first session or a finished adventure, we store the quote, whether it is shown with your name or anonymously, the display name copied at that moment if you chose to be named, what prompted the quote, and when you gave it. The basis is your consent: an explicit tick on the form, without which the quote is not stored. Only platform staff can read it, and nothing is published from it automatically. You can withdraw it at any time, and it is deleted with your account. If we ever publish a quote, it will be only with the name choice you made, and we will say where here first.
Calendar feed — if you turn on the calendar feed in Settings, we give you one secret web address that a calendar app can subscribe to. Anyone who holds that address can read the feed, and the calendar service or app you give it to receives it. The feed lists the titles of your adventures and of group events, the names of gear due for inspection, and the names and expiry dates of your credentials, which can include a medical certificate. We store only a one-way hash of the address and when it was last fetched. Rotating the address stops the old one working at once, and turning the feed off removes it.
Invitations — if you accept the "Analytics" cookie category and then sign up within 30 days of opening another member’s shared adventure link, we record on your account which member shared it, so we can count how many people each member’s shared adventures bring in. That member is never told who you are. Without that consent nothing is kept, and the record is removed if that member deletes their account. It is in your export and is deleted with your account.
How we use it
To run the service: serve your data back to you when you sign in.
To improve the product: anonymous, aggregated usage trends inform what we build next.
To alert the emergency contact you name on a safety plan when you miss a check-in, as described above.
To contact you about your account: sign-up verification, password resets, and magic-link sign-in emails, sent by Supabase Auth, our identity provider, rather than by us directly.
Legal bases
Where a law such as the GDPR asks us to name the ground for each use of your data, these are ours:
Contract — running your account and the features you use: storing and showing your adventure data, your safety plans and their alerts, notifications you turned on, and the connections you make.
Consent — the Analytics and Advertising cookie categories, signing in with Google, and connecting MuscleBuddy. You can withdraw any of them at any time: change your cookie choices, or disconnect the connection, and processing that relied on it stops.
Legitimate interests — keeping the service secure and running: rate limits, bot protection, audit logs, error monitoring, and the list of email addresses that have refused our mail. Your emergency contact’s details are also processed on this ground, at your instruction, so we can reach them if you miss a check-in, and so is the email address of someone you invite to an adventure, so the invitation can find them when they sign up.
Legal obligation — the records we have to keep, such as billing records once billing is live.
How long we keep it
Retention windows, by category. Anything not listed here is kept for as long as your account exists and deleted when it does — see “Delete” under Your rights.
Account, adventure and social data — kept for as long as your account exists.
Offline cached API responses, used to replay a mutation you made while offline so it cannot double-execute — 30 days from when we cached them, swept daily.
Retried API requests — when an app you authorised with a personal access token sends a write with an Idempotency-Key, we keep that request’s response so a retry is answered from it instead of applied twice. Kept for 24 hours, swept daily.
Campaign attribution — 13 months from sign-up, swept daily, and deleted with your account if that comes first.
Demo accounts — on a deployment that offers the shared demo, everything entered on a demo account is reset to its starting state every 6 hours.
Rate-limit counters — to slow down credential stuffing and runaway clients we count requests per caller, keyed by IP address or account id. A counter is kept only until its window resets, swept daily.
Push delivery records — when we send you a push notification we note that it went out, only so the hourly check never sends the same alert twice. Kept for 7 days, swept hourly.
MuscleBuddy OAuth handshake state, the short-lived authorization codes and link requests either direction of the MuscleBuddy connection generates mid-flow — kept only until they expire, whether or not the flow ever completed, swept daily.
Billing records, meaning Stripe invoice history and webhook-processing records — kept indefinitely, for accounting and fraud-prevention obligations.
Audit logs — kept indefinitely, as the record of security-relevant account actions.
Audit records of actions taken on your account (a suspension, a role change) — kept indefinitely. When you delete your account, your account ID in them is replaced by a one-way keyed hash, the same one the account erasure record uses.
Deleted items you can still restore — gear, sessions, vehicles and other fleet, mods, service logs, collections, climb routes, hunt tags, credentials and pets you delete are kept for 30 days so you can undo the deletion, then removed for good, swept daily.
Account-deletion follow-up — when you delete your account, any external deletion still owed (your sign-in identity, your profile photo) is retried hourly for up to 30 days, then reported to us and dropped.
Your Terms of Service and Privacy Policy acceptance history — every version you accepted and when, kept for as long as your account exists so we can show what you agreed to, and deleted with it.
Cookie-banner decisions — kept indefinitely as the record that a decision was made under a given policy version. When you delete your account, the link to you is removed and the decision stays as an anonymous record.
Account erasure records — when you delete your account, we keep a record that an erasure happened: a one-way keyed hash of the former account id (not the id, your email or your name), the reason, the date, and whether a connected-app link was revoked. It lets us answer a later complaint or a connected app’s question about an account that no longer exists, and it cannot be linked back to you by anyone who does not already hold the former id. Kept for 7 years from the erasure, swept daily.
Adventure invitations sent to an email address: deleted as soon as someone signs in with that address, and otherwise 14 days after the invitation was last sent, swept daily.
Adventure safety plan emergency-contact details: the name, email, phone and relationship of the person you named, and your link to their consent, are cleared 30 days after the adventure was last changed once it is completed, archived or cancelled, swept daily. Your check-in windows stay with the adventure.
Email delivery records — when a mail server permanently rejects a message we sent, or someone marks one as spam, we record the address so we stop mailing it. The address stays on that list for as long as it is the right answer; the individual delivery events behind it are deleted after 90 days. Continuing to mail an address that no longer accepts mail is what gets a sending domain throttled, and then nobody’s password-reset email arrives.
Connected recovery and nutrition data from MuscleBuddy — kept for as long as the connection is active, and deleted immediately when you disconnect it.
Bug reports and feedback — kept for as long as your account exists, and deleted with it. The copy in our issue tracker carries a reference number for the report, not your name or account ID; when you delete your account we also remove the submitter line from that copy, retrying for up to 30 days if the tracker is unreachable.
The crons that enforce the swept windows above are recorded in this repository’s data retention register, apps/server/src/lib/retention-register.ts, which is checked in CI to name every job that bulk-deletes data.
Children’s privacy
AdventureOS is not directed to children, and we do not knowingly collect personal information from anyone under 13. Sign-up requires a date of birth. If you sign up with an email address, an account that fails that age check is never created. If you sign up with Google, an account exists before we ask your date of birth; if the date you give shows you are under 13, we delete that account and everything you gave us immediately, and this device will not offer sign-up again for a day. If we learn that we have collected information from a child under 13, we will delete it. If you believe a child under 13 has an account or has otherwise provided us information, email privacy@adventureos.net and we will investigate and remove it.
Members aged 13 to 17 start with a private profile: they do not appear in member search, suggestions or leaderboards, and their profile page is hidden from other members until they choose otherwise in Settings. Adults start public. The date of birth is used for these two decisions, and to keep advertising tags off a browser where a date under 18 was entered (the Cookie Policy describes this under “Advertising exclusion”). It is used for nothing else.
Demo accounts
Some deployments offer a shared demo account so you can try AdventureOS without signing up. Everything you enter while using it is visible to anyone else using the demo, is not linked to you, and is reset regularly. Do not enter personal information there. The demo is not available in this deployment.
Your rights
Access — your adventure data is visible throughout the app wherever you logged it: vehicles and gear in your library, sessions and adventures in each module.
Export — download a complete, machine-readable copy of your account from Settings → Privacy & data while signed in.
Delete — erase your account from Settings → Privacy & data while signed in. Deletion removes your profile, adventure data, connected-app grants and sign-in identity immediately; it is not reversible and there is no grace period. Content other members are reading — comments, articles, marketplace listings, group events — stays up credited to “Deleted user” rather than being removed from their threads.
Correct — edit your name, handle, avatar, bio and profile visibility from Settings → Profile. For anything else that is wrong, email privacy@adventureos.net.
Object, restrict, or withdraw consent — ask us to stop or limit a use of your data, or withdraw a consent you gave (see Legal bases), by emailing privacy@adventureos.net.
Depending on where you live, for example the EEA or the UK under the GDPR, or California under the CCPA/CPRA, you may have further rights, including the right to complain to your local data-protection authority. We respond to every request within the time the law that applies to you allows.
Washington consumer health data
Some of what AdventureOS holds is “consumer health data” under Washington’s My Health My Data Act (RCW 19.373). This section is our Consumer Health Data Privacy Policy under that Act, and we apply it to every member, wherever you live. AdventureOS is not a healthcare provider or health plan, so HIPAA does not apply.
What we collect, where it comes from, and what we use it for:
Recovery and nutrition data from MuscleBuddy — the readiness snapshots and daily nutrition targets MuscleBuddy shares when you connect it and approve those scopes. We use them only to show them to you, beside your adventure itinerary and route plans. Nothing in AdventureOS acts on them or blocks anything you do because of them.
Medical certificates — a credential you add can be a medical (an aviation medical, for example), with its dates, identifier, and a link to any evidence you attach. We use it to keep your own record and to remind you before it expires, in the app, by push notification if you turned push on (the push service your browser uses relays the credential’s name), and in your calendar feed if you turned that on (the calendar service you give the feed address to receives it).
Health details in safety-plan notes — anything about your health you choose to write in the notes on a safety plan. We use it only to include in the alert email to the emergency contact you name, if you miss a check-in.
Consent. Connecting MuscleBuddy is your consent to collect your recovery and nutrition data; disconnecting withdraws it. A credential and a safety-plan note are things you enter yourself, and you can change or delete them at any time.
Sharing. We share consumer health data only where you direct it. Your MuscleBuddy recovery and nutrition data is shown to nobody but you. A credential appears on your public profile only if you mark it shared, and then only its name, issuer, and dates, never its identifier, evidence, or notes. Safety-plan notes go to the emergency contact you name, by email through Resend, when you miss a check-in; filing the plan with their email address is your instruction to send it. If you turned on push notifications or the calendar feed, a credential’s name and date reach the push service or calendar service you chose. Our hosting providers, Supabase and Railway, store and process this data on our behalf.
We do not sell consumer health data, and we do not use geofencing around health facilities. Our analytics and advertising tags, Google Analytics and Meta Pixel, never receive it: they see page views, never the content of these records.
Your rights. You can confirm whether we hold your consumer health data and get a copy (the export in Settings → Privacy & data includes it). You can withdraw consent and have it deleted: disconnecting MuscleBuddy deletes the recovery and nutrition data it shared immediately; deleting a safety plan deletes it immediately; a deleted credential can be restored for 30 days and is then erased; and deleting your account deletes all of it. For anything else, or to appeal a request we have refused, email privacy@adventureos.net; we respond within 45 days.
Security
Every connection to AdventureOS is encrypted in transit. Passwords are stored only as salted hashes by Supabase Auth. Access tokens we issue are stored only as one-way digests, and the tokens we hold for a connected app are encrypted. Database access is restricted per account. No system is perfectly secure, so we cannot promise absolute security; keep your own credentials private.
If you find a security vulnerability, report it to security@adventureos.net rather than disclosing it publicly. This is also published at /.well-known/security.txt.
International transfers
AdventureOS is operated from the United States, and the providers listed under Who we share with process data in the United States and in other countries where they operate. If you use AdventureOS from outside the United States, your data is transferred to those countries, whose data-protection laws may differ from yours.
Changes to this policy
When we change this policy, the Last updated date at the top moves. When a change is material — a new category of data, a new recipient, a new use, or a narrowing of your rights — we ask you to read and accept the new version the next time you use AdventureOS, before you can continue.
Contact
Privacy questions: Garrett Makes It, LLC, at privacy@adventureos.net.