Privacy Policy

What we collect

• Account details. When you sign in with Google we receive your email address, name and profile picture link. We use them to identify your account and show your initials in the app. If you get Plus, we also pass your email address to Stripe.
• Photos you upload. Your browser makes resized copies of each photo before upload and we store only those copies, not your original files. The copies don't carry the original file's embedded metadata.
• Photo details. For each photo we store the date and time it was taken, its location, the country and nearest town, the camera model and the original file name. Most of this comes from the photo's metadata. You can also set or change the location yourself.
• Sharing settings. If you turn on a public link, we store its settings: the name you show, the trips you hide, the cover photo and the preview image we make from it.
• Subscription details. If you get Plus, we store your Stripe customer and subscription IDs, your plan, its status and renewal date. Card details go straight to Stripe. We never see or store them.
• Technical data. Our hosting provider processes IP addresses and request details to deliver the site and keep it secure. We keep short-lived logs for fixing errors. We also store the language you choose in a cookie.

How we use it

We use your data only to run Trailroll:

• to place your photos on the map, group them into trips and show them to you;
• to show your shared map to people who have its link, with the settings you chose;
• to manage your plan and subscription;
• to keep the service secure, prevent abuse and fix problems;
• to reply when you contact us.

We don't sell your data, show ads or use your photos to train AI models. We don't use analytics or tracking tools.

Legal bases

Under UK GDPR, we process your data to provide the service you signed up for (performance of a contract). Security, abuse prevention and fixing errors rely on our legitimate interests in keeping Trailroll working safely. We keep billing records where the law requires it (legal obligation).

Who else processes your data

We use a small number of providers, each only for its part of the service:

• Supabase hosts the database with your account and photo details, in Frankfurt, Germany.
• Cloudflare hosts the website and stores your photo copies in its EU storage region.
• Google handles sign-in when you choose Continue with Google.
• Stripe processes payments for Plus. Plus is sold through Stripe Managed Payments, so Stripe and its Link service handle your payment details, receipts and sales tax under their own privacy policies.
• OpenFreeMap serves the map. Your browser loads map images from it directly, so it receives your IP address, but not your photos.
• Photon by Komoot finds places when you search for a location by name. We send it only the text you type, from our server.

Some providers may process data outside the UK and the EEA, for example in the United States. Where they do, they rely on safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum or the UK-US data bridge.

Shared maps

Your map is private until you turn on a public link. Anyone with the link, or on a website where you embedded your map, can then see the trips and photos you didn't hide, and could save or pass them on. By default a shared map shows approximate locations rather than exact ones, and never shows camera models or file names. You can hide dates, remove trips or turn the link off at any time. Shared maps are marked so search engines don't list them.

Cookies

We use only the cookies needed to keep you signed in and remember your language. They aren't used for tracking, so we don't ask for cookie consent.

How long we keep it

We keep your photos and their details until you delete them or your account. A deleted photo is removed from the map and storage straight away. When you ask us to delete your account, we delete your photos, account and share settings within 30 days. Copies in backups are overwritten within a further 30 days. Stripe keeps payment records as the law requires.

Your rights

You can ask us for a copy of your data, to correct it, to delete it or to send it to you in a portable format. You can also object to or ask us to restrict how we use it. Email support@trailroll.app from the address you sign in with and we'll reply within one month.

If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk or to the data protection authority where you live.

Children

Trailroll isn't meant for children under 13, and we don't knowingly collect their data.

Changes

If we change this policy, we'll update the date at the top. If a change matters for how we use your data, we'll tell you in the app or by email before it takes effect. See also our Terms of Service.

Contact

ED&EU LTD, 220 Elizabeth Drive, Bathgate, EH48 1HU, United Kingdom. Email: support@trailroll.app