Privacy Policy

1. Who controls your information

HandTrail is operated by Scott Savage.

For purposes of applicable privacy and data protection laws, Scott Savage, operating HandTrail, is the controller of personal information processed through HandTrail unless otherwise stated.

Privacy, data-rights and support requests may be sent to:

scottieapp90@gmail.com

2. About this policy

This Privacy Policy explains how HandTrail collects, uses, stores, shares and protects information when you use the HandTrail mobile application and related services.

HandTrail is a social game in which virtual objects move between players and build an ongoing journey history.

3. Information you provide

When you create and use a HandTrail account, we may collect information you provide, including:

• your email address and authentication information;
• your display name and HandTrail username;
• profile information you choose to maintain;
• messages you send through HandTrail's object chat;
• safety reports, report reasons and report details you submit;
• account and gameplay preferences, such as distance units and Discover visibility settings.

Authentication credentials are handled through HandTrail's authentication infrastructure. HandTrail does not need to display your password in order to operate the service.

4. Gameplay and journey information

HandTrail records information needed to operate the game and preserve object journeys. This may include:

• objects you currently hold or previously held;
• handoffs, drops, claims and Rescues;
• object journey history;
• approximate journey locations;
• timestamps and movement distance;
• Pass Score and Pass Timer information;
• Trail XP, levels, achievements, accomplishments, streaks and other gameplay progression;
• Chain participation and progress;
• safety and anti-abuse information associated with gameplay actions.

An object's journey is intended to remain part of HandTrail even as individual players join, leave or delete their accounts.

5. Location information

HandTrail uses device GPS location because physical proximity and real-world movement are core parts of the game.

HandTrail requests foreground location when you actively use a feature that requires it. HandTrail is not designed to continuously collect your location in the background.

HandTrail currently relies on device-provided GPS location for these gameplay features. It does not use IP-address geolocation as a substitute for proximity verification.

Nearby handoffs

During a verified Nearby Pass, both players submit fresh foreground GPS coordinates and device-reported accuracy so HandTrail can determine whether they are physically close enough to complete the transfer.

These precise verification coordinates are stored temporarily in the active handoff session. For a successfully completed handoff, the precise sender and receiver coordinates are cleared when the handoff completes.

Permanent handoff history stores an approximate midpoint derived from the handoff rather than the two players' precise verification coordinates.

Discover

When you choose to use your current location for Discover, HandTrail collects your foreground GPS coordinates and device-reported accuracy.

Before the location is stored for Discover, HandTrail rounds the coordinates server-side to a coarser geographic area. The stored Discover location is not directly exposed to other players.

Other players receive coarse distance bands rather than your stored coordinates or precise GPS location.

A stored Discover location is considered usable for nearby discovery only while it is sufficiently recent. HandTrail currently excludes Discover locations older than 24 hours from discovery results.

Rescue, drops and claims

HandTrail collects fresh foreground GPS coordinates and location accuracy when you search for or claim a Rescue-eligible object, create certain Drop-Offs, or claim a location-based object.

This information is sent to HandTrail's backend so server-side rules can verify distance, eligibility, claim radius and physical proximity.

Trail Finder

Trail Finder collects fresh foreground GPS coordinates and accuracy while you actively request guidance toward an eligible object or drop.

The location is used server-side to calculate approximate direction, distance and proximity. Trail Finder is designed not to reveal a hidden target's precise coordinates, exact bearing or exact raw distance to another player.

LocationIQ

HandTrail uses LocationIQ for city search, reverse geocoding of approximate journey geography and optional nearby landmark information.

Some reverse-geocoding requests intentionally reduce coordinate precision before the coordinates are sent to LocationIQ. LocationIQ is not used to perform HandTrail's player-to-player proximity verification.

6. Approximate journey geography

HandTrail may preserve approximate coordinates and geographic labels such as city, region and country as part of an object's permanent journey.

These records support features such as object history, Trail Footprint, distance calculations, Chain progression and geographic accomplishments.

Public-facing journey experiences are designed around approximate geography rather than exposing a player's home or raw device coordinates.

7. Chat, blocking and safety reports

HandTrail provides object-related communication features so players can coordinate gameplay.

We may store:

• chat requests and messages;
• conversation status and read state;
• archived conversation state;
• player blocks;
• safety reports and related report information.

Blocking is used to prevent certain future interactions between players. Reports may be retained as needed for safety, abuse prevention, moderation and service integrity.

8. Notifications

HandTrail may request notification permission to provide gameplay reminders.

HandTrail currently uses device-scheduled notifications for Pass Timer reminders. These may include the object's name, object identifier and reminder stage needed to schedule and display the alert.

You can control notification permission through your device settings.

9. How we use information

We use information to:

• create and authenticate accounts;
• operate HandTrail's gameplay systems;
• verify nearby or location-based actions;
• maintain object ownership and journey history;
• calculate distance and progression;
• provide Discover, Rescue and Trail Finder;
• deliver gameplay reminders;
• operate chat and player communication;
• investigate safety reports and abuse;
• prevent fraud, spoofing and object duplication;
• protect the security and integrity of HandTrail;
• provide account, privacy and technical support.

10. Legal bases for processing

Where laws such as the EU GDPR or UK GDPR require a legal basis for processing personal information, HandTrail relies on one or more of the following bases, depending on the purpose:

Performance of a contract

We process information when it is necessary to provide the HandTrail service you request. This can include maintaining your account, managing object ownership, processing gameplay actions, preserving journey history and providing requested game features.

Legitimate interests

We may process information when reasonably necessary for legitimate interests such as securing HandTrail, preventing fraud and spoofing, enforcing gameplay integrity, protecting players, investigating abuse, maintaining reliable service operations and improving the safety of the platform.

When relying on legitimate interests, we consider those interests against the rights and interests of affected individuals as required by applicable law.

Consent

We rely on consent where applicable law requires it, including certain device permissions or optional processing. You may withdraw consent where the processing is based on consent, although doing so may prevent features that require that permission from working.

Legal obligations

We may process or retain information where necessary to comply with applicable law, lawful requests or legal obligations.

11. Service providers

HandTrail uses third-party infrastructure to provide parts of the service.

Supabase

HandTrail uses Supabase for backend infrastructure, including authentication, database services, server-side functions and storage used by HandTrail.

LocationIQ

HandTrail uses LocationIQ for certain geographic functions such as city search, reverse geocoding approximate journey locations and optional landmark information used by location-based gameplay.

When geographic information is sent to LocationIQ, HandTrail attempts to limit the request to the information needed for the feature. Some reverse-geocoding flows intentionally coarsen coordinates before sending them to the geocoding provider.

Service providers may process information on HandTrail's behalf subject to their applicable agreements, privacy practices and legal obligations.

12. International data transfers

HandTrail and its service providers may process information in countries other than the country where you live.

Privacy and data-protection laws may differ between countries. Where applicable law requires safeguards for an international transfer, HandTrail will rely on an appropriate transfer mechanism or safeguard, which may include adequacy decisions, contractual protections such as Standard Contractual Clauses, or another legally permitted mechanism.

You may contact scottieapp90@gmail.com for additional information about safeguards applicable to your personal information.

13. Information we do not sell

HandTrail does not currently sell personal information or operate an advertising network based on your precise location.

The current HandTrail application does not contain an advertising or behavioral analytics SDK.

14. Data retention

HandTrail keeps different categories of information for different periods based on how the information is used. Where a fixed deletion period does not apply, HandTrail uses the criteria below to determine how long information is retained.

Account and profile information

Account, authentication-linked profile information and active account preferences are generally kept while your HandTrail account remains active. When you permanently delete your account, account-linked private state is deleted or de-identified according to HandTrail's account-deletion process.

Nearby Pass verification coordinates

Precise sender and receiver GPS coordinates used for a successfully completed Nearby Pass are temporary and are cleared from the handoff session when that handoff completes.

HandTrail retains the approximate handoff location needed for the object's permanent journey history.

Discover location

HandTrail stores the latest server-rounded Discover location associated with your account. A Discover location older than 24 hours is not used to make your held objects discoverable in nearby search results.

The stored Discover-location record is removed when the associated account data is deleted.

Object journey history

Approximate handoff geography, movement records and other object journey information may be retained long-term because an object's continuing historical trail is a core feature of HandTrail.

If a player deletes their account, permanent journey records may remain in de-identified form so the object's history is not destroyed.

Chat and private gameplay state

Chat requests, messages and related private gameplay state may be retained while needed to operate those features and are removed through the account-deletion lifecycle where applicable.

Safety and moderation records

Safety reports may be retained for as long as reasonably necessary to investigate abuse, enforce HandTrail's rules, protect users, prevent repeated misconduct, establish or defend legal claims, or comply with applicable law.

Moderation reports may remain in de-identified form after an account is deleted.

Local notifications

Pass Timer notifications are scheduled on your device. HandTrail clears and reschedules its local Pass Timer notifications when inventory state is synchronized so stale reminders are not intended to remain indefinitely.

HandTrail may retain information longer where required by law, necessary to resolve a dispute, or reasonably necessary to protect the security and integrity of the service.

15. Your privacy rights

Depending on where you live and the law that applies, you may have rights regarding your personal information.

These may include the right to:

• request information about how your personal information is processed;
• request access to or a copy of personal information HandTrail holds about you;
• request correction of inaccurate or incomplete personal information;
• request deletion of personal information where applicable;
• request restriction of certain processing where applicable;
• object to certain processing, including processing based on legitimate interests, where applicable;
• request portability of certain information in a structured, commonly used and machine-readable format where applicable;
• withdraw consent where processing is based on consent;
• lodge a complaint with an applicable privacy or data-protection authority.

Account deletion

You can also permanently delete your HandTrail account directly in the app at:

If you cannot access the app, email scottieapp90@gmail.com with the subject Account Deletion Request.

Privacy rights are not absolute and may differ depending on your jurisdiction, the type of information and the legal basis for processing.

16. U.S. state privacy rights

Residents of certain U.S. states may have additional privacy rights under applicable state law, which may include rights to know or access personal information, correct information, request deletion, obtain a portable copy, or opt out of certain uses of personal information.

The availability and scope of these rights depend on the law that applies to HandTrail and to the individual request.

HandTrail does not currently sell personal information or use personal information for cross-context behavioral advertising.

Requests may be submitted to scottieapp90@gmail.com .

17. Account deletion

You have the ability to permanently delete your HandTrail account directly inside the app:

Account deletion removes your HandTrail authentication account and account-linked private state as described on our Account Deletion page.

Permanent object journey history may remain in de-identified form so deleting one account does not destroy the history of an object or other players' participation.

HandTrail may retain an opaque historical holder value where necessary to preserve facts such as the number of distinct holders an object has had. The mapping connecting that value to the deleted player is removed with the account.

Moderation reports may remain in de-identified form after account deletion.

If you are carrying an eligible object when your account is deleted, that object is released into HandTrail's recovery system rather than destroyed.

18. Security

HandTrail uses reasonable technical and organizational safeguards intended to protect account, gameplay and location information.

Current safeguards include:

• authenticated account sessions for protected HandTrail operations;
• database row-level security and restricted access controls;
• server-authoritative checks for sensitive gameplay actions such as transfers, claims and Rescue;
• server-side proximity and location validation rather than relying only on client-side checks;
• administrative service credentials restricted to trusted server-side environments rather than shipped in the mobile app;
• rate limits on selected search, geography and location-related operations;
• temporary handling and clearing of precise Nearby Pass verification coordinates after a successful handoff;
• coarse or privacy-rounded location data for public-facing Discover, journey and Trail Finder experiences;
• restricted client upload permissions for HandTrail-managed object artwork storage;
• deletion or de-identification of account-linked information through the account-deletion process.

We review and may update security controls as the service changes. No internet-connected service can guarantee absolute security.

If you believe your HandTrail account or personal information has been compromised, contact scottieapp90@gmail.com .

19. Age requirement and children

HandTrail is intended for users age 16 and older.

HandTrail is not intended for children under 16, and we do not knowingly permit children under 16 to create or use a HandTrail account.

If we learn that we have collected personal information from a child under 16, we will take appropriate steps to investigate and delete the account and associated personal information where required, subject to information that may lawfully or necessarily remain in de-identified object history or safety records.

A parent or guardian who believes a child under 16 has used HandTrail may contact scottieapp90@gmail.com .

20. Changes to this policy

HandTrail may update this Privacy Policy as the service changes.

If an update materially changes how HandTrail handles personal information, we may provide additional notice through the app or another appropriate method.

The effective date at the top of this page identifies the current version.

21. Contact

HandTrail is operated by:

Scott Savage, operating HandTrail

For privacy requests, account assistance, safety concerns or other support:

scottieapp90@gmail.com