Privacy Policy — Trailhead by Nanki

• Account and profile information such as your name, email address, phone number, role, organization affiliation, and onboarding details.
• Authentication credentials and identity data managed through Clerk.
• Operational content you create in Trailhead, including trip and program records, field reports, chat and operational messages, notes, forms, and other user-generated content visible within your organization.
• Photos, audio recordings, voice transcriptions, documents, ID scans, receipts, and other attachments you choose to upload or capture in Trailhead.
• Expense and financial records entered or visible in Trailhead, including receipt images and related account or payout information exposed to authorized users.

• Device and app information such as device type, operating system, app version, language, and session identifiers.
• Push notification tokens and device identifiers used to deliver notifications and maintain secure sessions.
• Usage, diagnostic, and error information, including crash reports and performance logs when error monitoring is enabled.
• IP address and approximate network information for security and troubleshooting.
• With your permission, precise foreground and background location while an active Program is running, including timestamps, accuracy, speed, and heading supplied by your device.
• Motion activity signals used to improve location accuracy during active trips when permitted by your device.

Trailhead does not start route capture solely because location permission is enabled. Precise location capture is tied to an active Program and can be stopped by ending the Program, turning location sharing off inside Trailhead, or changing location permissions in your device settings.

Trailhead may offer an optional private Journal feature for eligible client users. Journal notes, voice recordings, transcripts, and private photos are encrypted on your device before synchronization. We store encrypted Journal data and the minimum metadata required to authorize access, synchronize content, enforce quotas, process deletion requests, and maintain service integrity.

We do not design Trailhead to give lodge staff, guides, or Arugula Labs personnel routine access to decrypt Journal content. Final privacy boundaries for Journal content are subject to ongoing data-flow verification and may be updated in this policy if our implementation changes.

Trailhead shares operational information with authorized users inside your organization according to role and assignment. Private Journal content is handled separately as described in Section 2.3.

• Clerk for authentication and identity management.
• Hosting and backend infrastructure providers, including Vercel and related database or storage processors.
• Mapbox for map display and geospatial services.
• Expo and related mobile infrastructure for builds, updates, and push delivery.
• Sentry for crash reporting and error monitoring when enabled.
• Google and Apple platform services used for push delivery, speech recognition, or device-level services where applicable.
• Email and communication providers used for service notifications and account workflows.

We may disclose information when required by law, to respond to valid legal process, to protect users and the Service, or to investigate fraud, abuse, or security incidents.

• Account information is retained while your account is active and for a limited period afterward unless a longer period is required by law or an open deletion request.
• Raw precise location points under the operations-only profile are deleted within 72 hours after the GPS session ends.
• Raw precise location points under approved route-learning profiles are deleted within 90 days.
• Restricted GPS evidence associated with a documented safety or SOS incident may be retained for up to one year with limited access.
• Operational logs and diagnostics are retained for limited periods appropriate to security and troubleshooting.
• Expense and receipt records may be retained according to organizational, contractual, and legal requirements.

You may request deletion of your Trailhead account by opening the account deletion page from Trailhead settings and emailing us from the address associated with your account. After identity verification, Arugula Labs will process eligible deletion requests within 30 days, subject to legal, safety, fraud-prevention, and backup retention limits.

Some information may be retained where required by law, for fraud prevention, to resolve disputes, or in encrypted backups for a limited period before permanent deletion.