Privacy Policy
TrailGuard is operated by De Beers Labs, in Western Australia. You can reach us at support@debeers-labs.xyz.
This policy covers the TrailGuard apps for iPhone and Android and our server at
trailguard.debeers-labs.xyz.
1. What we collect
Your account. Your email address, display name, username, profile photo, and the Firebase user identifier created when you sign up. If you sign in with Apple or Google, we receive whatever that service passes us — typically your name and email.
Your date of birth. Collected once, at sign-up, to confirm you are old enough to use the app.
Where you walk. Precise GPS coordinates, recorded while a walk is in progress. Recording continues when your screen is locked or the app is in the background — that is the point of it — and stops when you end the walk. We do not record your location when no walk is running.
Walks you choose to share. When you share a walk to the feed, or contribute it to the map that suggests routes to other walkers, the route leaves your phone only after the part between your door and the road has been removed — up to where you joined the loop TrailGuard suggested, or, if you walked freely, the 50 metres nearest your start and your finish. A shared post shows the route's outline only, never a street map and never street names. Contributed routes are not labelled with your name. You choose this per walk.
Live location, when you turn on a beacon. The safety beacon shares your position, live, with the one person you nominate, for as long as the walk lasts. They see where you are in real time. It stops when the walk ends.
Your pets. Names, breed, age, weight, photos, and the walks recorded for them.
Photos. Profile pictures, pet photos, pictures you post to the feed, photos you send in messages, and photos attached to hazard reports.
Hazard reports. What you reported, where it was, and any photo you attached. These are shown to other walkers nearby.
What you post and who you know. Feed posts, comments, reactions, your friend list, the loops you belong to, and your household membership.
Messages. Direct messages, family chat and loop chat are end-to-end encrypted. Our server stores the encrypted text and the routing information around it — who sent it, to which conversation, and when — and cannot read what the message says.
Households. If you set up a family, we store who is in it and what role they hold. Everyone in a household has their own account and must be 13 or over — see section 7.
Your device. A device identifier and push notification token, used to send you notifications and to recognise your device.
Health data. With your permission, we read steps and calories for the duration of a walk — from Apple Health on iPhone, from Health Connect on Android — to show real numbers on your walk summary, and we write the finished walk back as a workout so it counts alongside your other activity. Distance is always our own GPS figure, never taken from the health store. This stays on your phone; we do not upload it. If you decline, or your phone has no health store, the summary shows estimates and says so.
2. What we do with it
- Run the app: recording walks, drawing maps, suggesting routes, the feed, friends, loops, households and encrypted messages.
- Send you notifications about messages and social activity. A direct-message notification never contains the message.
- Keep people safe: the beacon, hazard warnings, and the tools for blocking and reporting.
- Keep the service working and secure.
We do not sell your information, we do not use it for advertising, and we do not track you across other companies' apps.
3. Who else sees it
- Google Firebase — sign-in and push notifications.
- Apple — Sign in with Apple, push notifications, and WeatherKit for weather.
- Google Maps — the map on Android.
- Open-Meteo — weather on Android.
- Cloudflare — carries traffic between your phone and our server.
Each processes data under its own privacy policy. We send only what the service needs to work.
Where your data lives. Our server and its database are in Sydney, Australia. Some of the services above are outside Australia: Google, Apple and Cloudflare all process data overseas, including in the United States. Using TrailGuard means accepting that those disclosures happen.
4. Encrypted messages
Direct messages, family chat and loop chat are end-to-end encrypted. The key that decrypts your messages is generated on your phone and stays there.
This has a consequence worth understanding: if you lose your phone and have not moved your key to another device, your old messages cannot be recovered by anyone, including us. The app tells you when it notices your key is on another device, and offers to start fresh with a new one — which leaves the old messages permanently unreadable.
5. How long we keep it, and how to get rid of it
We keep your data while your account exists.
Deleting your account. Settings → Account → Delete account. This removes your profile, your walks, your pets, your posts, your messages, your photos and your encryption keys from our servers, in a single operation that either completes or does nothing.
Three things are handled differently, on purpose:
- Hazard reports you made stay up, with your identity removed and any photo deleted. A hazard is a warning about a place, and pulling it down would take that warning away from other walkers who rely on it.
- Paths already built into the shared map remain. The tracks tied to you are deleted, but the map built from them keeps the geometry, with nothing linking it to you.
- A message you sent to somebody else stays in their copy of the conversation, encrypted, the same way an email you sent stays in the recipient's inbox.
Getting a copy of your data. Write to support@debeers-labs.xyz and we will send you what we hold about you.
6. Your choices
- Grant or withdraw location, notification, camera, photo and health permissions in your phone's settings. Withdrawing location stops walk recording working.
- Control who can message you, and your discoverability, in Settings.
- Block someone, or report a post, comment, message or loop, from where it appears in the app. Blocked people are listed in Settings and can be unblocked.
- Turn off a beacon at any time by ending the walk.
- Choose, per walk, whether to contribute it to the shared route map.
7. Children
TrailGuard is for people aged 13 and over. The app asks for your date of birth at sign-up and will not let you continue if you are younger.
There are no supervised child accounts. An earlier version of this page described a flow for adding an under-13 child to a household, with recorded parental consent. That flow is not available: it is held out of the app, and no such account can be created. This page said otherwise, and it was wrong to — so it is corrected here rather than quietly dropped.
TrailGuard is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, write to support@debeers-labs.xyz and we will delete it.
We do not advertise to anyone, and we do not sell or share personal information.
8. Security
Traffic between your phone and our server is encrypted in transit (HTTPS). Messages are additionally end-to-end encrypted, as described above. We apply access controls to our systems and keep verified, restorable backups. No system is perfectly secure, and we will tell you if something happens that affects you.
9. Complaints
If you think we have mishandled your information, write to support@debeers-labs.xyz. We will acknowledge you promptly and respond within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, or 1300 363 992.
10. Changes
We will update this policy as the app changes, and revise the date at the top. If a change materially affects how we handle your information, we will tell you in the app rather than quietly editing this page.