Privacy Policy

2.1 Information You Provide Directly

• Account Registration: When you create an account, we collect your first and last name and either your email address or phone number. The Service uses passwordless one-time authentication codes; we do not store passwords.
• User-Generated Content: We collect the content you create within the Service, including krawl names, stop names and addresses, routes, schedules, and associated notes.
• Social Interactions: We collect records of friend requests you initiate or accept, RSVPs you submit, and co-host invitations you send or receive.
• Google Calendar Integration: If you voluntarily connect your Google Calendar account, we access your calendar events in a read-only capacity solely to facilitate krawl scheduling. We do not write to your calendar, retain calendar event content beyond what you explicitly import, or access any Google account data beyond the calendar scope you authorize.

2.2 Information Collected Automatically

• Precise Geolocation Data: When you initiate a live hosting session, the Service collects your device's GPS coordinates in real time and transmits them to users who have access to your krawl. Geolocation data is collected solely during an active hosting session and ceases immediately upon termination of that session. GPS trail data from completed sessions is retained to generate session recaps (distance, route, statistics). You may elect to enable "ghost mode," which suppresses broadcast of your location to other users. Use of the live hosting feature is entirely voluntary.
• Device Push Token: Upon granting notification permissions, your device token (issued by Apple Inc. or Google LLC) is collected and stored to facilitate delivery of push notifications. You may revoke notification permissions at any time through your device operating system settings.

2.3 Information Derived from Your Contacts

If you elect to use the "Sync Contacts" feature, phone numbers stored in your device's contacts are converted to cryptographically irreversible hashes locally on your device prior to any transmission. Only the resulting hash values are transmitted to our servers, solely for the purpose of identifying other users of the Service who have undergone the same process. We do not collect, transmit, or retain your contacts' phone numbers in any identifiable form. Use of this feature is entirely voluntary.

• Service Operation: To authenticate your identity, maintain your account, display your krawls and social connections, and deliver core functionality of the Service.
• Real-Time Features: To transmit your live geolocation data to authorized viewers during an active hosting session, consistent with your privacy and visibility settings.
• Communications: To send push notifications and in-app alerts for events to which you have consented, including friend requests, co-host invitations, and friend activity alerts.
• Service Improvement: We may, in the future, engage analytics service providers to analyze aggregate usage patterns for the purpose of improving the Service. We will update this Policy prior to implementing any such processing.
• Legal Obligations: To comply with applicable law, respond to lawful governmental requests, and enforce our Terms of Service.

4.1 Third-Party Service Providers

We engage the following third-party service providers, each of whom processes personal information solely on our behalf and in accordance with our instructions and applicable data protection law. These providers are contractually prohibited from using your data for their own marketing or commercial purposes:

• Supabase, Inc. — Database hosting, user authentication, and real-time data infrastructure (data hosted in the United States).
• Vercel Inc. — Application hosting and content delivery.
• Google LLC — OAuth 2.0 authentication ("Sign in with Google"), optional Google Calendar integration (read-only), and map tile and routing services (Google Maps Platform). Google's use of data is governed by Google's Privacy Policy.
• Google LLC (Firebase) — Push notification delivery via Firebase Cloud Messaging. Device tokens are transmitted to Firebase solely for the purpose of delivering notifications; Firebase does not retain message content beyond in-flight delivery.
• OpenStreetMap Foundation / Overpass API — Map tile rendering and venue search.

4.2 Future Advertising

We do not currently sell your personal information or use it for targeted advertising. In the event we introduce advertising or data monetization practices in the future, we will provide advance notice and update this Policy prior to implementing such practices.

4.3 Other Disclosures

We may disclose your information: (a) to comply with applicable law or legal process, including a valid court order or subpoena; (b) to protect the rights, property, or safety of the Company, our users, or the public; or (c) in connection with a merger, acquisition, or sale of all or substantially all of our assets, provided the successor entity agrees to honor this Policy.

7.1 In-App Deletion

You may request permanent deletion of your account at any time by navigating to Settings → Delete account within the Service. Account deletion is immediate and irreversible.

7.2 Request Deletion by Email

If you no longer have access to the app or prefer to submit a request off-app, email info@krawlapp.com from the email address associated with your account (or, if you signed up with a phone number, include that number in the message) with the subject "Account deletion request." We will verify your identity and permanently delete your account within thirty (30) days of receiving a verifiable request, and will confirm completion by reply email.

7.3 What Gets Deleted

Deletion results in the permanent removal of your profile, krawls, stops, routes, schedules, social connections (friends, mutuals, co-host relationships), RSVPs, session and GPS trail data, device push tokens, and all other personal information associated with your account. Content you contributed to krawls hosted by other users (for example, a stop you added as a co-host) may be retained in de-identified form so the host's krawl remains intact. We may retain a minimal record of the deletion itself, and any data we are required to keep by applicable law, for the shortest period necessary. This right is available to all users regardless of jurisdiction.

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, our business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions permitted by law.
• Right to Opt Out of Sale or Sharing: We do not sell or share personal information as those terms are defined under the CCPA.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To submit a verifiable consumer request, please email info@krawlapp.com from the email address associated with your account. We will respond within forty-five (45) days. If we require additional time, we will notify you of the extension and the reason therefor. You may designate an authorized agent to submit a request on your behalf, subject to our verification of the agent's authority.