Privacy Policy

Who we are

ATTrails is run by @haroldadmin.com, an individual based in the United Kingdom. In this policy, “ATTrails”, “we” and “us” mean the operator of attrails.app. For the purposes of UK data protection law, we are the controller of the personal data described here.

How ATTrails is different

ATTrails is built on the AT Protocol. You sign in with an existing AT Protocol account, such as a Bluesky account, and the routes and reviews you create are saved to that account's Personal Data Server (PDS), not to ATTrails.

Records on the AT Protocol are public. Anyone, including other apps, can read them. ATTrails reads public records from the network and keeps its own copy (an index) so it can show, search and map them. Your PDS provider has its own privacy policy, which covers the data it holds for you.

What we collect

Public records from the network

We index ATTrails routes (including GPX files, names, descriptions, tags and the paths they describe), reviews, and basic profile information (your DID, handle, display name and avatar). This applies to anyone who publishes these records, whether or not they have signed in to ATTrails.

When you sign in

We store the OAuth session issued by your PDS, which includes your DID and access tokens that let ATTrails create, edit and delete ATTrails routes and reviews on your behalf. We can't see your password. We also set one cookie, described below.

When you visit

• Approximate location. Our network provider, Cloudflare, estimates your location from your IP address. We round it to about 1 km and use it only to show routes near you. We don't store it.
• Analytics. We use a self-hosted instance of Umami to count page views. It doesn't use cookies or build profiles of individual visitors, and it doesn't run if your browser sends a Do Not Track signal.
• Logs. Our servers record technical logs and traces (such as requests, errors and, when you're signed in, your DID) to keep ATTrails secure and working.

How we use it, and our legal basis

• Providing ATTrails, including signing you in and saving routes and reviews to your account: necessary to provide the service you asked for (contract).
• Indexing, searching and displaying public records: our legitimate interest in running a route discovery service over public AT Protocol data.
• Moderation, so ATTrails stays useful and welcoming: our legitimate interest. See our moderation approach.
• Security, debugging and usage analytics: our legitimate interest in keeping ATTrails secure and improving it.

We don't sell your data or use it for advertising.

Who we share it with

• Cloudflare carries all traffic to ATTrails and sees your IP address and requests.
• Typesafe receives the text of routes, reviews and profiles so its Jev model can suggest moderation labels.
• OpenFreeMap serves map tiles directly to your browser, so it sees your IP address and which map areas you view.
• Your PDS receives the records ATTrails writes on your behalf.

Some of these providers may process data outside the UK. Where they do, we rely on safeguards recognised under UK law, such as adequacy regulations or the UK International Data Transfer Addendum. We may also disclose information if the law requires it.

Cookies

We set a single, strictly necessary cookie, attrails_session, when you sign in. It keeps you signed in for up to 30 days, and is removed when you sign out. We don't use advertising or tracking cookies.

How long we keep it

• Sign-in sessions expire after 30 days. Your OAuth session is deleted when you sign out of every browser, or when your account is deleted, deactivated or taken down.
• When you delete a route, review or profile from your account, or delete your account, we mark our indexed copy as deleted and stop showing it. Ask us and we'll erase it from our index entirely.
• Logs and traces are kept for a limited time and deleted on a rolling basis.

Your rights

Under UK data protection law you can ask to access, correct or erase your personal data, to restrict or object to how we use it, and to receive it in a portable format. You can edit or delete your routes and reviews yourself at any time, and those changes reach ATTrails automatically.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office, though we'd appreciate the chance to sort it out first.

Children

ATTrails isn't meant for anyone under 13. If you think a child under 13 has signed in, let us know and we'll remove their data.

Changes

We'll update the date at the top of this page when this policy changes, and announce significant changes on Bluesky.

Contact us

For privacy questions or requests, message @attrails.app on Bluesky.