trail.safe
Sign in

Legal

Privacy policy.

Plain-English summary of what Trail-Safe collects, why we collect it, and the control you have over it.

Last updated · November 4, 2026

TL;DR

The short version

  • We store the locations your watch sends us, plus the account identity that signed in — Google on Wear OS and the web, Sign in with Apple on Apple devices — so we can show you a map of where you've been.
  • Authentication is delegated to the sign-in provider: Google Sign-In or Sign in with Apple. Your credentials are verified by the provider, and Trail-Safe only receives a cryptographically-signed identity token.
  • We never sell your data and we never share it with advertisers.
  • Everything we store stays in the EU, protected by the General Data Protection Regulation (GDPR). Your data is never sold, traded, rented or handed over for anyone’s commercial use.
  • You can delete every fix and session from the dashboard at any time.
  • Location history, heart-rate data and SOS records are erased automatically after 90 days. You don’t have to ask.
  • On Apple Watch, heart rate is read from HealthKit only while a route is recording — never written to iCloud, never used for advertising, never sold.
  • You can close your account from the deletion page; everything we hold is erased within 30 days.
  • Inactive accounts are deleted automatically after 90 days of no activity — one less thing to remember when you walk away.

1. Who we are

Trail-Safe (the “Service”) is developed and operated by 2552 BV, a company based in the Netherlands. On Apple’s App Store the app is published by Devidee B.V., which operates our Apple developer account. Devidee B.V. processes no data separately: it is the same team, the same backend and this same policy. For any privacy question you can reach us at privacy@paceguard.io.

2. What we collect

Trail-Safe only collects what it needs to do its job:

  • Location fixes. Latitude, longitude, altitude and accuracy, sent by your watch while you are recording a trail.
  • Heart rate. Beats per minute, attached to each fix while the sensor is granted and reporting. On Apple Watch it is read from HealthKit only while a route is recording — shown on your map and included in SOS alerts, but never written to iCloud and never used for advertising. On Wear OS it comes from the watch’s own wrist sensor.
  • Account identity. What we receive depends on how you sign in: the Google ID, e-mail address and display name returned by Google Sign-In (Wear OS and web); or, with Sign in with Apple (Apple Watch and iPhone), the name Apple sends us once at your first sign-in and an e-mail address — a private relay address if you chose Hide My Email. With e-mail-code sign-in, just the e-mail address; family codes only store which family you belong to and the display name you pick.
  • Device + session identifiers. A random session ID generated by your watch and the device model, so we can group fixes into one trail.
  • Push tokens. Your device’s push token — Firebase Cloud Messaging (FCM) on Android devices, Apple Push Notification service (APNs) on Apple devices — so we can deliver family alerts.
  • Status frames. Heartbeat “ping” messages (without coordinates) so the dashboard knows whether your watch is currently online.
  • SOS signals. If you trigger SOS on the watch, we record the flag together with your last known position. Your emergency-contact number stays on your device — our backend never receives it. The one SOS setting we do store is whether you opted in to alerting nearby Trail-Safe users (community SOS); the rest stay on the device.
  • Live share links. If you create a link to share your live location, we store the link itself, the devices you chose to show on it, its title and when it ends. For someone who opens the link we store only a random viewer number and when their page last checked in — no name, no account, no cookie — so we can limit how many people watch at once. Their IP address is used for a few seconds to limit abuse and is not stored — unless that address keeps opening links that do not exist (see security records below).
  • Security records. To protect families against abuse, we count signals such as wrong family or trip codes, invalid sign-in tokens, links that do not exist and floods of SOS or check-in messages. Only when one network (IP address) or one account crosses a limit that ordinary use never reaches do we record that address or account, which limit it was and when. We may then block it for a limited time. These records are never used for anything else. When an account is created or a watch or phone is registered, we also keep the IP address and app or browser version it came from, and give a new account a risk score, so that waves of automated sign-ups spread over many addresses can be recognised. An account created during such a wave can be used normally but cannot share access with others until it has been used with a device or a plan, or we have checked it. This information is deleted together with the account or device.
  • Keys and webhooks you create. If you create an API key (Home Assistant) or an SDK key, we store a one-way hash of it (never the key itself), the name you gave it, when it was created and last used, and for an SDK key the IP addresses you allow it to be used from. For a webhook we store its URL, its signing secret and a delivery log of the last 7 days.

We do not collect contacts, photos, microphone audio, on-watch activity outside Trail-Safe, or any data while the app is closed. An emergency contact’s name and number are picked or typed on your device and stay there.

3. Why we collect it

  • To show you your trails — the central feature of the dashboard.
  • To keep the live presence indicator honest — so you and your contacts can see whether the watch is currently connected.
  • To deliver SOS alerts — so your last position is available when help is needed.
  • To keep the Service running — minimal operational logs (errors, request counts) so we can fix bugs.
  • To protect you and the Service against abuse — spotting and stopping code guessing, scripted sign-ups, misuse of sign-in tokens and the testing of stolen cards.

Under the GDPR our legal basis is contract performance (Article 6(1)(b)) for the core map / SOS features, and legitimate interest (Article 6(1)(f)) for fixing bugs and preventing abuse. Integrations you set up yourself (API keys, SDK keys, webhooks) also run on contract performance: you ask for them, and they run only while you keep them on.

3a. What we deliberately don’t collect

The fastest way to keep your data safe is not to store it in the first place. Trail-Safe never collects:

  • Account credentials. Trail-Safe operates no credential store. Identity verification is delegated to Google Sign-In (Wear OS and web) or Sign in with Apple (Apple devices); our backend only ever receives the signed identity token the provider issues after a successful sign-in. We never see or store your Google or Apple password.
  • Payment or card details. Subscriptions are billed by Google Play; when App Store purchases are introduced, Apple handles that billing the same way. Our backend retains only the purchase token needed to validate the entitlement — no card data, ever.
  • Contacts, photos, microphone or files. The watch app does not request these permissions, and our backend exposes no API to receive them.
  • Behavioural analytics. No Google Analytics, Meta pixel, Mixpanel, Sentry profiling, or advertising SDK. The dashboard ships zero third-party JavaScript trackers. Visits to our public website we count ourselves, without cookies (legitimate interest: knowing which pages help people): per day we keep only how many views each page got, the site that linked to it, and the country, device type and language. To estimate how many different people visited, your IP address and browser are hashed with a key that changes every day and is then thrown away; we store neither, and cannot recognise you on another day. Browsers that send Do Not Track or Global Privacy Control are not counted, and neither are signed-in pages or live-share links.
  • Device fingerprints. No IMEI, advertising id, screen-resolution probes, or installed-app surveys. The only device identifier on file is the UUID issued at first registration.

Breach exposure. The data Trail-Safe holds is limited by design. In the event of a database compromise, the exposed material would consist of location history, the display name and email returned at sign-in (an Apple private-relay address if you use Hide My Email), and a purchase token. No credentials, no payment instruments, and no means of accessing your Google or Apple account would be exposed, because that material is never persisted by Trail-Safe.

4. Where it’s stored

All fixes, sessions and account data are stored in a PostgreSQL database operated by Trail-Safe inside the European Economic Area. Communication between the watch, the dashboard and our backend is encrypted with TLS.

We also run a server in the United States so Trail-Safe responds quickly for people in the Americas. It is an application server only: it has no database and no file storage, and it reads and writes your data directly in our EU database over an encrypted connection. Nothing about you is kept there beyond the minimal operational logs every server keeps (see How long we keep it). Your data is stored in the EU, always, and protected by the GDPR wherever you use Trail-Safe.

On your devices, sign-in tokens are stored in the Keychain on Apple devices and in Android’s EncryptedSharedPreferences (AES-256-GCM) on Wear OS, so a stolen device can’t read them in clear-text. Your SOS settings and emergency-contact number live in your device’s own local storage and never leave it.

5. How long we keep it

Two different clocks. Data that describes where you were ages out on its own; data that describes who you are lives as long as the account does.

Erased automatically after 90 days

  • Location history — every position fix, breadcrumb and recorded trail.
  • Heart rate and activity data recorded alongside those fixes.
  • SOS and fall-alert records — the alert, the position shared with it, and the replies it got.

A scheduled job deletes anything past that window; nothing older than 90 days survives it, whether or not you ask. You can of course delete fixes, trails and sessions yourself at any time before then.

Kept until you close your account

  • Your identity — the sign-in account, e-mail address and name.
  • Your devices, family connections, home zones, saved routes and waypoints.
  • Subscription and purchase records, for as long as the account exists.

These have no timer, because deleting them would break the product while you are still using it. They go when the account goes.

The other two clocks

  • Closing your account: everything above is erased within 30 days of your request, backups included. See section 6.
  • Inactive accounts: if you don’t sign in (on the dashboard) or connect a watch for 90 consecutive days, the whole account is deleted automatically. We don’t email you first; the deletion is the point. Sign in again any time before the 90 days are up to reset the clock.
  • Operational logs: rotated after 30 days.
  • Security records: deleted after 90 days; a block always ends by itself (after 30 days at most).
  • Live share links: a link shows nothing once it expires or you stop it (only an SOS in progress keeps it open until the SOS ends). The link record is deleted 7 days later, and a viewer’s record within an hour of them closing the page.
  • Revoked keys: an API or SDK key you revoke stops working at once and is deleted 30 days later.

Operators running their own deployment can adjust these windows from the admin interface. For Trail-Safe the retention window is 90 days and the deletion window is 30 days.

6. Deleting your account

You can close your account yourself, at any time, from https://trail-safe.app/delete-account. Sign in there, confirm twice, and we do the rest. There is no survey, no phone call and no retention offer.

What happens, and when:

  • Immediately: your watches are signed out, and you leave every family you were part of — your name and position disappear from their maps at once.
  • Within 30 days: your account and every record attached to it are permanently erased, including from our encrypted backups.
  • In between: the account is closed but recoverable. Sign in on the same page and cancel if you change your mind. Your watches and family memberships do not come back automatically — you re-link and rejoin.

What is erased:

  • Your identity: sign-in account, e-mail address, name and avatar.
  • Every device, its session, and its push notification token.
  • Every location fix, trail and breadcrumb, on every device.
  • Every SOS and fall alert, the positions shared with them, and the replies.
  • Home zones, saved routes, waypoints, offline map regions, weather areas and live share links.
  • Family connections in both directions, and any invites you sent or received.
  • Notifications, API keys, SDK keys and webhooks, subscription and purchase records, and diagnostic logs.

Deleting your account does not cancel a Google Play subscription. Google holds that, not us, and only you can cancel it — in the Play Store under Payments & subscriptions. Cancel it there first, or you will keep being billed for an account that no longer exists.

We keep only what the law requires us to keep, for only as long as it requires. In practice that means invoices, which are held by our payment providers (Google Play, Mollie) under their own tax-retention duties; our own copies of them are deleted with everything else. No location, heart-rate or SOS data is ever retained on this basis.

If you have lost access to the account and cannot sign in, write to privacy@paceguard.io from the address on the account and we will do it by hand, within 30 days.

7. Your rights (GDPR)

You can, free of charge and at any time:

  • See everything we have on you — the dashboard shows every fix and session.
  • Export your data — use the export button on each device row.
  • Delete individual fixes, whole sessions, or your entire account — in the iPhone app under Settings → Delete account, from the dashboard, or by writing to us.
  • Withdraw consent for heart-rate or notifications (in the watch’s system settings).
  • Lodge a complaint with your national data-protection authority.

To act on any of these rights, write to privacy@paceguard.io. We respond within 30 days.

8. Who we share data with

We share data with:

  • Google — only the ID token your watch presents at sign-in, so we can verify it’s really you; Firebase Cloud Messaging delivers push alerts on Android devices. Google’s privacy policy applies to their part.
  • Apple — on Apple devices, Sign in with Apple verifies your identity, Apple Maps (MapKit) loads the map tiles your device requests, APNs delivers push alerts, and Apple operates the private email relay if you use Hide My Email. Apple’s privacy policy applies to their part.
  • Mapbox — to render the map tiles on the watch. Mapbox sees the area you’re looking at, but not your identity.
  • Our infrastructure providers — hosting and database providers, contractually bound to data-processing agreements. All storage is inside the EEA; our server in the United States stores none of your data (see Where it’s stored).
  • People you send a live share link to — only if you create one. Anyone holding the link sees the devices you chose: their current position, the route since the link was made, the device names and any active SOS, until the link ends or you stop it. They see nothing from before the link and no other data about you. A link works for whoever has it, so share it only with people you trust; you can stop it at any time in the dashboard.
  • Tools you connect yourself — only if you set one up. An API key (Home Assistant), an SDK key (Family Plus) or a webhook lets a system of your choice read your positions and activity; in a family that includes your family members’ locations. They are told when one that can see their location is created, and can see it under Who sees me. The SDK never passes on IP addresses. What happens to the data there is up to whoever runs that system. You can revoke a key or webhook at any time; it stops working within a minute.

We never sell your data, and we never share it with advertising networks, data brokers or analytics tools that profile you.

9. Cookies

The dashboard uses one essential cookie to keep you signed in. No tracking pixels, no third-party cookies, and no cookie for the website’s visit counts (see behavioural analytics above).

10. Children

Trail-Safe is not intended for users under 13. We do not knowingly collect data from children. If you believe a child has signed up, write to us and we’ll remove the account.

11. Changes to this policy

We’ll post any changes here and update the “last updated” date at the top. Material changes will also be announced inside the dashboard.

12. Contact

2552 BV (controller)
App Store listings published by Devidee B.V.
privacy@paceguard.io