What we collect
- Account data — your email address and password (stored hashed by our auth provider).
- Location — your device location, only when you grant browser permission, used to show nearby weather and campsites. It is processed in your browser and sent to weather/geocoding services as coordinates; we do not store a location history.
- Trips & rig data — trips, waypoints, and rig specifications you save, stored so the Service can work.
- Telemetry credentials — if you connect Victron/RREV Hub, we store your hub URL and access token to fetch your rig data when you view it. We do not store the telemetry readings themselves.
- Contributions — campsites, confirmations, and reports you submit are public by design (without your email attached).
What we don't do
- We do not sell your personal data.
- We do not show third-party advertising.
- We do not track your location in the background.
Service providers
Data is processed by the following providers as needed to run the Service:
- Vercel — website and API hosting (short-term request logs, which include IP addresses)
- Supabase — database, authentication, hosting of your account data
- Mapbox — maps, geocoding, and routing (receives coordinates you search or route between)
- Open-Meteo — weather forecasts (receives coordinates)
- OpenStreetMap/Overpass — campsite and point-of-interest data (receives area queries)
- NIFC via Esri ArcGIS — active wildfire data (receives the area around a route)
- AI model providers — turn a trip you describe in your own words into a plan (receive that description only; never used by the public connector API)
- Resend — sending account and alert emails (receives your email address)
- Stripe — payment processing when you buy a subscription, trip credits or a field guide (we never see your card number)
Your rights
You can access and update your data in Settings, and permanently delete your account and all associated data with the Delete Account action. Public Contributions may remain after account deletion but are disassociated from you. For data requests (access, export, correction, deletion) email us — we respond within 30 days. EU/UK users: our legal basis is contract performance (running the Service you signed up for) and legitimate interest; you may lodge complaints with your supervisory authority. California users: we do not "sell" or "share" personal information as defined by the CCPA.
Government and third-party requests
We disclose personal data only in response to valid, legally binding process, such as a subpoena, court order or search warrant. We review every request for legal validity and scope, and we challenge or narrow requests that are overbroad. Unless the law prohibits it, we notify the affected user before disclosing their data so they can respond. We disclose only the minimum data the request legally requires. The public connector API stores no personal data beyond short-term hosting logs, so for that service there is usually nothing to disclose.
Retention & security
Account data is retained while your account exists and deleted when you delete it. Connections use TLS; access to production data is restricted. No system is perfectly secure — use a strong, unique password.
Changes & contact
Material changes to this policy will be announced in-app or by email. Questions: rr@roamresilient.com