Privacy

What's collected

• Your email address and a password (stored as a one-way bcrypt hash — we never store or can see your actual password).
• Your display name, kilometre-or-mile display preference, and nightly-rest story preference. If you opt into language practice, your self-reported starting level is also stored.
• The walks you log: date, distance, and any note you add.
• For GPX imports, the uploaded coordinates are processed only long enough to calculate distance and are never saved. A one-way file fingerprint, calculated distance, date, point count, and link to the resulting walk are retained to prevent duplicate imports. The original filename exists only in the temporary preview and is cleared when you confirm.
• Anything you write in the journal or in a tradition (like what you're symbolically carrying) — this can be personal. On an individual Camino it is visible only to you; on a shared Camino it is visible to every member of that Camino.
• Your scripted encounter choices and transcript. If language practice is enabled, card review history (box, due date, and review counts) is stored so it can continue where you left off.
• If you use adult pilgrim discovery safety controls, the accounts you hide or block and reports you submit, including your selected reason and optional details.
• If you use adult “walking beside,” the other pilgrim, invitation direction, relationship state, who paused, and request/response/update/end times. It stores no conversation, route, distance, pace or location.
• If you settle for the night, the date, active Camino, your exact ledger distance, narrative rest label and—if selected—the walking-beside companion's account ID and chosen community name. We do not read their progress for this.
• If accepted adults use wayside conversation, message text, sender, relationship, status and times, plus an optional link to the sender's latest daily-rest label/date. Report records include the specific reported message, reason, optional context, status and staff review.
• If an adult gives or receives a Buen Camino keepsake, the two account IDs, the giver's Camino and waypoint sequence, fixed token type, chosen attributed/pseudonymous/anonymous presentation, frozen sender label, time, and the recipient's own non-stacking opportunity state.
• A session cookie: a random token that keeps you logged in. It can't be read by page scripts and expires after 30 days.

Shared Caminos

Adult accounts may own or join multiple Caminos using single-use invitations. One journey is active at a time, and newly logged walks or GPX imports go only to that journey. Members share its walks, route position, journal, milestones, traditions, encounter transcript, and—only for members who opt in—language-card progress. Switching preserves every journey. Each person's email, password, avatar, language preference, distance-unit preference, nightly-rest story preference, and active-journey choice remain attached to their own login. A narrative milestone or albergue rest never changes the shared ledger's distance. A group walk should be logged once. Invitation links expire after seven days and are stored only as one-way hashes.

Optional phone recordings

When phone recording is enabled and you save a deliberately started walk from the phone app, we store its start/end times, timezone, duration, optional steps, measured distance, source and a retry identity. Only its ordinary distance/date/note credit is shared with journey members. Choosing to save your GPS route uploads precise coordinate segments for your own phone and web viewing. Other members, including the journey owner, do not receive these tracks. A distance-only save uploads no coordinates. Maps request tiles from their provider, which can infer the viewed area. This is not end-to-end encrypted storage.

You can remove the GPS route in Recorded activities, including while new phone uploads are disabled, while keeping the distance credit. Retries cannot restore it or recreate a deleted credit. The account export includes your private recordings, not other members’ tracks; account deletion removes your private data. Recordings remain until you remove their route or delete your account, subject to hosting backup rotation. The beta accepts up to 1,000 recorded activities per account and 12,000 GPS points per activity. Unfinished and unsent phone recordings remain on that device; discard them there to remove them. Precise phone recording is disabled for managed children.

What's not collected

• No analytics, no ad trackers, no third-party marketing pixels.
• No payment information — there's no payments feature.
• No original GPX files. GPX imports do not retain GPS coordinate traces. Separately, adult phone recordings can save a private GPS route when you explicitly choose to upload it. Importing does not send the file to a third-party activity provider.
• IP addresses aren't stored in the database. (Ordinary web server access logs, wherever this happens to be hosted, may transiently contain them — that's outside the app's own control.)
• We never sell or share your data for advertising. There's no business model here that involves your data at all.

If you install the app, its service worker caches only public interface files and a static offline explanation. It does not cache authenticated pages, journal entries, progress responses, forms, or uploaded avatars for offline use.

Third parties

The map on Your Camino is powered by Mapbox. When it loads, your browser talks directly to Mapbox's servers to fetch map tiles — which means Mapbox receives your IP address and request details for that, governed by Mapbox's own privacy policy, not this one. No other third-party service is used anywhere else in the app.

Your control over your data

Settings has a "Delete my account" option. Using it immediately and permanently deletes your account and everything tied to it — walks, journal entries, achievements, traditions, credential stamps, encounter transcripts, and Spanish review progress. There's no soft-delete or recovery window; once it's done, it's done on our end. (If the app is ever run somewhere with routine database backups, deleted data could persist in a backup until that backup naturally rotates out — that's a hosting-level detail, not something the app itself controls.) You can also download a password-confirmed JSON copy from Settings. It includes your account profile and the shared records from every Camino you can access, but never password hashes, session/reset tokens, invitation secrets, or another member's email or login name.

A shared Camino is one group ledger, and the app does not record which member entered each shared walk, note, tradition response, or encounter choice. If a companion deletes their login, their membership and personal Caminos are deleted, but records already added to another person's shared Camino remain with that Camino. The owner must remove shared entries individually where the app provides that control; full owner-account deletion is blocked until companions are removed.

Imported walks can be corrected or deleted like manually entered walks. Deleting one leaves its one-way GPX fingerprint until the account is deleted so the same activity cannot accidentally be imported twice.

Security

Passwords are hashed with bcrypt and never logged or stored in plain text. Session and password-reset bearer tokens are also stored only as one-way hashes. Session cookies are host-only, HttpOnly (invisible to page scripts), and scoped with SameSite=Lax; production configuration forces the Secure flag behind HTTPS. Login and reset requests have bounded account-level rate limits. A completed email password reset signs out every existing session. Whether your connection is actually encrypted still depends on the deployment serving this app through HTTPS.

Children

Managed child logins are disabled by default. The code is designed to collect only a display name, login name, and password hash—no child email or birth date—and to keep the account inside a guardian's shared Camino. A child account always remains tagged as a child, even if its guardian separately allows community participation. We record the guardian, policy version, exact permission snapshot, and time for each grant or revocation; the history is included in the guardian's data export and is deleted with the child account. The current setting is also shown to the child in plain language. Enabling child accounts or child community features requires a child-specific direct privacy notice, a verifiable parental-consent process, guardian review/deletion controls, child-safety review, and legal review. Setting up a profile, checking a guardian box, or recording in-product authorization alone is not represented as sufficient consent.

Pilgrim community cards

An optional pilgrim card can contain your account display name or a pseudonym, a short introduction, broad region, and connection preferences. It is private by default, stores no exact or live location, and enters moderation review whenever it is enabled or edited while enabled. Staff review only those volunteered fields. Approved adult cards can appear to other signed-in adults under Walk together; pending, rejected, disabled, suspended and self-owned cards do not. Managed children never enter open discovery. Discovery does not permit direct messaging. The card is included in your account export and deleted with your account.

Adults can privately hide a discovered card or block another adult, which hides both cards from each other. A report stores the reporter, subject, selected safety reason, optional details, status and review information for staff. Reporting can also block immediately. Only one open report per pair is accepted. Staff review does not automatically suspend or delete an account. Your controls and reports you submitted are included in your export; reports submitted by someone else are not disclosed through your export. These open-discovery controls are unavailable to managed-child accounts.

Approved adults who opt into walking beside can receive a message-free invitation. We store both participants, who invited whom, whether it is pending, accepted, declined, paused or ended, who paused, and lifecycle times. Either adult may pause or end; only the person who paused may resume. Blocking ends the relationship. The relationship never exposes or combines Camino progress and is included in each participant's export. Managed children cannot participate.

An adult may choose one accepted walking-beside companion as ongoing evening company. Pressing Settle for tonight stores one updateable record for that date: the recording pilgrim's active Camino, exact ledger distance and narrative stop, plus the companion's chosen community name. It does not access the companion's Camino or claim shared physical location. Pausing, ending or blocking clears the ongoing selection but does not rewrite existing rest history. Current selection and daily records are included in the recording pilgrim's export.

Accepted adults may exchange stored asynchronous text messages. Messages are not end-to-end encrypted. A thread can show the sender's latest rest label/date but not route, distance, pace or coordinates. Pausing makes it read-only; ending or blocking removes it from active view. Senders can withdraw text, which clears the body. A recipient may report one visible message and optionally block; only that reported message and report context become visible to staff, not the ordinary thread. Staff may leave or clear the reported body. Accessible messages and reports you submitted are included in your export. Managed children cannot use conversation.

Approved adults may offer a fixed, text-free Buen Camino keepsake only to a card that welcomes gifts. The giver chooses their display name, reviewed pseudonym or anonymity. The recipient privately retains the impression; receiving never stacks more than one waiting opportunity on that Camino, and an unused opportunity lapses silently after the next waypoint. A sender cannot see whether the recipient passed goodwill onward. Mutes, blocks, opt-out and rolling send limits are enforced. Your own gift and opportunity history is included in your export; managed children cannot send or receive gifts.

Community safety records

We store short-lived account-based send and report counters to enforce rolling abuse limits across journeys. Withdrawing a message or closing a report does not reset those limits. Routine cleanup removes counters older than 24 hours.

When a participant reports a message, a separate staff-only copy of that specific text is retained for review even if the sender later withdraws it or staff hide it. Staff cannot browse unrelated private messages through moderation. Review history records the reviewer, affected account, time, action, versions and decision note. Changing the name or avatar used by a visible card returns it to review.

Automatic case retention is disabled until the operator explicitly enables it. Once enabled, closed-case context and captured reported text are cleared 90 days after review, and moderation history older than 365 days is removed except for unresolved cases. Open cases and their history are kept for review. Account deletion removes records tied to the deleted subject; a deleted reviewer's identity is removed from other accounts' retained history. Backups follow the hosting operator's rotation policy. Staff-only notes, frozen evidence and other people's reports are not added to your account export.

Waypoint reflections and community inbox

Reflections belong to your login and start private, even when you share a journey. Choosing a guestbook or next-traveler audience submits the text, chosen sharing name and story waypoint for staff review before signed-in adults can read it. It does not publish your current journey, progress or physical location. The sharing name is stored with that version; edit or withdraw the reflection to change it. Anonymous contributions hide your account identity from readers, while staff retain the author link for safety review. Your words or contact changes may still let someone infer your identity.

Shared edits return to review. Withdrawing clears the reflection's body; a copy already reported by a reader remains available to staff under the report policy. A reflection report stores only the reported version, reason, optional context, reporter, author, status and review record. Newly hiding or blocking an anonymous author uses a private restoration handle, without putting the author's account name or account ID in your safety list or export.

The community inbox stores generic event references, times and your own read/archive choices for invitations, connections, messages, gifts and review updates. It does not duplicate private message bodies, send email or push notifications, or tell anyone when you read an entry. Current consent, ownership and blocks are rechecked before a source can appear or open. When the operator explicitly enables retention, inbox metadata expires after 90 days without deleting the underlying content. Closed reflection-report context and evidence expire after 90 days; unresolved cases and pending-review history remain protected from automatic expiry.

Your account export includes your reflections, inbox metadata, your submitted reflection-report context/status and opaque safety choices. It excludes staff-only notes/evidence and other members' private reflections or inbox choices. Account deletion removes your personal reflection/inbox records; reports tied to a deleted author are removed, and deleted reviewers are anonymized in others' retained history. Adult-only reflection and inbox access does not enable child participation.

Changes

This is a small, evolving personal project. This page will be updated as features change; history of those changes lives in the project's git history like everything else.