Information you provide
Account information: email address, display name, and password. Passwords are stored as salted bcrypt hashes; we never see or store your plaintext password.
Profile preferences: units, notification settings, biometric unlock preference, selected avatar preset, optional cloud-sync preferences, and app settings.
Profile avatar photos: custom avatars stay on the device by default and are not uploaded to Epicrest backend servers. On iPhone, if you enable avatar iCloud sync, the cropped avatar is stored in your private iCloud account for restore on your Apple devices. Android custom avatars currently remain device-local; journal-photo Google Drive Sync does not transfer the Android custom avatar.
Journal and visit content: date and time you summited a peak or visited an outdoor place, the selected peak/place/route and optional trail or road, notes, tags, visited/planned status, sync metadata, and weather snapshot notes if you choose to add them.
Saved and planning content: saved peaks, saved outdoor places, saved routes, outdoor plan entries, target dates, priorities, planning notes, route selections, saved weather windows, weather snapshot notes, and tags. This metadata may sync with the Epicrest backend so it follows your signed-in account and reconciles changes from your devices.
Journal photos and AR captures: journal photos remain on device and may also live in your private iCloud container or, when you explicitly enable Google Drive Sync, encrypted in Google Drive's hidden app-data folder. Before Drive transfer, images have embedded metadata removed and are encrypted on-device with AES-256-GCM. Epicrest backend servers never receive your Drive access token or plaintext journal photo. AR captures are processed on device; shared and saved capture images strip EXIF and precise location metadata before export, and exact coordinates are not included by default.
Social-post drafts: Epicrest can generate a temporary image card and editable caption for supported peak, Journal, plan, and AR sharing flows. A note you entered can appear in the editable draft so you can review or remove it before sharing. Cards are generated on device and are not uploaded to Epicrest servers. On Android, a Journal source photo is decoded and repainted into a new JPEG without copying its original filename, EXIF, or GPS metadata. Epicrest hands the card and caption to a third-party app only when you select Open; that app then controls the final draft and post. Android checks only the selected supported destination locally and does not send Epicrest an installed-app list.
Shared peak links: when you share a peak from Peak Detail, Epicrest creates a public epicrest.app peak link that contains the peak identifier and opens that public peak record in the app when possible. The link does not include your Journal notes, outdoor plans, saved state, photos, exact location, or other private account content.
Place and trail improvement suggestions: if you use Help improve this place or Improve Trail, we store the target place or route, title, notes, proposed facts, and any optional photos you choose to attach or capture. If you opt in, those photos may be reviewed for use in public place or trail profiles. Suggestions are stored for review and do not immediately change public place or route data.
Support and feedback submissions: messages, issue reports, feature requests, data-quality reports, and any screenshots or photos you choose to include.
Subscription and purchase information: if you subscribe to Epicrest Pro, we receive and verify information issued by Apple or Google such as the product and plan, receipt or purchase token, entitlement status, renewal or expiration time, cancellation state, and an account-binding identifier used to prevent one purchase from being claimed by another Epicrest account. Marketplace server notifications may update that lifecycle state. We do not receive your payment card information.
Information collected automatically
Device location, only when you grant permission, is used to show nearby peaks, outdoor places, routes, alerts, recommendations, distance, bearing, weather context, Pro offline-pack estimates, and AR features. Precise foreground coordinates are processed on device and sent to our servers transiently for nearby-data requests. We do not collect precise background location or create a continuous history of your device's movement. When you are signed in, Epicrest does retain coordinates that belong to content or actions you choose: the selected peak, place, or route in saved items, plans, and Journal records, plus an offline-pack download-history record created when a Pro download is requested, containing the chosen center rounded to two decimal places, radius, and pack generation/expiry timestamps. Those account records are included in the deletion scope described below. Our map provider's on-device SDK (Mapbox) may also process your foreground location to render maps, as described in Who we share data with.
Elevation and heading, only when you grant permission, are used by AR and altimeter features and are processed on device.
Camera and motion processing is optional. Epicrest uses the camera while you open the live AR view or when you explicitly choose to take a Journal, plan, or place/trail-improvement photo where that action is available. Custom avatars use the system photo picker rather than the camera. Camera frames, device attitude, heading, and local skyline analysis are processed on device. An image is retained only when you choose to capture, attach, save, or share it. Epicrest does not use the camera in the background.
Local AR alignment diagnostics may be written inside the app's private container when you use guided calibration, save a whole-view correction, or choose Report mismatch. Depending on platform and action, a local record can include timestamp, peak identifier and name, original/corrected projected positions, current coordinates and altitude, compass and location accuracy, motion stability, confidence, correction offsets, and camera-tracking quality. Epicrest does not automatically upload these local diagnostic files. They leave the device only if you explicitly include relevant information in a support or feedback submission.
Google Play Services for AR (ARCore) is used for visual-inertial camera tracking on supported Android devices. Google states that ARCore always collects a Google account identifier or device identifier, performance and diagnostic data, and ARCore API usage and app activity for analytics, reliability, and improving AR experiences. That required collection is handled by Google under the Google Privacy Policy. Camera frames used for local tracking, peak labels, skyline matching, and captures remain on device in this implementation; Epicrest does not enable ARCore Cloud Anchors or Geospatial.
Mapbox SDK data may include map and style requests, map interactions, device or other identifiers, app and SDK information, diagnostics, and foreground location when location-enabled map features are used. This processing is governed by the Mapbox Privacy Policy. The visible Mapbox attribution control on interactive maps opens provider information and Mapbox telemetry controls where supported.
API request logs include method, URL path, response status, request duration, and IP address for debugging, monitoring, and abuse prevention. App version, operating-system version, and device model may also be included to investigate crashes and compatibility issues. Request logs are retained for 30 days. When an account is deleted, account-linked request logs are deidentified by removing the account, IP, app, operating-system, and device fields.
Information we do not collect
- We do not collect journal photos on our servers. Photos remain on device, in private iCloud, or encrypted on-device for optional Google Drive Sync.
- We do not upload custom avatar photos to Epicrest backend servers. Optional avatar iCloud sync on iPhone uses your private iCloud account; Android custom avatars remain device-local and are not part of journal-photo Drive Sync.
- We do not automatically upload local AR calibration or mismatch diagnostic files.
- Epicrest backend servers do not receive Google Drive access tokens or Drive file identifiers.
- We do not track you across other apps or websites.
- We do not run third-party advertising SDKs or sell personal information.
- We do not access your photo library beyond images you explicitly pick or capture inside Epicrest.
- We do not collect precise background location.
- We do not include private Journal, Plans, saved place, photo, or account content in shared peak links.
- We do not include exact coordinates in AR capture exports by default, and shared/saved AR capture files strip EXIF and precise location metadata before leaving the app.
How we use your information
- To provide the service, including peak, park, route, and outdoor-place discovery, recommendations, weather, alerts, logging, account sync, and payment entitlement checks.
- To improve the app by diagnosing crashes, measuring feature usage in aggregate, reviewing pending place/trail suggestions, and understanding which outdoor-data workflows need more work.
- To communicate about account, service, security, and material product updates.
- To detect and prevent abuse or misuse.
Google API Services Limited Use: information Epicrest receives from Google APIs is used only to provide or improve the user-facing Google sign-in, account-linking, and optional encrypted Google Drive Sync features you choose. We do not sell Google API data, use it for advertising, or use it to train generalized artificial-intelligence or machine-learning models. Epicrest's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who we share data with
We do not sell personal information. We share limited data with providers used to deliver Epicrest: Apple for CloudKit, StoreKit, Sign in with Apple, optional private iPhone avatar sync, and directions when requested; Google for Google Sign-In and, in v2.3 release-candidate builds, Google Play purchases and lifecycle notifications, optional Google Drive app-data sync, and Google Play Services for AR visual-inertial tracking on supported Android devices; Mapbox for interactive maps, authorized Epicrest Pro offline map downloads on iPhone and in Android 2.3 release-candidate builds, service operation, telemetry, and diagnostics as described above; OpenStreetMap contributors and Overpass plus public sources such as GeoNames, Wikidata/Wikimedia, USGS GNIS, NPS, RIDB, public-land, boundary, and topographic sources for public outdoor data; Open-Meteo for forecasts; MapTiler and the Iowa Environmental Mesonet (IEM) for available weather-map and NEXRAD radar overlays; and infrastructure providers for hosting, database, caching, monitoring, email, and authenticated marketplace notifications. Mapbox map requests and other public outdoor-data requests use coordinates but do not carry your Epicrest account identity. If an Android 2.3 release-candidate build uses the attributed interactive fallback map, its embedded browser loads Leaflet resources from a public content-delivery network and standard OpenStreetMap tiles for the visible viewport; those providers receive ordinary request information such as IP address, user agent, and requested map area. That fallback is for interactive viewing only and does not bulk-download public tiles into offline packs. When the app displays a source image or other hosted media, it can load the media URL directly from Wikimedia or another named public source; the media host receives ordinary request information such as IP address, user agent, and the requested asset, but no Epicrest account identity. Weather-map providers receive tile or public map-region coordinates plus ordinary network information, but no Epicrest account identity. Each provider's privacy policy applies. We may disclose information if required by law or to protect user safety.
Cloudflare Turnstile protects the public Support and Account Deletion forms from automated abuse. When either form loads or is submitted, Cloudflare processes ordinary browser, device, and network signals under the Cloudflare Privacy Policy; Epicrest receives the verification result and does not use it for advertising.
If you choose to post or share through another app, that destination receives the content you send or paste and its own privacy policy and terms apply.
Your private cloud data
On Apple devices, when iCloud Sync is enabled, Journal, Plans, and photos synchronize to your personal iCloud account using Apple's CloudKit service. The iCloud copy lives in your private iCloud container, and Epicrest backend systems cannot retrieve journal photos from iCloud. Optional iPhone avatar sync is a separate iCloud control for the cropped profile image.
In v2.3 release-candidate builds, Google Drive Sync is a separate optional cross-platform path for Journal media on iPhone and Android. Images have embedded metadata removed and are encrypted on-device with AES-256-GCM before they are sent directly to Google Drive's hidden app-data folder under opaque names. Epicrest stores the media key only as an encrypted server envelope returned over authenticated TLS; the usable key is protected by Keychain or Android Keystore. Epicrest backend servers never receive the Drive access token, Drive file identifiers, or plaintext photo. Android custom avatar photos are not currently transferred by this Journal-media path and remain device-local.
Turning either provider off, signing out, or deleting an Epicrest account stops future synchronization but does not silently delete copies already stored by Apple or Google. Remove provider copies through your iCloud or Google account/app-data controls. Signed-in saved-item, plan, and journal metadata can continue to sync without photo files.
Android system backup and device transfer
In Android 2.3 release-candidate builds, Epicrest disables Android Auto Backup and device-to-device transfer for app data. Account credentials, journal metadata and photos, saved and planned items, custom avatars, offline packs, personal-sync records, Google Drive bindings and keys, databases, files, and preferences are excluded from Android system cloud backup and device transfer. Optional encrypted Google Drive Sync is separate and occurs only when you enable it.
Your rights and choices
Access and export: request a copy of account data we hold through the support form or email support@epicrest.app.
Deletion: delete your account from Settings → Delete Account, or use the dedicated request page at https://epicrest.app/account-deletion/ if you cannot access the app. Deletion removes the active server account, authentication sessions, subscription receipt and ownership records, summit/place journal metadata, saved and planned data, personal-sync records, offline-pack history, and signed-in support, issue, and feature submissions with their attachments and replies. Android also removes that account's local journal and photos, personal preferences and sync records, custom avatar, Drive binding and usable media key, reminders, queued work, and user-scoped offline packs while preserving public map caches and device-wide appearance choices.
Retention after deletion: account-linked operational and audit records are retained only after account, IP, device, and free-form identifying details are removed. Routine restricted service backups are retained for up to 14 days and are not used to recreate a deleted account in the live service. We may retain narrowly required information for law, fraud prevention, security, or dispute obligations. Private iCloud or encrypted Google Drive copies and user-created ZIP, image, or other exports remain under your control and must be removed separately.
Subscriptions: deleting an Epicrest account does not cancel a subscription purchased through Apple or Google. Use the applicable store's subscription controls separately.
Location and notifications: manage permissions in Epicrest or your device's system settings. Epicrest continues to work with reduced functionality when location is off.
Security
- Passwords are stored as salted bcrypt hashes.
- Network traffic uses HTTPS/TLS.
- Authentication tokens and usable media keys are protected by iOS Keychain or Android Keystore.
- Production access is restricted to authorized personnel.
No system is perfectly secure. Use strong, unique passwords and enable biometric unlock where appropriate.
Children
Epicrest is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact support and we will remove it.
Website performance analytics
The public epicrest.app website uses Cloudflare Web Analytics to measure page views and real-user performance such as loading speed and Core Web Vitals. Cloudflare states that this privacy-first measurement does not use cookies, local storage, cross-site tracking, or fingerprinting to identify individual visitors. The browser loads Cloudflare's performance beacon, and the proxied site sends timing data to its own /cdn-cgi/rum endpoint. We use these aggregate measurements to find slow or ineffective pages, not for advertising.
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced in-app and by email where available. The Last updated date indicates when changes were last made.
Contact
Questions about privacy? Email support@epicrest.app or use the support form. Account-deletion requests can also be submitted at https://epicrest.app/account-deletion/.