Trail Signal — Privacy Policy

Trail Signal is a UK-based mapping application that shows mobile phone signal coverage on hiking and walking routes. It is operated by an individual developer based in the United Kingdom.

For the purposes of UK GDPR, we are the data controller for the personal data described in this policy.

2. What Data We Collect

Account Data

When you sign in, we receive basic information from your authentication provider (Google Sign-In via Firebase Authentication):

Email address and display name
Firebase User ID — a unique identifier for your account

We do not store your password. Authentication is handled entirely by Google/Firebase.

Location Data (GPS)

When you use the Record Walk feature on the mobile app, we collect GPS coordinates from your device at regular intervals (approximately every 3 metres of movement). This data includes:

Latitude, longitude, and altitude
Timestamp of each GPS reading
Speed and heading (where available)

GPS data is collected only while you are actively recording a walk. We do not track your location in the background at any other time. You start and stop recording manually.

If you enable Background Location permission, GPS recording continues when the screen is off or the app is in the background — but only during an active recording session that you have started.

Mobile Network Data

During recording, the app collects information about the mobile cell tower your phone is connected to. This includes:

Operator name (e.g. EE, Three, O2, Vodafone)
Signal strength (RSRP in dBm)
Cell tower identifiers (eNodeB, CID, TAC, PCI, EARFCN)
Timing Advance (TA) — a distance estimate from the tower
Radio band and technology (4G LTE, 5G NR)

This data is paired with your GPS location to build a picture of where signal coverage exists along your route.

GPX Route Files

When you upload a GPX file (a standard GPS route file), it is stored privately in your account. GPX files contain GPS waypoints and track points that describe a hiking route.

Community Signal Data

After recording a walk, cell signal observations from your track may be extracted, anonymised, and contributed to the Community Signal layer. This shared dataset helps all users see where signal coverage exists. See Section 5 for details on how this data is anonymised.

3. Why We Collect Your Data (Lawful Basis)

Data	Purpose	Lawful Basis
Account data	Identify you and sync your data across devices	Contract (providing the service)
GPS tracks	Record your walking route for personal review	Consent (you choose to record)
Cell signal data	Map signal coverage along your route	Consent (you choose to record)
GPX uploads	Store your planned routes for use in the app	Contract (providing the service)
Community Signal	Improve coverage data for all users	Legitimate interest (improving the service, balanced against minimal privacy impact due to anonymisation)

4. How We Store and Protect Your Data

Cloud Storage

Your account data, GPX files, and recorded tracks are stored in:

Cloudflare R2 (private bucket) — GPX files and track binary data, accessible only via authenticated API requests with your Firebase JWT token
Firebase Authentication — account credentials, managed by Google

User data is stored in a private storage bucket that has no public URL. It can only be accessed through our authenticated API, which verifies your identity before returning any data. No one else can access your routes or tracks.

On-Device Storage

The mobile app stores data locally on your device using IndexedDB (a browser/app storage mechanism):

Recorded tracks (GPS points and cell observations)
Uploaded routes
Downloaded trail maps for offline use

This data stays on your device and is not transmitted unless you choose to sync it.

Data Location

Cloud data is stored on Cloudflare's global network and Google's Firebase infrastructure. Both providers maintain appropriate safeguards for data stored outside the UK, including standard contractual clauses where applicable.

5. Community Signal — How We Anonymise Contributions

When your recorded walk data is contributed to the Community Signal layer:

Cell observations are snapped to a 50-metre grid — your exact GPS position is rounded, so no one can trace the precise path you walked
Your identity is represented only by a truncated hash of your user ID (8 hex characters derived from a SHA-256 hash) — this prevents duplicate counting but cannot be reversed to identify you
No timestamps, route names, or GPS tracks are included in Community Signal data
The shared data contains only: grid position, operator, signal strength (RSRP), and radio band

Community Signal data is stored publicly and is accessible to all app users as part of the coverage map.

6. Who We Share Your Data With

We do not sell your data. We share data only with:

Google Firebase — authentication services (account management)
Cloudflare — hosting, content delivery, and private data storage

These providers act as data processors on our behalf. Both maintain their own privacy policies and data processing agreements.

We do not share your personal data with advertisers, analytics companies, or any other third parties.

7. How Long We Keep Your Data

Data	Retention
Account data	Until you delete your account or request erasure
GPX routes	Until you delete them or delete your account
Recorded tracks	Until you delete them or delete your account
Community Signal contributions	Retained indefinitely as anonymised aggregate data (cannot be linked back to you)
On-device data	Until you clear app data or uninstall the app

8. Your Rights

Under UK GDPR, you have the following rights:

Access — request a copy of the personal data we hold about you
Rectification — ask us to correct inaccurate data
Erasure — ask us to delete your data ("right to be forgotten")
Restriction — ask us to restrict how we process your data
Portability — receive your data in a standard format (GPX files are already in an open format)
Objection — object to processing based on legitimate interest
Withdraw consent — stop recording at any time; delete synced data from the app

To exercise any of these rights, contact us at [email protected].

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
ico.org.uk/make-a-complaint | Helpline: 0303 123 1113

9. Children

Trail Signal is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Cookies and Local Storage

Trail Signal does not use tracking cookies or advertising cookies. We use browser localStorage and IndexedDB solely to store your app preferences (map position, layer settings) and offline data. No data is shared with third-party analytics or advertising services.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the app. The "last updated" date at the top of this page will always reflect the current version.

Privacy Policy

1. Who We Are