Privacy Policy

ShadePath generates routes optimized for outdoor comfort using dozens of environmental factors including weather conditions, terrain, and vegetation coverage.

ShadePath provides environmental comfort guidance for informational purposes only. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Always consult a healthcare professional before making health decisions based on environmental conditions.

Your privacy matters to us. This policy describes what data ShadePath collects, how we use it, and the choices you have. We designed ShadePath with a simple principle: your location data belongs to you. By default it stays on your device. The one exception is Live Location Sharing, which you turn on yourself and can stop at any time — described below.

Data Processed On Your Device Only

The following data is, by default, processed on your phone and is not transmitted to our servers — with one exception you control: Live Location Sharing, described below.

• GPS coordinates — used to determine your location and generate routes. Not stored on our servers, except your live position during an activity you choose to share (see Live Location Sharing below).
• Walking distance — tracked locally to show your daily mileage.
• Route geometry and waypoints — the detailed path of your route exists only on your device.
• Shade and sun scores — computed on your device using environmental data.
• Profile photo — if you choose to set a profile avatar from your camera roll, it is stored on your device only and is never uploaded to our servers.

Data Stored On Our Servers

If you create an account by signing in with Apple or Google, we store the following in our database hosted on Supabase in the United States (East region). Our legal basis for processing this data is performance of the service you have requested by creating an account.

• Authentication identity — a token from Apple or Google that verifies your account. We do not store your Apple or Google password.
• Profile information — your display name, persona selection (such as Runner or Pet Owner), and preferences for units, voice guidance, and haptic feedback.
• Route metadata — when you save a favorite or complete a walk, we store the route name, distance, shade score, route category, and a general origin label (such as "Near Bethany Lakes Park"). Apart from Live Location Sharing (described below), we never store GPS coordinates, route geometry, or waypoints on our servers.

Live Location Sharing

ShadePath includes an optional feature that lets you share a walk, run, or ride while it is in progress. It is off unless you turn it on.

If you choose to share, ShadePath sends your live location to our servers so the person you share with can see it on a map, for the duration of that activity. They open your link in ShadePath and sign in to view it, so the share is tied to both your account and theirs. Sharing stops when the activity ends, when you stop it, or shortly after your device stops sending updates. Your shared location is never used for advertising and is deleted afterward. You can stop sharing at any time from the app or the notification.

If You Use ShadePath Without an Account

If you tap "Continue without account," zero personal data is stored on our servers. All route data is processed on your device and exists only for the duration of your current session. When you close the app, it is gone.

Third-Party Services

ShadePath relies on the following services to function. Each receives limited data strictly necessary for its purpose. Apart from Supabase (our own database, which stores your account and profile as described above), no user identity, personal information, or device advertising identifiers are sent to these services.

• Mapbox — receives coordinates to render maps, generate walking directions, search for destinations, and snap waypoints to roads. This data is transmitted in real time and is not stored on our servers. Mapbox processes this data under their privacy policy.
• Visual Crossing — receives coordinates to retrieve current weather conditions, UV index, and air quality for your route. No user identity is transmitted — only coordinates and our API key. Visual Crossing processes this data under their privacy policy.
• Supabase — hosts our authentication system and user profile database in the United States (East region), and during an active Live Location Share temporarily stores your live-location data (deleted after the activity). Processes data under their privacy policy.
• Firebase Crashlytics — collects anonymous crash reports to help us identify and fix bugs. No personal information, GPS coordinates, or user identity is included in crash reports. Google processes this data under their privacy policy.
• PostHog — collects anonymous usage analytics to help us understand how the app is used. Hosted in the European Union. Uses internally generated anonymous identifiers only. No GPS coordinates, device advertising identifiers, or personal information is collected. PostHog processes this data under their privacy policy.

In future updates, we may integrate additional services for subscription billing and push notifications. We will update this privacy policy before activating any new service.

Data We Never Collect or Share

• We do not store GPS coordinates on our servers, except your live position during an activity you actively choose to share — which is deleted afterward.
• We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.
• We do not collect or use device advertising identifiers.
• We do not access your contacts or files.
• We do not track your browsing or search history.
• We do not use your data to build advertising profiles.

International Data Transfers

ShadePath's servers are located in the United States. If you use ShadePath from outside the United States, your profile and route metadata will be transferred to and processed in the United States. We protect your data using encryption in transit (HTTPS) and Row Level Security on our database to ensure each user can only access their own data. By creating an account, you consent to this transfer. If you prefer not to transfer data internationally, you may use ShadePath without an account — in which case no data leaves your device.

Future Biometric Data

In future versions, ShadePath may optionally integrate with wearable health and fitness devices such as smartwatches and fitness trackers to read heart rate and activity data for enhanced comfort guidance. This data will be processed on your device only and will never be transmitted to our servers. You will be asked for explicit consent before any biometric or health data is accessed, and you can revoke that consent at any time in your device settings.

Children

ShadePath is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Data Retention and Deletion

Route history is retained for as long as your account exists, up to a maximum of 50 entries per user. Older entries are automatically removed when this limit is reached.

You can delete your account at any time from the Profile screen in the app. You can also delete your account from a web browser at shadepath.app/delete-account. When you delete your account, all data associated with it — including your profile, favorites, and route history — is permanently deleted from our servers immediately, with any residual backup copies removed within 30 days.

Your Rights

Depending on where you live, you may have specific rights regarding your personal data.

All users — You can use ShadePath without an account (no data stored on our servers). You can delete your account and all server-side data at any time from the app or from shadepath.app/delete-account. You can revoke location permission in your device settings at any time.

European Economic Area, United Kingdom, and Switzerland (GDPR) — You have the right to access, correct, delete, and port your personal data. You have the right to restrict or object to processing. You have the right to withdraw consent at any time. Our legal basis for processing is performance of the service you requested by creating an account. To exercise these rights, contact us at the email below.

California (CCPA/CPRA) — You have the right to know what personal information we collect and the right to delete it. You have the right to opt out of the sale of personal information. We do not sell your personal information. To exercise these rights, contact us at the email below.

Brazil (LGPD) — You have the right to access, correct, anonymize, and delete your personal data. Contact us at the email below.

We will respond to all data rights requests within 30 days.

Your Choices

You can use ShadePath without creating an account — no personal data is stored on our servers. You can revoke location permission at any time through your device settings; ShadePath requires location access to generate routes but retains no location data when permission is revoked. You can delete your account and all associated data at any time from the Profile screen in the app or at shadepath.app/delete-account.

Security

We use Row Level Security on our database to ensure each user can only access their own data. Authentication is handled through Apple and Google's secure sign-in protocols. We do not store passwords. All data in transit is encrypted via HTTPS.

Changes to This Policy

We may update this Privacy Policy as we add new features or as legal requirements change. We will notify you of material changes through the app or by email. The "Last Updated" date at the top of this page reflects the most recent revision.