Privacy and your planning data

Optional journey analytics

On www.trailready.run, Google Analytics 4 loads only after you choose Allow analytics. It measures visits to broad screens and successful planning steps such as saving, reopening, importing, sharing and starting a file download. It uses a pseudonymous browser identifier and analytics cookies; Google processes device, browser and approximate location information. These are aggregate product signals, not evidence that a file reached a device or that a trip took place.

Analytics receives static screen labels and bounded event categories. We exclude trip names, notes, route coordinates, imported file names, account details, private links and sign-in callback pages. Advertising storage, Google signals and advertising personalization are disabled. Full URLs and query strings are replaced with safe virtual screen addresses; referrers are reduced to their origin.

After consent, a successful save or reopen that opens another page can leave a short-lived, category-only record in this tab’s session storage. The next page consumes it once; it expires after 30 seconds and is cleared on withdrawal. It contains no trip or account details.

Choose No thanks to keep analytics off. Analytics choices at the bottom of the page lets you change your choice; withdrawal stops collection and removes this site’s analytics cookies. Your choice is stored in this browser. Withdrawal does not erase previously received reports. Preview hosts and offline actions are not collected, and actions before consent are not replayed. Blocking analytics does not restrict guest planning or sign-in.

Browser-local plans

The guest planner stores trips, checklists, weather snapshots and downloaded map areas in this browser. They are not uploaded merely by signing in. Browser storage may be cleared or evicted; an editable JSON export is a separate backup. Other people using this browser profile can see local plans, even after you sign out. A separate offline gear snapshot holds bounded temperature thresholds and a save time without credentials or account identity; the app labels it when the account cannot be checked and clears it after confirmed sign-out, guest status or account change.

Laravel account services

Google sign-in identifies a Laravel account when configured for this deployment. The account service stores gear preferences, explicitly shared plan snapshots, pending proposals/drafts, grants and expiring exports. HTTP-only session cookies identify the first-party browser. OAuth tokens authorize assistant clients separately. Provider credentials and the application encryption key belong outside the synced workspace.

Deliberate sharing

A shared snapshot includes route geometry, stops, notes and any group/contact agreement stored in that plan. Authorized assistant hosts receive requested shared content and account preferences under their own processing policies. Stop sharing and connection revocation block future authorized requests according to current server checks; content already copied to a chat or downloaded cannot be recalled.

Weather and maps

Loading weather sends mapped stop coordinates and dates to Open-Meteo. Basemap viewing requests tiles from the named map provider. Optional offline map downloads use approved public terrain sources; the Canadian map endpoint is a fixed provider proxy. No arbitrary browsing proxy or account credential is provided to those services.

Temporary files and logs

Assistant-generated PDF/GPX URLs are expiring bearer links. Anyone possessing a link can download the file until expiry or server invalidation. Files may contain plan notes. Request processing and hosting logs have separate operator-controlled settings; this local implementation does not establish a production retention or deletion guarantee. Keep private records and credentials out of public files, prompts and source-control history.

Account migration and browser continuity

Browser libraries belong to this browser and origin. Signing in, changing devices or opening another origin does not transfer those local files. Move them with an explicit JSON export/import. Assistant grants remain tied to the service where you approved them; reconnect explicitly when moving services.