Trailborn Privacy Policy

This document has not been reviewed by a lawyer.

Document version: 2026-10-24
Effective date: 22 October 2026

Who processes your data

The data controller is Michał Mijalski, a private individual running the Trailborn project under the name Forest Nap Studio.

• postal address: ul. Południowa 54, 42-229 Częstochowa, Poland
• e-mail: forestnapstudio@gmail.com

Trailborn turns your everyday movement into territory on a map. This document says what reaches us, why, who we pass it to and how long we keep it. It describes the game as it actually works on the document version date above.

Age

Trailborn is intended for people aged 16 and over. When you create an account you confirm, by continuing from the start screen that says so, that you are at least 16 and have read the terms and this policy. We do not ask for a date of birth; we store the declaration itself and use it for two things: to avoid creating an account for someone under 16, and to configure advertising correctly. Accounts created before 16 September 2026 gave a birth year, which we keep for that purpose only. We do not infer age from phone settings or from behaviour in the app.

What data we process

Account. The identifier of the Google or Apple account you sign in with, the e-mail address linked to that account (with Sign in with Apple this may be Apple's relay address if you choose so), your nickname, colour, character appearance, age declaration (a birth year only for accounts created before 16 September 2026) and app settings (language, theme, units, notifications, animation speed).

Playing without an account. You can play without a Google or Apple account. Your phone then creates a random key and keeps it in the system's protected storage (Keychain on iPhone, Keystore on Android). We store only a one way hash of that key, which lets us recognise your phone the next time you play, plus the other account data described above, without an email address. If you remove the game from an Android phone or change phones before linking a Google or Apple account, we cannot restore your progress. When you link an account, we delete the hash and you sign in with Google or Apple from then on. To limit abuse, we count new accounts created without signing in from one phone (a random installation identifier) and from one IP address; we do not store the IP address, and the counter is kept in server memory for at most one hour.

Steps and floors — three sources. With your explicit consent we read your step and floor counts from:

• Health Connect on Android, if you connect it;
• the Health app (HealthKit) on iPhone, if you grant access in the system dialog; we read steps and floors climbed only, write nothing, and HealthKit data is never used for advertising or profiling, never sold and never shared with any third party;
• the motion sensor in your phone, if you enable the step counter. This is a separate source with its own permission (ACTIVITY_RECOGNITION), requested only after you tap "Turn on the phone counter", with an explanation right above the button.

Steps and floors are converted into metres, which you spend discovering roads. Only daily totals reach the server, not the raw sensor log. The phone counter's history stays on the device for 30 days and is then deleted. Daily totals are kept for as long as your account exists — without them we cannot show statistics or detect the same activity being counted twice.

We do not read heart rate, sleep, weight or any medical records. We never write anything back to Health Connect or to the Health app. Health data is never sold, never used for advertising or ad profiling, and never passed to insurers or for credit scoring.

Height and weight (optional). We do not read them from any app. If you enter them in your profile and tick the consent box, we keep them on your account and use them to count the calories you burn walking, from your step count only. The daily total of those calories is stored with your daily steps. Nobody else sees your height, weight or calories, and we do not use them for advertising or profiling. Bjørn’s in-game total of all players’ calories includes them without identifying anyone. You can delete them in your profile at any time, and we then also delete the calories counted from them.

Location. We keep only your last position, overwritten on every change. We do not store a continuous GPS trail.

We do store which road segments you have claimed and when — that is the game state without which the map does not work. Claimed roads indicate the areas where you play. In the route privacy settings you can enable incognito mode; it shifts your future routes, while territory claimed earlier stays where it was.

Your first route. If on your first walk the phone gives no GPS position within about 20 seconds, we paint the first route from the approximate position the phone knows from the network (Wi-Fi, cell towers) or from a reading no more than 15 minutes old, accurate to within 500 metres. Later routes always wait for GPS. If you do not allow location, your first route starts in a city in your country, usually the capital. The server picks the country from your phone's time zone and, if it does not recognise the zone, from the region and language set on the phone. We then store that city and the country code as your last position; your first real position after you allow location replaces them.

Messages. The game has two chats. Messages in the team chat are visible to the members of your team. Messages in the global chat are visible to every signed-in player. Both chats expire automatically after 48 hours. You can delete your own message within 48 hours of sending it; a team administrator can delete any message in the team chat. An automatic filter masks profanity in messages before other players see them.

Flags with a message. If you plant a flag, we store the exact place where you are standing, the message (up to 140 characters), the level of the chest you leave and the time. A moderator reads the message before anyone else can see it. Flags exist only in Team War mode, so only players who belong to a team can plant, see and find them. An approved flag is visible to other players on the Team War map at exactly that place. Only the player who finds the flag sees your nickname, the message and the chest level; everyone else sees just the flag on the map. You only receive a message that someone found it, without the finder's nickname. Do not plant a flag near your home or anywhere you do not want to show to others. A flag nobody finds disappears after 30 days. We delete the record of a flag (message, place, who found it and when) 180 days after the flag closes, that is after it is found, expires, is rejected or is withdrawn, or earlier if you delete your account.

Races. If you organise a race or accept an invitation we store: the race name, the start and finish (or the duration), the invitees and their answers, your progress since the start (metres and steps, computed from the walk records we keep anyway) and the result. The other entrants see your nickname and progress. You receive the result as a message from the game in the in-app inbox.

Reports and moderation. If you report content or someone reports yours, we record: who reported, what the report concerns, the chosen reason, your optional comment and a snapshot of the reported message — chat expires after 48 hours, so without the snapshot a moderator would receive an empty case. We also record the moderator's decision and any appeal. A flag's message can be reported by the player who found it; we then also record the message and the nickname of the flag's author.

Blocks. We keep the list of people you have blocked until you unblock them.

Diagnostics. At sign-in we record the app version, device model, system version, interface language and the country code from your device settings. On a crash we record the error and its technical context. From version 1.1.45 the app also records the state of the permissions and settings the game needs — location, step access (Health Connect or Health), the phone’s step counter, notifications and the ad consent — and the kind of app that records your steps (for example “phone” or “Garmin”), without the activity data itself. This lets us explain why someone’s steps are not being counted. We do not record your IP address — with one exception, described below under invitations, where we keep a one-way hash of it for 48 hours.

Fair play. We check whether the activity is humanly possible (step cadence, floor counts, daily limits) and reject data entered manually in a health app. On first launch the app creates a random installation identifier and keeps it in the system's secure storage; its only purpose is to stop the same steps feeding two accounts. It is not a device identifier and none of your data can be derived from it.

Trailborn+ and purchases. The app sells the Trailborn+ subscription and chest bundles. Payment is handled by the store you installed the game from — Google Play or the Apple App Store. We do not receive your card number or any other payment details. The store passes us a purchase confirmation, which we verify with Google or Apple; we store the product identifier, the transaction identifier assigned by the store, the date and, for a subscription, the period it is paid up to. We also store the price, the currency and the store country that the store gives for that purchase or renewal, to count the game's revenue. We ask the store for the subscription status at renewal. We also record whether a free trial is running — the monthly chest bundle is not given during one. Free Trailborn+ days (for invitations, from events, as a gift from another player or from us) are recorded on the account together with their source; if you have a paid subscription, they wait until it ends. For every paid month of the subscription you receive 3 days of Trailborn+ to give away: to a person you choose, to a random player without Trailborn+ who has opened the game in the last 2 days, or to nobody. We record your choice, the recipient and the date. A person you choose yourself receives a message with your nickname; a randomly chosen person is not told who the days are from, and you receive a message with their nickname. You can see your own gift record in the game. A free trial does not earn a gift.

Invitations. Every account has a personal invitation link and code. When someone accepts your invitation, we record who invited whom, how the game recognised the invitation (a link, a code, the Google Play store or a visit to the invitation page), on how many different days the invited person has played and when both of you received Trailborn+ days. The inviter sees the invited person's nickname and their progress towards the reward. When someone opens an invitation page, we keep for 48 hours a one-way hash of the IP address (computed with a secret key; the address itself is not stored) and the type of device. Its only purpose is to let the game ask a new player on an iPhone — where the App Store does not pass the invitation on — whether they came through an invitation; the new player always confirms it themselves. When the invited person plays on 3 days, people further up the invitation chain are rewarded too: whoever invited the inviter (2 days of Trailborn+), the person one level higher (1 day) and everyone above them (a level 1 chest). Each of them receives an inbox message with the nickname of the invited person and the nickname of the person who invited them. If someone in the chain deletes their account, we record the link to the nearest person above them so that the chain does not break; the deleted account itself is not kept.

Points, challenges and expeditions. We record the points you earn and spend in the game. If you take on Bjørn's weekly challenge, we record the week, the step target, your step count from the previous week, the points set aside and the result. You get the result as a message from Bjørn in the in-app inbox: after a successful week with the week's goal, after an unsuccessful one with the number of steps you were short. With notifications on, a notification may also come; it says at most that the goal was reached and that a message is waiting, without the number of steps. During a community expedition we count your distance from your daily step totals and show it in the expedition ranking.

Daily streak and step goal. We record your streak of days in the game: your current and your longest streak, the last day counted and the day Bjørn covered for you, and for each counted day its number in the streak, the level of that day's chest and when you claimed it. A day counts when you open the game and a synchronisation runs. The step target of the daily quest is your own: we work it out once a day from the median of your daily step totals over the last 7 days and store it together with that median and the number of days it was based on. Only you see your streak and your target. We keep them until you delete your account.

Starter chest. At the end of your first painted route we place a starter chest that only you can see. We store with your account where it stands (the end of that route), its level, when it was placed and opened, and what it contained, so that opening it again gives the same rewards. There is one starter chest per account and one per phone. That is why we store with it the random identifier of your installation of the game, which the app sends when you sign in and which stays on the phone until the game is uninstalled (a different identifier from the one described above under "Fair play"). Separately, without any link to your account, we store that identifier on its own with the date the chest was given, so that a second account created on the same phone does not get a second chest. The record on your account is deleted with the account. The identifier with its date stays even after the account is deleted, because that is exactly when it prevents abuse.

First launch. The app records on our server which first-launch screens (profile, location, first walk, starter chest, first route summary, steps, ad consent, notifications) were shown, which you completed and which you skipped, when, and how long after the screen appeared, together with the app version and the system (Android or iOS). This shows us on which screen new players give up, so that we can improve it. Only we see these records, in the admin panel. We keep them until you delete your account.

Team deputy. A team administrator can name one deputy from among the team's members; we store with the team who it is. Team members see the deputy's nickname, and the team chat announces in a system message, with the nickname, who has become deputy and that the deputy has taken over the team. The deputy can change the team crest, accept and decline requests to join and remove members (except the administrator), so the deputy sees join requests and receives notifications about them. The deputy is first in line to take over the team when the administrator leaves it, deletes their account or has their account suspended. The deputy also takes over when the administrator shows no sign of life for 14 days, that is syncs no walk, does not sign in and does not connect to the server from the app; the roles then swap and the former administrator becomes the deputy. The appointment ends when the deputy steps down, the administrator withdraws it or the deputy stops being a member of the team, including by deleting their account.

Advertising. Advertising in Trailborn is entirely voluntary: you watch an advertisement when you choose to claim a chest or a shortcut (an extra kilometre of road) for it. There are no banners and no full-screen advertisements shown without your decision. Advertisements are served by Google AdMob, which may use the advertising identifier and technical device data to serve the advertisement, cap frequency, produce aggregate reports and prevent abuse.

Whether an advertisement is personalised depends on your decision. In the European Economic Area, the United Kingdom and Switzerland we show Google's consent form before the first advertisement; without consent to personalisation we request non-personalised advertisements only. On iPhone the system tracking question applies as well; declining it also means non-personalised advertisements. Accounts whose age declaration is below the age of consent always receive non-personalised advertisements, whatever the form says. Outside those regions advertisements may be personalised according to the advertising settings of your system. You can change your decision in the app's privacy settings.

To grant your reward after an advertisement, Google sends us a confirmation. We do not pass your account identifier for this: our server issues a single-use, random token valid for 60 minutes, which expires once spent. Google does not learn whose advertisement it was.

Measuring advertising campaigns and use of the game (Firebase Analytics, Android). Trailborn advertises on Google Ads. To see which campaigns bring players who create an account and come back to the game, and to see in aggregate reports how players use the daily streak and the card inviting them to join a team, the Android app uses Google Analytics for Firebase (provider: Google). Google receives: the app instance identifier assigned by Firebase, the device's advertising identifier, the phone model, the system and app versions, the language, the country or region Google derives from the IP address (Google Analytics does not store the address itself) and these events: first launch, creating an account or signing in (with the method: Google, Apple or without an account), the first painted route, opening the starter chest, coming back to the game at least one day and at least one week after the account was created, a streak day counted (the day number), a streak reward claimed (the day number and the chest level) and the team card (shown, joining a team, creating a team or closing the card). We do not pass your account identifier, nickname, e-mail address, steps, location or health data. Measurement depends on the advertising consent in Google's form described above; there is no separate question. Nothing is sent to Google before you answer the form: events from that time (for example creating an account or signing in, the first route, opening the starter chest, a streak day) wait on the phone, each at most once per account, and are sent only once you consent. In the European Economic Area, the United Kingdom and Switzerland nothing is sent without your consent, and the events waiting on the phone are deleted. Outside these regions measurement starts once the form confirms that consent is not required. Data from accounts that declared an age below the age of consent is never used for personalised advertising or advertising audiences. Google keeps event data for 2 months; after that only aggregate reports remain. On the phone we store the date the account was created, which of these events have been sent or are waiting, and the last streak day reported, so that none is sent twice. You can change your decision in the app's privacy settings; withdrawing consent turns measurement off. Firebase Analytics is not used on iPhone for now.

Notifications. If you enable them, we store the device's push notification token, its language, the kinds of notification you chose and the phone's time zone. When you disable them, the token is deleted from the server and from the device. Notifications about achievements, settled steps and the daily reminder are created locally on the device. The next day's walk reminder comes at the time of day you choose when asked about notifications (morning, midday or evening); we keep that choice only on the phone and do not send it to the server. Messages from the game (race results, rewards, announcements, Bjørn's morning summary of the previous day) go to the in-app inbox.

If you turn notifications on, the server may send at most two automatic notifications a day, by your own calendar, and sends none at night, from 21:30 to 8:30 your time. You can switch each kind off in Options. The kinds:

• attack on territory: another team is taking your team's roads within 1.5 km of the last position your phone reported (we treat it as the area around your home); the notification names that team, the length of the roads taken and the district or town;
• team territory lost while you are away;
• flag found: someone found your flag (without the finder's nickname);
• challenge: on Sunday afternoon, when Bjørn's weekly challenge is one walk short of its goal, and during the day on Monday, when the server does not yet see last week's goal reached, so that Sunday's steps arrive before the week is settled;
• last week's ghost: in the evening, when at this time a week ago your walk was clearly longer;
• a postcard from Bjørn: once a week, a fact about a town or district your route passed through that week;
• Trailborn+ days for an invitation, and one reminder after three days away;
• a new personal message in the inbox, for example about a level, a Trailborn+ gift (with the giver's nickname), a reward in the invitation chain (with the nicknames of people in the chain), a moderator's decision about your flag, a race result or the result of Bjørn's weekly challenge.

Notifications never contain your step count or distance from Health Connect or the Health app. When an inbox message mentions them (the challenge, a race, an expedition), the notification only says that a message is waiting; the numbers stay in the game. Outside this limit, with notifications on you may receive a notification about a new team chat message (with the sender's nickname and the message text), a request to join a team you administer or are deputy of, a new team member, and announcements from the game; none of them is sent during your night. Push notifications are relayed by Expo and delivered to the phone by Google (Firebase Cloud Messaging) or Apple (Apple Push Notification service).

Uninstalling the game. When we send a notification and Google or Apple answers through Expo that the game is no longer on the phone (the DeviceNotRegistered response), we delete that phone's notification token and record in our uninstall table: the date, the system (Android or iOS), a one-way hash of the token (SHA-256; the token itself is deleted, and nothing can be sent with the hash) and whether it was your last phone with notifications. When you open the game again (a new notification token, the app connecting to the server, or a sign-in), we add the date and how we noticed. This tells us that a player uninstalled the game. Only we see this record, in the admin panel, and we keep it until the account is deleted. It works only with notifications on: nobody tells us when the game is removed from a phone without a token.

Time zone. The app sends the server the time zone set on your phone (for example "Europe/London") with every request, also when notifications are off. It sets the bounds of your day, that is the moment when the daily limit of chests for watching an advert, the daily quests, the daily streak, Bjørn's Trail and the daily Trailborn+ chest renew, and when the week of Bjørn's weekly challenge begins and ends. If you do not allow location, it also decides the country your first route starts in (see "Your first route"). It also sets the night silence, the daily notification limit and which day Bjørn's morning summary describes. If the phone does not send it, we estimate it from your last position. We store the latest time zone on your account (until you delete the account), and also with the phone's notification settings (until you turn notifications off or delete the account) and with each summarised day (30 days). A time zone roughly indicates the region you are in. With every request the app also sends the units you chose in the settings (metric or imperial). We store them on the server as well, with your account (until you delete the account), so that messages from the game (the inbox, push notifications, daily summaries, race results, the expedition) give distances in kilometres or miles.

What is publicly visible

Another player who taps your nickname sees: your nickname, colour, character appearance, total distance and territory, player level, worn items and accessories, and the teams you belong to. If your Trailborn+ gift choices lean to good or to evil, the profile has a gold frame or a red background. We do not show how many choices you made or who received the days, but the frame or background does reveal that the account once had a paid subscription. In the global chat every player sees your nickname and message. In a race the entrants see each other's nicknames and progress. Rankings, including the expedition ranking, show your nickname and result. An approved flag with a message is visible on the Team War map at the place where it was planted; only the player who finds the flag sees your nickname and the message.

Your invitation page (forestnap.com/z/…) is open to anyone with the link: it shows your nickname, avatar, team, total distance, number of road segments uncovered and the town you last played in — without your exact position.

They do not see: your e-mail address, health data, last position, daily activity, birth year, purchases, or whether the account is suspended.

Map tiles show claimed roads in the owner's colour but contain no player identifiers.

Legal bases

• Contract (Article 6(1)(b) GDPR) — running your account, the map, territory, teams, races, rankings, inventory, chats, purchases and the subscription. Also flags with a message, invitations and the invitation chain, free Trailborn+ days and the Trailborn+ gift, points, challenges and expeditions, the daily streak and its rewards, the starter chest and the role of team deputy.
• Explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR) — step and floor data from every source (including the personal step target worked out from them), location, notifications and your choices about advertising personalisation. You can withdraw any of these consents in your device or app settings; withdrawal does not affect what we did lawfully before.
• Explicit consent to height and weight (Article 9(2)(a) GDPR) — if you enter them in your profile. You withdraw it by deleting them there; we then also delete the calories counted from them.
• Legitimate interest (Article 6(1)(f) GDPR) — crash diagnostics, account security, protection against cheating (including the installation identifier that limits the starter chest to one per phone), purchase verification, backups, moderation of user content, the record of first-launch screens, which lets us improve the game for new players, and the record of uninstalls (date, system, hash of the notification token), which tells us that a player uninstalled the game.
• Consent in Google's form (Article 6(1)(a) GDPR) — measuring campaigns and use of the game in Firebase Analytics in the European Economic Area, the United Kingdom and Switzerland; you can change it in the app's privacy settings. Measurement outside these regions, where consent is not required, relies on our legitimate interest (Article 6(1)(f) GDPR) in checking whether the game's paid advertising works and how players use the daily streak and the team card.

Providing data is voluntary, but without an account and a source of steps the game cannot work — there is nothing to count metres from.

Who we share data with

We do not sell data.

Place search is called by our server, not by your phone, so your IP address does not reach Nominatim.

The base map is downloaded by your device directly from OpenFreeMap's servers, so they receive your IP address and which part of the map you are looking at. We do not pass them your nickname, account or steps.

Google, Apple and Expo may process data outside the European Economic Area; this takes place under the European Commission's standard contractual clauses or an adequacy decision.

How long we keep data

The periods below match what the code actually deletes.

A moderation case is not deleted while an appeal against it is pending.

Backups. Every night we make a backup of the database and keep it for 14 days on the game server, in the same infrastructure as the database. Data deleted from the database — including after account deletion — may remain in a backup for at most 14 days, after which the backup is deleted. Backups are used for nothing but restoring the database after a failure.

Deleting your account

You can delete your account in the app: Settings → Account and data → Delete account, with two confirmations. You can also submit a request without installing the game, through https://forestnap.com/delete-account/.

After a confirmed deletion we erase your profile, sessions, step and floor data, personal territory, inventory, chests (the starter chest too), the daily streak, the record of first-launch screens, purchase records, notification token, uninstall records and the data stored on the device, except the random identifier of your installation of the game. On the server only that identifier remains, with the date the starter chest was given and no link to the account. Team events, races and the shared world history may remain in anonymised form so that other players' maps and rankings do not fall apart — without your nickname and without your identifier. Deleting the account does not cancel a subscription in the store — you cancel it in Google Play or the App Store.

A plain sign-out clears from the device the sensor step history, Health Connect cursors, the installation identifier and the notification token. Claimed territory stays on the device, tied to your account, so that you find your map again after signing back in.

Your rights

You have the right to: access your data, rectify it, erase it, restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time.

We make no decisions about you based solely on automated processing that would produce legal effects. Fair-play checks may flag activity as unreliable and the word filter may mask part of a message, but decisions to suspend an account are made by a human and can be appealed.

Requests: forestnapstudio@gmail.com. We respond without undue delay and at the latest within one month.

You also have the right to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

Changes

We will announce material changes in the app. The version of this document you accepted is stored with your account together with the date.

Version 2026-10-24 compared with version 2026-10-23: adds that for a purchase and every subscription renewal we store the price, the currency and the store country given by the store, to count the game's revenue. The change does not require a new acceptance; earlier acceptances remain valid.

Version 2026-10-23 compared with version 2026-10-22: removes from Firebase Analytics on Android the event of the first synchronisation in which the game counted steps. The app no longer sends it from version 1.1.57, and we do not use events from earlier versions to measure advertising campaigns. The change does not require a new acceptance; earlier acceptances remain valid.

Version 2026-10-22 compared with version 2026-10-21: describes the record of uninstalls. When Google or Apple reports that a notification did not reach a phone because the game is no longer installed (DeviceNotRegistered), we record the date, the system and a one-way hash of the notification token (until the account is deleted), on the basis of legitimate interest. It also describes the inbox message with the result of Bjørn's weekly challenge and the notification about it. Adds the uninstall record to the retention table. The change does not require a new acceptance; earlier acceptances remain valid.

Version 2026-10-21 compared with version 2026-10-20: adds a Firebase Analytics event on Android: the first synchronisation in which the game counted steps from the phone's step counter, Health Connect or the Health app (the event alone, without the number of steps). It is sent once per account created on that phone, under the same consent rules as the other events. The change does not require a new acceptance; earlier acceptances remain valid.

Version 2026-10-20 compared with version 2026-10-19: describes the data new in version 1.1.55 of the game: the daily streak and its rewards, the personal step target worked out from the median of 7 days of steps, the starter chest at the end of the first route (one per account and one per phone, hence an installation identifier that stays, without a link to the account, even after the account is deleted), the record of first-launch screens and the team deputy (visible to team members, announced in the team chat, taking over the team also after 14 days of the administrator's absence). Also describes the approximate network position (within 500 m) for a first walk without a GPS signal, the first route starting in a city in the player's country when location is not allowed, the reminder time kept only on the phone, and the new Firebase Analytics events on Android (opening the starter chest, streak day, streak reward, team card) with the new purpose of that measurement: how players use the daily streak and the team card. Adds this data to the table of retention periods. The change does not require a new acceptance; earlier acceptances remain valid.

Version 2026-10-19 compared with version 2026-10-18: describes measuring advertising campaigns with Google Analytics for Firebase in the Android app (new recipient: Google; app instance identifier, events, phone model, country or region). Nothing is sent before you answer Google's consent form, and in the European Economic Area, the United Kingdom and Switzerland measurement runs only with your consent. Also describes the legal bases and how long Google keeps this data (2 months). The change does not require a new acceptance; earlier acceptances remain valid.

Version 2026-10-18 compared with version 2026-10-16: describes storing the phone's time zone and the units you chose with your account (until account deletion); the app sends them with every request. The time zone now also sets the player's day for the daily limit of chests for watching an advert, the daily quests, the weekly challenge, Bjørn's Trail and the daily Trailborn+ chest (previously Polish time or UTC), and the units are used to give distances in messages from the game in kilometres or miles. Adds this data to the table of retention periods. The change does not require a new acceptance; earlier acceptances remain valid.

Version 2026-10-16 compared with version 2026-10-10: describes playing without an account (a random key on the phone, only its one way hash on our side, a counter of new accounts kept in server memory for at most one hour). The change does not require a new acceptance; earlier acceptances remain valid.

Version 2026-10-10 compared with version 2026-10-06: describes flags with a message in Team War mode (the exact place of a flag is visible to other players once a moderator approves it; its author's nickname and the message only to the player who finds it), the invitation chain and the messages to people further up it, free Trailborn+ days and the Trailborn+ gift after a purchase, the gold frame or red background on the public profile that follows Trailborn+ gift choices (which indirectly reveals that the account once had a paid subscription), points, the weekly challenge and expeditions, the new push notifications (at most two automatic ones a day, night silence from 21:30 to 8:30 the player's time, each kind can be switched off, no step count or distance in their text) together with the services that deliver them (Google, Apple), the phone's time zone, the morning summary of the day, reporting a flag's message, and our server's queries to the Overpass API. It adds retention periods for flags (180 days after closing), ad reward confirmations and the push notification log (90 days), and daily summaries with the time zone (30 days), and removes the previous game server, now shut down, from the list of recipients. The change does not require a new acceptance — earlier acceptances remain valid.

Version 2026-10-06 compared with version 2026-10-05: optional height and weight in the profile, kept with explicit consent to count the calories burned walking, and the daily total of those calories. The change does not require a new acceptance — earlier acceptances remain valid.

Version 2026-10-05 compared with version 2026-09-30: diagnostics include the state of the permissions and settings the game needs (location, step access, the phone’s step counter, notifications, the ad consent). The change does not require a new acceptance — earlier acceptances remain valid.

Version 2026-09-30 compared with version 2026-09-29: describes friend invitations (including the IP address hash kept for 48 hours for the invitation page), automatic notifications — at most one a day — and the record of a Trailborn+ free trial. The change does not require a new acceptance — earlier acceptances remain valid.

Version 2026-09-29 compared with version 2026-09-26: messages in the team chat and the global chat are kept for 48 hours instead of 24, and the author can delete their message throughout that time. This applies to messages sent from 29 September 2026; earlier messages expire after 24 hours. The change does not require a new acceptance — an acceptance of version 2026-09-26 remains valid.

Version 2026-09-26 compared with version 2026-08-29: describes Sign in with Apple, purchases of Trailborn+ and chest bundles through Google Play and the App Store, the global chat, races, the advertising personalisation consent form, the move of the game servers to Contabo, backups kept for 14 days and the 60-minute advertisement token.