Privacy Policy
This Privacy Policy explains how Kyo Hyun Koo ("NP Tracker," "we," "us," or "our") collects, uses, shares, and protects your information when you use the NP Tracker mobile application and the website at nptracker.app (together, the "Services"). If you do not agree with this policy, please do not use the Services. Questions? Contact us at adventure@nptracker.app.
1. Information we collect
Information you provide
- Account & profile: your name, email address, username, profile photo, and bio. If you sign up with email and password, authentication is handled by Firebase Authentication; we store your email and profile fields, never your plaintext password.
- Content you create: park visit logs (visit dates or date ranges, ratings, notes, and the photos and videos you attach, plus any external photo-album links you add), posts, comments, likes, direct messages, saved and bucket-list parks, personal park notes, and the follows/followers and block lists you create.
- Companions on visits: you can record who joined a visit in two ways. You can tag another NP Tracker user, which sends them a request they must accept before their name appears on your post (see Section 4), or you can type a name as plain text. Typed names are just text you provide — they are not linked to any account and do not notify anyone.
- Settings: your app and privacy preferences (including account visibility and blocked/restricted users), badges and activity, and notifications.
- Reports: if you report content or another user, we collect the report and its context.
- Support: if you contact us through the in-app feedback form, we collect your message and the diagnostic details described in Section 3.
Information from sign-in providers
You can sign in with Google, Apple, or email and password. If you sign in with Google or Apple, we receive basic profile information from that provider, which depends on the provider — generally your name and email address, and your profile picture where the provider supplies one (for example, Google). We do not import your contacts or friend lists. These providers may also process information under their own privacy policies when you use their sign-in; we recommend reviewing Google's and Apple's privacy policies.
Information collected automatically
When you use the Services, we and our providers automatically collect device and usage information such as device model, operating system and app version, language/locale, a per-install identifier, IP address (used to operate and secure the Services), and crash and diagnostic data. We do not collect this for advertising, and we do not track you across other companies' apps or websites.
Location
With your permission (granted as "While Using the App"), the app uses your device location to show nearby national parks and detect when you're at a park. We do not store your precise coordinates on our servers and do not use location for advertising. You can turn off location access in your device settings at any time.
Push notifications
With your permission, we register a device push token (via Firebase Cloud Messaging) to send you notifications, such as a new follower, message, or visit-tag request. To route notifications reliably to each of your devices, we store a per-installation record containing the push token, a Firebase installation identifier, and the app version on that device. These records are not visible to other users, and we remove them when you sign out on that device or delete your account. You can disable notifications in your device settings.
2. How we use your information
We use your information to: create and manage your account and authenticate you; provide the app's features (logging visits, sharing content, tagging companions with their consent, following others, direct messaging, badges); operate, secure, and troubleshoot the Services; understand how the Services are used so we can fix problems and improve them; respond to your support requests; enforce our terms and keep the community safe (including reviewing reports and moderating content); and comply with law.
3. Service providers and other recipients
Service providers (process data on our behalf). We share information with vendors who process it on our behalf under agreements that limit their use to providing services to us:
- Google Firebase — Firebase Authentication (sign-in), Cloud Firestore (database for your account and content), Cloud Storage (your uploaded photos and videos), and Firebase Cloud Messaging (push notifications).
- Google Firebase Crashlytics — crash reporting and diagnostics, to help us find and fix bugs.
- Web3Forms — processes messages you submit through the in-app feedback form. When you send feedback, we transmit your feedback text and category, along with diagnostic context: app version/build, iOS version, device model, locale, a per-install identifier, a timestamp, the most recent error (if any), and your signed-in user ID when available.
Sign-in providers (independent). Google and Apple, when you choose to sign in with them. These providers are independent of us and handle your information under their own privacy policies — not solely on NP Tracker's behalf (see Section 1).
Public data and content sources. The app retrieves national park information (such as park alerts) and park images from the U.S. National Park Service (NPS) APIs and servers. We do not send your account data to NPS, but NPS servers may receive standard request metadata (such as your IP address) when the app loads this content.
We may also disclose information to comply with law, enforce our terms, protect rights and safety, or in connection with a business transfer. We do not sell your personal information, and we do not share it for cross-app or cross-site advertising.
4. How other users see your information
Your profile (username, photo, bio) and the content you choose to share (visits, photos and videos, ratings, notes, posts, comments) are visible to other users according to the visibility settings you choose. Visits are private by default; you choose whether each is private, visible to people you follow, or visible more broadly. Once content is visible to others, copies (for example, in a follower's activity history or a notification) may persist outside your direct control even after you change settings or delete the original.
Visit tagging and consent
If someone you mutually follow tags you as a companion on a visit, you receive a tag request showing their name and photo, the park, the visit date or date range, and who will be able to see the post. Your name and profile photo are added to their post only if you accept. You can decline (the other person is not notified of a decline), and after accepting you can remove yourself from the post at any time. If the post's dates later expand or its audience widens beyond what you agreed to, your name is removed and a new request is sent — your identity never appears under terms you didn't accept. Blocking the other person, switching your account to Private, or deleting your account removes these tags automatically. Typed companion names (plain text, not linked to an account) are visible to whoever can see the post and can be reported like any other content.
5. How long we keep your information; deleting your account
We keep your information for as long as your account is active or as needed to provide the Services. You can delete your account at any time in the app (Settings → Delete Account). Deleting your account removes your data from our active systems — including your profile, posts and comments, activity, follows, direct messages, personal park notes, uploaded photos and videos, visit-tag requests and tags (in both directions), and device push registration records. While your account is active, we keep records of declined and canceled tag requests and related rate-limit data to prevent repeated unwanted requests; these are also deleted with your account. We retain moderation reports after account deletion for safety and to enforce our terms. Some information may also be retained where required by law, and may persist briefly in backups or logs, or while deletion completes (cleanup runs shortly after you delete your account).
6. Security
We use reasonable technical and organizational measures designed to protect your information. However, no method of transmission over the internet or method of storage is completely secure, so we cannot guarantee absolute security.
7. Children
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us at adventure@nptracker.app and we will delete it.
8. Your privacy rights
Depending on where you live (including residents of California and other U.S. states with privacy laws), you may have rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing. You can exercise many of these rights directly in the app — update your profile, change your privacy settings, or delete your account — or by contacting us at adventure@nptracker.app. We do not sell your personal information or share it for targeted advertising, and we will not discriminate against you for exercising your rights.
9. Changes to this policy
We may update this policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, provide additional notice.
10. Contact us
Kyo Hyun Koo
21 Greentree Cir, Milpitas, CA 95035
adventure@nptracker.app