Privacy Policy

The short version

• We don't sell your data, run ads, or use third-party analytics or trackers.
• You can browse caves and the map without an account.
• Sensitive cave locations are coarsened/fuzzed; precise cave entrances are shared only with verified grotto members, never published.
• Photos you upload have their GPS/EXIF metadata stripped on your device before upload.
• Your trip logs and safety check-ins are private to you.

Information we collect

Account & identity

• Anonymous by default. When you first open Karst you get an anonymous account ID so saved caves work; no personal info is required.
• Phone number, if you sign up with phone verification (used as your login identity).
• Google account details (name, email address, profile photo), only if you choose to connect Google sign-in.
• Display name, avatar, and optional bio you set for your public caver profile.

Location

• Precise GPS when you record a breadcrumb trail — one entrance point is stored as a gated anchor readable only by verified grotto members, and never made public. Trails recorded underground store no coordinates at all.
• Approximate location when you tap “find caves near me” — used on your device to sort results; not stored.
• Cave locations you add as a moderator are coarsened to a broad area before saving (the exact point is never stored) unless the cave is already publicly advertised.

Content you create

• Photos you upload to caves or grottos (GPS/EXIF metadata removed on-device first).
• Public contributions: comments, condition reports, breadcrumb trails/routes, and grotto posts, events, and RSVPs.
• Saved caves and groups.
• Trip logs — your personal, private journal of cave visits (owner-only).
• Safety check-ins — when you tell Karst you're heading underground, we store your expected return time and the emergency contact name, phone number, and private rescue note you enter. This is owner-only and shown only in an overdue-alert context.

Device & technical

• Push notification token, only if you enable saved-cave alerts.
• Sensor access — camera (augmented-reality trail view and photo upload), motion/compass (in-cave dead-reckoning), and GPS. Sensor streams are processed on your device; we don't store raw sensor data.
• Standard technical data (e.g. IP address) is processed by our hosting/infrastructure providers to deliver the app.

How we use your information

• To provide core features: browsing caves, the map, saving caves, grottos, trails, conditions, trip logs, and safety check-ins.
• To authenticate you and keep your saved data across devices.
• To send push notifications you opt into.
• To operate the overdue-check-in safety reminder.

We do not use your data for advertising, profiling, or sale.

How information is shared

• Public content (your display name, comments, condition reports, trail shapes, grotto posts, and uploaded photos) is visible to other users, consistent with where you post it. Grotto content is limited to approved members of that grotto.
• Precise cave-entrance anchors are shared only with verified grotto members and are never publicly listed.
• Service providers. We use Google Firebase (authentication, database, file storage, and push messaging) to run the app; your data is stored on Google Cloud infrastructure. Map tiles are served by OpenStreetMap, which receives your IP address and the map area you view.
• We may disclose information if required by law or to protect safety.
• We do not sell or rent your personal information.

Your choices & rights

• Use Karst anonymously; sign in only when you want to contribute or sync.
• Delete content you created (comments, trails, photos, trips, check-ins) from within the app.
• Turn push notifications on or off on your profile.
• Delete your entire account and personal data anytime from your profile → “Delete my account.” This removes your profile, saved caves and groups, trip logs, safety check-ins, uploaded photos, caver stats, and your sign-in. Public contributions (comments, condition reports, trails, grotto posts) may be retained; contact us to remove those as well.

Data retention & security

We keep your data while your account is active or as needed to provide the app, and delete or anonymize it on request. Data is transmitted over encrypted connections (HTTPS) and stored on Google Cloud infrastructure. No system is perfectly secure, but we minimize what we collect and gate sensitive location data.

Children

Karst is not directed to children under 13, and we do not knowingly collect their personal information.

Changes

We may update this policy; material changes will be reflected by a new effective date on this page.

Contact

Questions or data requests: getkarstapp@gmail.com.