Privacy Policy

Effective Date: August 24, 2026

Trail Time ("we," "us," or "our") operates the Trail Time mobile application (the "App"). This Privacy Policy describes how we collect, use, and share your personal information when you use our App.

1. Information We Collect

Information You Provide

• Account Information: Name, email address, phone number, and password when you create an account.
• Identity Verification: Driver's license images and a selfie, submitted through Stripe Identity for age and identity verification. Stripe performs the verification, and is the only party that stores these images — we keep no copy. When authorized staff need to check a license, the image is retrieved from Stripe for that viewing and is not saved, and the access is recorded in our audit log. We do retain your date of birth and the outcome of the verification. Deleting your account instructs Stripe to erase the images.
• Payment Information: Payment card details processed through Stripe. We do not store card numbers — Stripe handles all payment data in compliance with PCI-DSS.
• Rental Photos: Photos of vehicles taken during checkout and return for damage documentation purposes.
• Digital Signatures: Your signature on the safety agreement and rental terms.

Information Collected Automatically

• Location Data: Precise location, when you grant permission, recorded as part of the record when you sign a rental agreement. Sharing it is optional and signing works without it. Trail Time does not track your location during a ride.
• Device Information: Device type, operating system version, and push notification tokens for sending rental updates.
• Crash and Performance Data: Anonymous crash reports and performance metrics collected through Sentry to improve app stability.

2. How We Use Your Information

• Process and manage ATV rentals, reservations, and payments
• Verify your identity and age eligibility
• Document vehicle condition at checkout and return
• Send rental confirmations, reminders, and status updates via push notifications, email, and SMS
• Process damage claims and deposit adjustments
• Improve app stability and performance
• Comply with legal obligations

3. Third-Party Services

We share information with the following third-party services that help us operate the App:

We do not sell your personal information to any third party.

4. Data Retention

• Account data: Retained while your account is active. When you delete your account, your name, email address, phone number, date of birth, password, linked Google or Apple sign-in, and saved payment profile are erased immediately. See Identity verification images below for those.
• Rental records and photos: Retained for 3 years for legal and insurance purposes.
• Identity verification images: Held by Stripe, not by us. Stripe removes biometric data (your selfie) within one year and other verification data after three years. Deleting your account instructs Stripe to erase them sooner.
• Payment records: Retained as required by financial regulations (typically 7 years).
• Crash/performance data: Retained for 90 days.

5. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate personal data.
• Deletion: Delete your account at any time from the app, under Profile → Delete Account. This immediately erases your name, email address, phone number, date of birth, password, any linked Google or Apple sign-in, and your saved payment profile, and instructs Stripe to erase the identity verification images it holds for you. Records of past rentals and payments are kept without your personal details, as described in Data Retention above, and our audit log keeps a dated record that the deletion happened, including the email address and name held at that time. Stripe keeps its own record of your payments under its retention policy. An account cannot be deleted while a rental or reservation is in progress — return the ATV or cancel the reservation first.
• Opt-out of communications: Unsubscribe from marketing emails or disable push notifications at any time.

To exercise these rights, contact us at privacy@trailtime.us.

6. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• The right to know what personal information we collect, use, and disclose.
• The right to request deletion of your personal information.
• The right to opt-out of the sale of your personal information. We do not sell personal information.
• The right to non-discrimination for exercising your privacy rights.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encrypted data transmission (TLS/HTTPS)
• Secure token storage using iOS Keychain
• JWT authentication with short-lived access tokens
• PCI-compliant payment processing through Stripe
• Presigned URLs with 5-minute expiry for photo uploads

8. Children's Privacy

The App is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. ATV rental requires valid identification and age verification.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the App or by email. Your continued use of the App after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

• Email: privacy@trailtime.us
• Website: trailtime.us