Privacy Policy for TrainTrax

1. Information We Collect

To provide a seamless, collaborative professional networking and digital transit experience, we collect several categories of information depending on how you interact with the App.

A. Personal Information You Provide

• Account Credentials: We collect your email address and password when you register for an account. We process your authentication securely via Supabase Auth (passwords are securely hashed and are never visible to us).
• Boarding Pass & Profile Information: You may choose to customize your user profile (your "Boarding Pass") by providing a full name, username, avatar photo, professional biography, career roles (e.g., passenger or conductor), career interests, mentorship preferences, and professional goals.
• Career Vault Files: You may choose to upload documents, photos, or links to your in-app Career Vault. These files are stored securely in our designated backend file storage.

B. User-Generated Content (UGC)

TrainTrax is designed for community interaction. We collect and store:

• Messages: Direct and group chat messages sent between users.
• Bulletin Board Posts: Text, hashtags, comments, and file attachments (images, video, documents) shared within designated Station or Line feeds.
• Station Cargo: Files, resources, and descriptions submitted by members for collaborative sharing.
• Connection & Match Data: Your connection requests, blocks, and Coupler matching preferences.

C. Coarse Location Information

TrainTrax does not track your precise real-time location or collect background GPS data.

• To enable location-aware networking features, you manually input your city/region (up to 3 entries).
• The App queries OpenStreetMap's Nominatim geocoding service to resolve the city name to approximate coordinates, which are stored on your profile to aid in networking and station suggestions.

D. Device and Technical Data

• Push Notification Tokens: If you grant permission, we collect an Expo Push Notification token to deliver essential notifications (such as new messages, Coupler matches, and event reminders).
• Device Metadata: We collect standard system data, including your operating system version and device platform (iOS or Android), to route push notifications and verify system compatibility.
• Server Logs: Our infrastructure hosts automatically collect standard server and CDN logs (including IP addresses) to maintain security, performance, and platform integrity.

2. How We Use Your Information

We process your data strictly to deliver and secure our services, including:

• Creating, authenticating, and maintaining your account.
• Generating smart networking recommendations via the TrainTrax Coupler.
• Facilitating direct messaging, group chats, and community bulletin boards.
• Delivering push notifications for active app engagement.
• Enforcing safety features, administering user reports, and moderating inappropriate UGC.

Please Note: We do not serve third-party ads, nor do we offer in-app purchases in this version of the App.

3. Data Sharing and Processors

We do not sell, rent, or trade your personal data with third parties for marketing or advertising purposes. We share information only with essential service providers ("processors") required to operate TrainTrax:

• Database & Authentication Hosting: Supabase (your data is stored securely in their United States data region).
• Deployment & Push Infrastructure: Expo / EAS (manages our push notification pipelines and deployment builds).
• Push Notification Delivery: Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM).
• Coarse Geocoding: OpenStreetMap / Nominatim (processes manual text queries to resolve approximate city coordinates; your personal account identity is not shared with this service).
• Transactional Admin Notifications: Resend (routes administrative emails, such as safety reports and account deletion requests, directly to our internal support team).

Future Updates: We may integrate crash-reporting and performance analytics services (such as Sentry) in future updates to improve App stability, at which point this policy will be updated.

4. Safety, Moderation, and Controls (Report & Block)

To maintain a respectful, professional networking environment, TrainTrax enforces strict safety features (aligned with App Store Guideline 1.2):

• Reporting Content & Users: You can report profiles, messages, posts, and comments that contain harassment, hate, spam, or other inappropriate content. Reports are routed to Inner Loot Innovations admins for manual review and resolution. We retain safety reports for up to three (3) years to monitor repeat offenders and comply with legal requirements.
• Two-Way Blocking: You can block any passenger in the App. Once blocked, you are mutually filtered from each other's direct messaging channels, feed views, and Coupler recommendations.

5. Account Deletion & Data Retention

We believe in giving you absolute control over your personal data.

How to Delete Your Account:

1. In-App Request: Navigate to your Boarding Pass / Profile Settings inside the App, tap "Delete Account", and confirm the request by entering your account email and password.
2. Email Request: If you cannot access the App, you can request account deletion by emailing us at [Show Email].

Deletion and Retention Terms:

• SLA for Deletion: Upon receiving a deletion request, your active user profile, boarding pass details, direct messages, posts, and uploaded files will be permanently purged from our active databases either the same day or within 30 days.
• Permanence: Once processed, account deletion is completely permanent and cannot be recovered.
• Inactive Accounts: Unless deletion is explicitly requested, inactive accounts are retained indefinitely so that you can return to the platform at any time.

6. Children's Privacy

TrainTrax is designed strictly for an adult audience and is restricted to users who are 18 years of age or older. We do not knowingly collect personal information from individuals under the age of 18. If we discover that we have inadvertently collected data from a minor, we will delete that information immediately.

7. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know/Access: You have the right to request a copy of the personal information we have collected about you.
• Right to Deletion: You have the right to request that we delete your personal information.
• Right to Correction: You have the right to request that we correct inaccurate personal information.
• No Sale or Share: We do not "sell" your personal information, nor do we "share" your personal information for cross-context behavioral advertising.

To exercise any of these rights, please contact us at [Show Email]. We will respond to verified consumer requests within forty-five (45) days, as required by law.

8. International Users

Our App is currently operated and hosted in the United States and is intended primarily for users located in the United States. If you access the App from outside the US, please note that your data will be transferred to, stored, and processed in the United States. If you reside in the EU, UK, or other regions with comprehensive data protection laws, you may contact us at [Show Email] to exercise your corresponding data access or erasure rights.

9. Website Cookies and Tracking

Our landing page website (https://traintrax.innerloot.com) is a static HTML page. We do not use cookies, tracking pixels, or third-party web analytics on our policy, support, or landing pages.

10. Contact Us

If you have questions about this Privacy Policy, your data rights, or the safety mechanisms inside TrainTrax, please reach out to our primary privacy contact:

• By Email: [Show Email]