Privacy policy

Last updated 8 September 2026

TrailMesh7 is made by Levity7, Inc., a corporation incorporated in Minnesota, United States. This policy covers the TrailMesh7 mobile and web apps and this website.

The short version: your messages and your position travel over the radio mesh between your group’s devices. They do not pass through our servers, because there is no route through them. An optional account stores a small profile and backups of your tag’s configuration and keys — three collections, listed in full below.

What never leaves your devices

• Message contents. Room messages are encrypted on your phone with the room’s own key and sent over the radio. There is no server copy, and no server path they could take. Our database rules deny every collection that is not one of the three named below.
• Your position. Location is shared over the radio with the tags in your room. It is not uploaded, logged or retained by us.
• Maps. Offline map areas are downloaded to the phone and rendered there. Panning a map does not report where you are looking.
• Room keys on other people’s devices. A room’s key is held by the phones in that room. We cannot read a room, and cannot add anyone to one.

What an account stores

The app creates an anonymous account on first launch. That account exists only to authenticate downloads of map data and firmware; it holds no personal information.

Signing in fully — with Google or Apple — enables three stores, and only these three:

Profile

users/{your id}. Your display name, avatar, avatar colour, and the push token used to send you notifications, plus the time it last changed.

Tag backups

users/{your id}/tagBackups/*. Saved copies of each tag’s settings and rooms: the tag’s hardware code, node number and name, its hardware model and firmware version, its radio configuration, which room slots it knows about and which are muted, the room member and tracker rosters, and the room encryption keys.

Escrowed tag keys

users/{your id}/tagIdentities/*. The private key that gives each of your tags its identity on the mesh, filed under the code printed on the hardware.

These last two hold key material. They are readable only by the account that wrote them; that scoping is the security boundary, and it is enforced on the server, not just in the app.

What sign-in providers give us

Signing in with Google or Apple passes us the account identifier and, depending on what you allow, a name and email address. Sign in with Apple’s private relay address is supported and we do nothing that would defeat it. We do not receive your password in either case.

Diagnostics

Nothing is collected automatically. If you choose to export or attach a diagnostic log from the Support screen, be aware that the log records text you dictated, so it may contain the contents of your own messages. It does not include messages you received. The log is plain text and you can read it before sending it. Logs you email to support are kept only as long as it takes to resolve the issue.

Dictation and speech

On iOS the system chooses the speech recogniser and uses the on-device one whenever there is no network. On Android there is a setting: with it off, dictation is entirely on-device; with it on, audio is sent to the platform’s speech service when the offline recogniser is unavailable. That processing is the platform’s, under Apple’s or Google’s own policies, not ours.

Incoming messages read aloud by the app are synthesised on the device.

Push notifications

If you enable them, we store a device push token in your profile and send notifications through Firebase Cloud Messaging. Turning notifications off removes the token.

Location permissions

The app asks for location so it can put you on the map and share your position with your room, and it asks only for the “while using the app” level. It does not request background or always-on location. Lift-top alerts still work with the phone in a pocket, because the app’s foreground service carries the position for as long as your tag is connected; if you would rather not grant location at all, the tag’s own GPS can supply it instead. That detection happens on the phone. Declining location disables the matching features and nothing else.

Processors

We use Google Firebase — authentication, Cloud Firestore, Cloud Storage, Cloud Messaging and App Check — to run the account features above, and Google Cloud Run to prepare map extracts. Data is stored in the United States, in Google’s us-east region. We do not sell data, and we do not use it for advertising.

Children

TrailMesh7 is not directed at children under 13, and we do not knowingly collect their information.

Your choices

• Turn cloud sync off. A single switch stops this device writing anything about you to the server. While it is off, backups and key escrow do not happen, and the app says so rather than failing quietly.
• Delete everything. Settings → Danger Zone → Delete my data or account shows a live count of what is stored in each of the three collections, states what deleting it costs, and removes it. Sync is switched off as part of the deletion, so nothing is written back a moment later.
• Delete your account. The same screen has a tick box to remove your sign-in as well. Your data is deleted first and the account second, so nothing is left behind that only that account could have removed. Signing in afterwards creates a new account rather than returning you to the old one. Leave the box unticked to clear your data and keep the account.
• Both key stores are unrecoverable. A room’s identity is its key and a tag’s identity is its keypair; neither can be regenerated or reissued. The deletion screen says so before you confirm.

Depending on where you live you may also have rights to access, correct, or port your data, or to object to processing. Write to us and we will act on it.

Retention

Account data is kept until you delete it or ask us to. Support email is kept for as long as the conversation is useful and then removed.

Changes

Material changes will be announced in the app before they take effect, and the date at the top of this page will change.

Contact

Support@levity7.com.

This policy is governed by the laws of the State of Minnesota, United States.