Privacy Policy

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We may share your information in the following limited circumstances:

• With Your Consent: When you explicitly authorize sharing
• Public Content: Posts, comments, trip reports, and ratings you make public are visible to other users based on your privacy settings
• Service Providers: Trusted third-party vendors who assist with hosting (Vercel), database services (Supabase), email delivery, payment processing (Stripe), error monitoring (Sentry), and analytics - all bound by confidentiality agreements
• Business Transfers: In connection with mergers, acquisitions, bankruptcy, or asset sales, with notice to affected users
• Legal Requirements: To comply with valid legal processes, court orders, subpoenas, or governmental requests
• Safety and Security: To protect rights, property, or safety of Nomad Path, our users, or the public; to investigate potential violations of our terms
• Aggregated/De-identified Data: Anonymized, aggregated statistics that cannot reasonably identify you (e.g., "X% of users fish for walleye")

We use cookies and similar technologies to operate our Service:

• Essential Cookies: Required for authentication, security, and basic functionality - cannot be disabled
• Preference Cookies: Remember your settings, selected states, and display preferences
• Analytics Cookies: Help us understand how users interact with our Service to make improvements

Managing Cookies: You can control cookies through your browser settings. Disabling certain cookies may limit functionality of the Service.

Do Not Track: Our Service does not currently respond to "Do Not Track" browser signals. However, you can opt out of analytics tracking by contacting us.

We implement industry-standard security measures to protect your information:

• Encryption in transit (HTTPS/TLS 1.3) and at rest (AES-256)
• Secure authentication with bcrypt-hashed passwords
• Row-level security policies in our database
• Regular security audits and vulnerability assessments
• Access controls limiting employee access to personal data on a need-to-know basis
• Secure cloud infrastructure with redundancy, backups, and disaster recovery
• Rate limiting and abuse prevention mechanisms

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information using commercially reasonable measures, we cannot guarantee absolute security.

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of your personal information we hold
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and personal data
• Portability: Receive your data in a structured, machine-readable format (JSON)
• Opt-Out: Unsubscribe from marketing emails or disable certain data collection
• Restrict Processing: Limit how we use your information in certain circumstances
• Object: Object to certain types of processing
• Withdraw Consent: Where processing is based on consent, withdraw that consent at any time

To exercise these rights, please contact us at privacy@nomadpath.net or use the account deletion feature in your account settings. We will respond within 30 days (or sooner as required by law).

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out of Sale: We do not sell personal information, so this right does not apply
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

Categories of Information Collected: Identifiers (name, email), commercial information (subscription history), internet activity (usage data), geolocation data, and inferences drawn from this information.

To submit a CCPA request, email privacy@nomadpath.net with "CCPA Request" in the subject line. We may need to verify your identity before processing your request.

We use automated processes to provide personalized recommendations and alerts:

• Alert Matching: Automatically match tag availability and stocking reports to your preferences
• Location Recommendations: Suggest hunting zones and water bodies based on your selected states and past activity
• Content Personalization: Display relevant seasons and opportunities based on your interests

These automated processes do not make decisions that produce legal effects or similarly significant effects on you. You can adjust your preferences at any time in your account settings.

We retain your information for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy:

• Account Data: Retained while your account is active; deleted within 90 days of account deletion request
• Trip Data: Retained as long as you maintain your account; deleted with account
• Alert Preferences: Retained while your account is active; deleted with account
• Posts and Content: Retained unless you delete them or request account deletion
• Analytics Data: Individual data deleted after 24 months; aggregated data may be retained indefinitely
• Payment Records: Retained for 7 years for tax, legal, and audit compliance
• Security Logs: Retained for 12 months for security and fraud prevention

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@nomadpath.net. We will promptly delete such information from our systems.

Users between 13 and 18 years of age may use the Service only with parental or guardian consent and supervision.

Our Service is hosted in the United States and is intended primarily for users in Michigan, Minnesota, North Dakota, South Dakota, and Wisconsin. If you are accessing our Service from outside the U.S., please be aware that your information may be transferred to, stored, and processed in the United States where data protection laws may differ from your jurisdiction.

By using our Service, you consent to the transfer of your information to the United States. We will take reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the new Privacy Policy on this page with a new "Last Updated" date
• Sending an email notification to your registered email address for significant changes
• Displaying a prominent notice on our Service

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will acknowledge your inquiry within 5 business days and aim to respond substantively within 30 days.