Privacy Policy

Last Updated & Effective Date: September 1, 2026

Welcome to MyBreadcrumbs ("we", "our", or "us"). This Privacy Policy explains how we collect, use, process, and protect your personal information across our website, progressive web application, and iOS and Android mobile applications available at mybreadcrumbsapp.com (collectively, the "Service").

1. Information We Collect

We collect information you provide directly, data generated through automated service features, and information collected via technical logging:

1.1 Account & Identity Information

• Authentication Credentials: When creating an account via email and password, passwords are cryptographically salted and hashed using industry-standard hashing algorithms (bcrypt/Argon2 via Supabase Auth) prior to storage. We never store or have access to plaintext passwords.
• Federated Single Sign-On (Google OAuth): When authenticating via Google Sign-In, we receive your email address, full name, and avatar image URL strictly authorized by you.
• User Profile Data: Display name, home city/origin hub, traveler bio, preferred distance units (miles vs. kilometers), and theme preferences.

1.2 Travel Logs, Routes & Geographic Data

• Journey Entries: Flight legs, departure and arrival airports (IATA/ICAO codes), dates, carrier and flight numbers, rail/road/cruise transport routes, visited countries, passport stamps, and custom notes.
• Guest Mode: If you use the Service without signing in, all travel logs remain exclusively on your local device (via browser localStorage or local app storage) and are never transmitted to our cloud servers.

1.3 Inbound Email & Automated Itinerary Ingestion (trips@mybreadcrumbsapp.com)

We provide an automated travel ingestion feature allowing you to forward travel confirmations, receipts, and e-ticket documents to trips@mybreadcrumbsapp.com or upload booking text directly:

• Forwarded Email Contents: When you forward an email, our serverless pipeline receives the sender address, email subject, body text, and attachments (such as airline PDF e-tickets).
• Transient Processing: Inbound emails and attachments are processed strictly in memory by our automated parsing pipeline to extract flight numbers, airport codes, dates, and times. Raw email bodies and temporary attachments are discarded immediately upon successful extraction and are not permanently archived or stored in our database.
• Linked Forwarding Addresses: To authorize forwarding from secondary addresses (e.g. personal, work, or family email accounts), you may link secondary addresses in Settings. We collect the secondary email address, verification timestamp, and cryptographic verification status.
• 6-Digit Verification Codes: Secondary email verification utilizes a temporary 6-digit one-time passcode (OTP) with a 15-minute expiration dispatched via Google Workspace. Once verified, verification codes are permanently deleted.

1.4 Automated Device & Technical Information

• Device & Telemetry Data: Browser user agent, operating system (iOS, Android, macOS, Windows), screen dimensions, WebGL hardware capabilities, crash diagnostics, and session performance metrics.
• Local Cache: We store local application caches to allow 0-millisecond offline loading and offline journey plotting.

2. Artificial Intelligence (AI) & Third-Party Itinerary Parsing Disclosures

• Purpose of Processing: When you forward an itinerary or paste confirmation details into the Service, the text and/or document data is sent to the Google Gemini API solely for the automated extraction of structured journey details (such as carrier names, flight numbers, airport IATA/ICAO codes, dates, and times).
• Transient & Stateless Processing: Inbound itinerary parsing operates within serverless execution environments. Once structured travel data has been extracted and saved to your account, the raw email contents and temporary document files are discarded.
• Third-Party Terms: Transmissions to Google's generative AI services are governed by the Google Terms of Service, Gemini API Additional Terms of Service, and Google Privacy Policy. We do not sell, rent, or monetize your personal travel confirmations or itineraries to third parties.

3. How We Use Your Information

We process personal information under the following legal bases and purposes:

• To Deliver the Service (Contract Performance): Plotting your 3D trajectories, computing cumulative distance and Earth laps, issuing digital passport stamps, and synchronizing your account across devices.
• Account Security & Fraud Prevention (Legitimate Interest): Verifying email authenticity, enforcing re-authentication on password modifications, detecting suspicious sign-ins, and dispatching security alert notifications.
• Media & Reel Generation: Rendering 9:16 vertical travel recap videos using client-side HTML5 canvas and WebM encoding. Video rendering occurs directly on your device.
• Support & Communication: Responding to user feedback, bug reports, and customer inquiries submitted to support@mybreadcrumbsapp.com.

4. Third-Party Subprocessors & Service Providers

We share data only with trusted infrastructure subprocessors necessary to deliver the Service:

5. Advertising & Analytics

To support the free availability of MyBreadcrumbs, we may display non-intrusive advertisements via Google AdMob (mobile) and Google AdSense (web):

• Identifiers & Cookies: Google and third-party vendors use cookies, web beacons, or mobile advertising identifiers (IDFA/GAID) to serve ads based on prior visits or general geographic location.
• Consent & Privacy Controls: In applicable jurisdictions (such as the EEA, UK, and California), we implement a standardized Consent Management Platform (CMP) allowing you to accept or decline personalized advertising. On iOS, we respect Apple App Tracking Transparency (ATT) preferences.
• Opting Out: You can manage ad preferences through Google Ads Settings or through your device settings ("Ask App Not to Track" on iOS or "Delete Advertising ID" on Android).

6. Data Security, Row-Level Security & Retention

• PostgreSQL Row-Level Security (RLS): All cloud journey logs, stamps, profile records, and linked emails in our Supabase database are guarded by cryptographic Row-Level Security policies. No user or public API caller can read or alter another traveler's records.
• Data Encryption: All communications between your client, serverless functions, and database use TLS 1.3/HTTPS in transit and AES-256 encryption at rest.
• Retention Period: Your data is retained for the lifetime of your active account. If you choose to delete your account, your profile, journeys, stamps, and linked forwarding addresses are permanently purged immediately.

7. Your Rights & Data Sovereignty

Regardless of your geographic location, we provide comprehensive self-service controls directly within the application:

• 1-Click JSON Data Export: You can download a complete, machine-readable JSON archive of all your trips, coordinates, notes, and milestones at any time in Settings ➔ Data & Backups.
• Immediate Account Deletion: You can permanently delete your account and all associated cloud records in Settings ➔ Account ➔ Delete Account.
• GDPR & UK GDPR (European Travelers): You have the right to access, rectify, restrict processing of, port, or erase your personal data, as well as the right to lodge a complaint with your local Data Protection Authority (DPA).
• CCPA & CPRA (California Residents): You have the right to know what categories of personal information we collect, the right to deletion, the right to correct inaccurate data, and the right to non-discrimination for exercising your privacy rights. We do not sell personal information or share personal information for cross-context behavioral advertising.

8. Account Security & Emergency Lockout

To protect accounts against unauthorized takeovers, whenever an account password is changed:

• We dispatch a native security alert email to your registered address.
• If you did not authorize the change, clicking the "Secure My Account" button in that alert opens account recovery at https://www.mybreadcrumbsapp.com/?action=secure_account with your email pre-filled, allowing you to immediately request a password reset to regain control of your account.

9. Children's Privacy (COPPA & Global Standards)

The Service is not directed to children under 13 years of age (or under 16 in the EEA/UK). We do not knowingly collect personal data from children. If we discover that a minor under the minimum legal age has registered an account without verified parental consent, we will promptly delete all associated data.

10. Contact Information & Data Protection

For any privacy inquiries, data subject access requests, or legal questions, please contact our Data Protection Team at:

• Email: support@mybreadcrumbsapp.com
• Web: mybreadcrumbsapp.com