Privacy Policy
Effective date: July 8, 2026
Trail Kos ("we", "us", "our") is a hiking and outdoor discovery app for Kos, Greece, operated through the Trail Kos mobile app and website at https://trailkos.devolist.com. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the choices you have.
By installing or using Trail Kos, you agree to this Privacy Policy. If you do not agree, please do not use the app.
1. Who we are
Data controller: Trail Kos
Contact: [email protected]
Website: https://trailkos.devolist.com
For privacy requests (access, correction, deletion, or complaints), email [email protected] with the subject line "Privacy request".
2. What Trail Kos does
Trail Kos helps you discover hiking trails, guided hikes, offline maps, safety information, and related travel content for Kos Island and surrounding areas. Some features work without an account. If you create an account, you can save trails, book guided hikes, subscribe to Premium, and sync preferences across devices.
3. Data we collect
3.1 Information you provide
- Account details: name, email address, phone number (optional), and password (stored only as a secure hash).
- Sign-in providers: if you use Google or Apple sign-in, we receive your Firebase user identifier and profile fields those providers share (typically name and email).
- Guided hike bookings: name, email, phone, party size, dates, and notes you submit when booking a guided trip.
- Support messages: contact form submissions (name, email, subject, message).
- Premium billing: subscription status and Stripe customer identifiers. We do not store full payment card numbers on our servers.
3.2 Information collected automatically
- Device identifier: an app-generated device ID (`X-Device-Id`) for API security, notification delivery, and anonymous usage metrics.
- Usage analytics: aggregated app activity via Google Firebase Analytics (screens viewed, session length, crash reports).
- Push notification token: if you allow notifications, your Firebase Cloud Messaging token and platform (iOS/Android).
- Location data: when you use map, navigation, or nearby trail features, your device may share GPS coordinates. We do not continuously track background location unless you grant permission and a feature requires it.
- Offline maps: downloaded map regions and trail files are stored locally on your device.
- Technical logs: IP address, app version, and timestamps for security and abuse prevention.
3.3 Advertising data
- Google AdMob: the app may show Google ads. AdMob may process advertising identifiers under Google's policies. Premium subscribers may see fewer or no ads depending on app settings.
- Sponsor ads: we may record ad impressions and clicks with your device ID for campaign reporting. We do not sell your personal profile to advertisers.
3.4 Third-party services
| Service | Purpose |
| --- | --- |
| Google Firebase Authentication | Email, Google, and Apple sign-in |
| Google Firebase Analytics | Usage and stability |
| Google Firebase Cloud Messaging | Push notifications |
| Google AdMob | In-app advertising |
| Stripe | Premium subscriptions and guided hike payments |
| Yesim (optional) | eSIM partner links — opens external site |
| Map tile providers | Map display and offline map packs |
We do not control third-party sites you open from the app. Review their policies before sharing personal data.
4. How we use your data
We use personal data to:
- Provide trails, maps, bookings, Premium features, and support
- Authenticate you and keep your account secure
- Process payments and subscriptions
- Send notifications you opt into
- Improve content, fix bugs, and measure anonymous usage
- Comply with law and prevent fraud or abuse
We do not use your data for automated decisions that produce legal or similarly significant effects.
5. Legal bases (EEA / UK users)
Where GDPR applies, we rely on:
- Contract — to provide the app, bookings, and Premium you request
- Legitimate interests — security, analytics, and service improvement
- Consent — push notifications and optional marketing where required
- Legal obligation — minimal retention where required by law
6. How long we keep data
- Account data: until you delete your account, then erased without undue delay.
- Session tokens: until expiry or logout.
- Push tokens: until you disable notifications or uninstall.
- Booking and payment records: as needed for accounting, disputes, and legal obligations.
- Deletion audit log: after account deletion we may keep only a one-way hash of your email, deletion timestamp, and request source for compliance — not your readable personal data.
7. Who we share data with
We share data only with:
- Service providers (hosting, database, email, Firebase, Google, Stripe) under data-processing terms
- Guided hike operators when you submit a booking
- Law enforcement or regulators when required by law
We do not sell your personal information.
8. International transfers
Our servers and providers may process data outside Greece or your home country. Where required, we use appropriate safeguards such as standard contractual clauses.
9. Your rights
Depending on your location, you may have the right to access, correct, delete, restrict, or port your data, and to object to certain processing. You may also lodge a complaint with your local data protection authority.
Delete your account: Profile → Delete account in the app, or see Account Deletion.
10. Children's privacy
Trail Kos is not directed at children under 13 (or 16 in the EEA where applicable). We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it.
11. Changes
We may update this policy from time to time. The current version is always at https://trailkos.devolist.com/privacy. Continued use after changes means you accept the updated policy.
12. Contact
Trail Kos Support
Email: [email protected]