Cookie & Data Storage Notice

Victory Lap Trail is a web-based progressive web application (PWA). This notice explains what data is stored locally on your device and what is stored on our servers. We do not use advertising cookies or third-party tracking.

At a Glance

1. What Is Stored on Your Device

Session Storage

We do not use sessionStorage for persistent data. Session state is managed by the Supabase authentication library in memory only and is cleared when you close the browser tab.

localStorage

We do not store personal data in localStorage. The Supabase JS SDK stores an authentication token locally so you remain logged in between visits. This token is:

• Encrypted and tied to your session
• Never shared with third parties
• Cleared when you log out

Service Worker Cache (PWA)

If you install the App or visit on a modern browser, a service worker may cache the following for faster loading:

• Static app files (HTML, CSS, JavaScript)
• Third-party library files (Leaflet.js, Supabase SDK)

The service worker does not cache your account data, check-in records, location coordinates, or any personal information.

2. What Is Stored on Our Servers

The following data is stored in our Supabase-hosted database:

• Your username and hashed password (via Supabase Auth — we never see your raw password)
• Your email address
• Your check-in history, points, streaks, and achievement records
• Your GPS coordinates at the moment of each check-in
• Timestamps of all check-in events

Location photos and QR codes are stored in Supabase Storage (cloud object storage). These are public assets and are not linked to individual user accounts.

3. Third-Party Services

The App uses the following third-party services that may process data as part of normal operation:

• Supabase (supabase.com) — database, authentication, and file storage. See supabase.com/privacy.
• CartoDB / OpenStreetMap — map tile provider. Tile requests include your IP address as standard HTTP traffic. No personal data is sent beyond this. See carto.com/privacy.
• Google Fonts — fonts loaded from Google's CDN. Your IP address is sent to Google as part of the font request. See policies.google.com/privacy.

We do not use Google Analytics, Facebook Pixel, or any advertising or behavioral tracking services.

4. Camera Access

The QR scanner feature requests access to your device camera. Camera access is:

• Only active when you open the QR Scanner tab and tap "Start Camera"
• Used solely to read QR codes — no images, video, or frames are stored or transmitted
• Stopped immediately when you leave the QR Scanner tab

You can deny camera permission at any time in your device settings. GPS check-ins remain available if camera access is denied.

5. Location Access

GPS location is requested to calculate your distance from check-in sites. Location data is:

• Only accessed in the foreground while the App is open
• Not tracked continuously or in the background
• Recorded (your coordinates at check-in time) and stored on our servers

You can deny location permission at any time. QR code check-ins remain available without location permission.

6. How to Clear Your Data

To remove locally stored data from your device:

• Log out of the App (clears the authentication token from localStorage)
• Clear your browser's site data (browser Settings → Privacy → Clear Browsing Data)
• Uninstall the PWA if you have added it to your home screen

To request deletion of your server-side data, email us at legal@edgesetmarketing.com. We will process requests within 30 days.

7. Contact

Questions about data storage or this notice:

Edgeset Marketing, LLC
Email: legal@edgesetmarketing.com
Website: https://victorylap.trail