Privacy Policy
Effective 2026-07-02. Last updated 2026-07-03.
Muddy Boots is a workspace for a small hiking group. This policy explains what personal information we collect when you use the app, how we use it, and the choices you have. The same app is served at muddyboots.app and at muddyboots.anandalmal.com.
If you have questions about this policy, email hello@muddyboots.app.
Who runs Muddy Boots
Muddy Boots is a personal project operated by Anand Almal ("we", "us", or "the operator") as a workspace for one specific hiking group.
Two levels of access:
- Visitors — anyone with a Google account can sign in and browse the app. Visitors see the group's roster (member first name, display name, home region, photo), trail library, log book of completed activities, and upcoming trips.
- Members — a smaller allowlist of Gmail addresses maintained by the operator. Members can additionally create content (add trails, log activities, plan trips, post messages in the Lounge, use the built-in AI assistant).
Muddy Boots is not a commercial service. There is no fee, no advertising, and no sale of data.
Information we collect
When you sign in with Google
When you authenticate through Google, we receive from Google:
- Your Google account email address
- Your display name
- A profile picture URL (if you have one set on your Google account)
- A Google-issued user identifier
We do not receive your Google password, your contacts, your calendar, your Drive files, your Gmail, or anything else beyond the basic profile scopes above. Specifically, we request only the openid, email, and profile OAuth scopes.
Information you provide inside the app
- Trails you add or edit (name, region, distance, elevation, notes, photos, and source links).
- Trips you propose or participate in (dates, participants, RSVP status).
- Activities you log (date, trail, distance, elevation, notes, attendees, photos).
- Messages you post in the group Lounge.
- Answers to the optional onboarding personality quiz.
- Optional profile details you edit (bio, home location, preferred trail types).
- Optional Strava connection (see below).
Information collected automatically
- Standard server logs (IP address, timestamp, browser, request path) retained for up to 30 days for security and debugging.
- Presence signals — when you have the app open, other members can see your first name in the "who's here" bar in the Lounge, and can see the timestamp of your most recent activity. This is inherent to a live group chat and cannot be turned off while you have the app open.
Strava (optional)
If you connect your Strava account (Member Profile → Connect Strava), we receive from Strava:
- Your recent hike-type activities (Hike, Walk, TrailRun, Run) — date, distance, elevation, name, notes.
- OAuth tokens so we can automatically import new activities.
We do not receive Strava activities of other types, and we do not receive personal Strava data unrelated to activities. You can disconnect Strava at any time from your Member Profile, which nulls the tokens and stops future imports.
How we use your information
We use your information only to run the app for the hiking group:
- Authenticate you and determine whether you are a member (per the allowlist) or a visitor.
- Display your name and photo alongside content you contribute (trails you added, activities you logged, trips you're on, messages you posted). This content is visible to both members and visitors who browse the app.
- Compute group and personal statistics (miles logged, elevation gained, trails hiked).
- Deliver the AI assistant's answers (member-only — your questions may be sent to Anthropic's Claude API for processing — see "Third parties").
- Send members optional push notifications for Lounge messages, trip updates, and RSVP changes if you opt in.
Email and phone are visible only to you (on your own member profile page). They are not displayed to other members or to visitors.
We do not use your information for advertising, do not sell it, and do not share it with third parties other than the service providers listed below.
Who can see the data you contribute
Anything you contribute (a trail entry, an activity log, a trip proposal, a Lounge message) is visible to:
- Members, who can also interact with it (post replies, RSVP, edit their own contributions).
- Visitors — any signed-in Google account browsing muddyboots.app — with two exceptions: the Lounge chat and the MB Assistant are member-only surfaces. Everything else (roster, trails, trips, log book, individual member profiles minus email/phone) is browseable by any signed-in user.
If you are uncomfortable with content you post being visible to visitors, do not post it. Members can delete their own contributions from the app at any time; visitors cannot delete anything.
Third parties that process data on our behalf
| Provider | What they receive | Why |
|---|---|---|
| Supabase (US region) | All app data (accounts, trails, trips, activities, messages). | Database, authentication, real-time messaging, edge functions. |
| Vercel | Standard web-server logs. | Hosting the app frontend. |
| The OAuth handshake payload. | Sign-in only. | |
| Anthropic (Claude API) | Your AI assistant prompts and any data the assistant reads to answer them (trails, trips, activities from your group). | Powering the MB Assistant. Prompts are not used by Anthropic to train models per their API terms. |
| Strava | Your OAuth handshake. | Only if you choose to connect Strava. |
| Anthropic Web Search (via Claude) | Search queries the assistant issues on your behalf. | Fetching public web content when you ask about trails or conditions. |
| National Park Service API, Recreation.gov | Park name and date range in each query. | Fetching public alerts and permit availability. |
| Open-Meteo | Latitude/longitude and date. | Fetching weather forecasts for trails and trips. |
We do not send your identity or personal profile to the weather, park, or permit APIs — only the coordinates and dates needed to answer the question.
Data retention
- Your account and content remain in the app for as long as you are on the member allowlist.
- If you are removed from the allowlist (or ask to be removed), your account is disabled within 7 days. Content you contributed (trails, trip participation, activities logged, messages posted) remains attributed to your name unless you request full deletion.
- Server logs are retained for up to 30 days.
- Backups are retained for up to 30 days.
Your choices
- See what we have on you: email us at hello@muddyboots.app and we'll send you a copy of your data.
- Correct information: update your Member Profile inside the app for most fields; email us for anything you can't edit.
- Delete your account: email us at hello@muddyboots.app asking for account deletion. We'll delete your account, personal profile fields, and any group-specific personal data within 30 days. Aggregated group statistics may remain but will no longer be attributed to you by name.
- Disconnect Strava: Member Profile → Disconnect Strava. Tokens are nulled immediately; already-imported activities remain.
- Opt out of push notifications: turn off notifications for the app in your device settings.
- Sign out: the app has a sign-out button in the side navigation.
Security
We use HTTPS for all traffic. Passwords are never stored — authentication is handled entirely through Google via OAuth. OAuth tokens for connected services (Google, Strava) are stored encrypted at rest by Supabase.
No system is perfectly secure. If we ever learn of a breach affecting your data, we will notify you by email as soon as reasonably possible.
Children
The app is designed for adult members of a specific hiking group. It is not directed to children under 13 and we do not knowingly collect information from anyone under 13. If you believe we have inadvertently collected data from a child, email us and we will delete it.
International users
The app is hosted in the United States (Vercel and Supabase's US region). By using the app you consent to the transfer of your information to the US.
Changes to this policy
If we make material changes to this policy, we will update the "Last updated" date at the top and — for changes that meaningfully affect what data we collect or how we use it — email you before the change takes effect.
Contact
Anand Almal hello@muddyboots.app
Muddy Boots is not affiliated with, endorsed by, or connected to Google LLC, Anthropic PBC, Strava Inc., Supabase Inc., Vercel Inc., or any of the other providers listed above.