Privacy Policy

ProofPath (“Path Proof”) — the app and the pathproofing.site service.

Last updated: 27 August 2026 · Effective: 27 August 2026

This Privacy Policy explains what information ProofPath (“we”, “us”, “the app”) collects, why we collect it, who we share it with, and the choices you have. It applies to the ProofPath mobile app and the services at pathproofing.site.

This document is a template describing how the app works. Before publishing, confirm the operator’s legal name, contact address, hosting location and retention periods below, and have it reviewed for your jurisdiction (GDPR, CCPA, Apple App Store requirements).

1. Who we are

The service is operated by [Operator legal name] (“the operator”). For any privacy question or request, contact us at support@pathproofing.site.

2. Information we collect

Account information

Email address and a password (stored only as a salted Argon2id hash — we never store your password in readable form).
Display name, if you provide one.

Content you create

The decisions, options, criteria, evidence, notes and related content you add in the app. This is stored so it can sync across your sessions and devices.

Device & attribution data

When the app first opens, and to measure which marketing source an install came from, we collect:

Data	Purpose
AppsFlyer device ID, install & attribution data (media source, campaign, deep-link parameters)	Measure marketing attribution and app installs
Advertising Identifier (IDFA)	Collected only if you allow tracking in the iOS App Tracking Transparency prompt; never otherwise
Push notification token (Firebase Cloud Messaging)	To deliver notifications you have enabled
Device platform/OS, app bundle ID, store ID, device language/locale, Firebase project identifier	App functionality and analytics
IP address of the request	Security, abuse prevention and coarse region of the attribution event

The device/attribution payload is encrypted in transit (AES-256-GCM in addition to HTTPS/TLS). A reinstall is treated as a new device.

We do not collect your device’s User-Agent, contacts, photos, precise location, health data, or browsing history.

3. How we use your information

To provide the app: create your account, store and sync your content.
To send notifications you have enabled (reminders, follow-ups).
To measure marketing attribution — which channel an install came from.
To keep the service secure: rate-limiting, abuse prevention, and diagnosing errors.

4. Legal bases (EEA/UK)

Performance of a contract — running your account and the service.
Consent — advertising-identifier tracking (via the ATT prompt) and push notifications; you can withdraw it at any time.
Legitimate interests — security, fraud prevention, and basic analytics that do not override your rights.

5. Third parties we share data with

We do not sell your personal data. We share the minimum necessary with service providers who process it on our behalf:

AppsFlyer — mobile attribution. See AppsFlyer’s privacy policy.
Google Firebase (Cloud Messaging) — push notification delivery. See Firebase’s privacy information.
Apple — the App Tracking Transparency framework and the IDFA it governs.

We may also disclose information if required by law or to protect the rights, safety and security of our users and the service.

6. Data retention

Account and content data are kept while your account exists. When you delete your account, the account and its content are removed. Attribution and security records are retained for [retention period] and then deleted or anonymised.

7. Your rights and choices

Access & correction — view and edit your content in the app; update your display name and password in Settings.
Deletion — delete your account from the app (Settings → delete account); this removes your account and content.
Tracking — allow or deny the ATT prompt, and change it any time in iOS Settings → Privacy & Security → Tracking.
Notifications — turn push notifications off in iOS Settings → Notifications, or in the app.
Depending on where you live, you may also have the right to object to or restrict processing, to data portability, and to lodge a complaint with your data protection authority.

To exercise any right, contact support@pathproofing.site.

8. Security

Data travels over HTTPS/TLS; the device/attribution payload is additionally encrypted with AES-256-GCM. Passwords are hashed with Argon2id. Access tokens are short-lived and refresh tokens are rotated. No method of transmission or storage is 100% secure, but we work to protect your data.

9. Children

ProofPath is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

10. International transfers

Your data is processed on our servers [hosting location] and by the third-party providers listed above, which may process data in other countries. Where required, we rely on appropriate safeguards for such transfers.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated “Last updated” date on this page, and where appropriate we will notify you in the app.

12. Contact

Questions or requests: support@pathproofing.site.