Last updated 29 August 2026 · version 2026-08-29
thicket is operated by blckbrd technologies LLC, a Missouri limited liability company.
The short version. We never store raw GPS coordinates, and we never track your location continuously or in the background. When you check in, we keep the park and the time. That is the whole record.
What "location" means here
The word covers four different things in this app, and they are not equally sensitive, so this policy names them separately.
- A live GPS reading. Your device takes one when you open the map, so it can centre on you, and one when you check in, so it can confirm you are at the park. Both are used on the device and thrown away. Neither is ever sent to us.
- A rounded area. To show you nearby parks, the app has to ask our database which parks are in your part of the world. Your position is first snapped to a grid roughly three and a half miles across, and only that square is sent, so the request narrows you to a cell of that size and no further. Your real position stays on the device, which filters the results down to your actual search radius locally. The same rounded square is used to look up the day's weather.
- A home turf. Optional, and only if you set one. A single GPS reading is sent to our server, converted to a city and state, and discarded. We store "St. Charles County, Missouri", never the coordinates. You choose whether it appears on your profile at all, and at what level of detail.
- A city and state you type. If you apply for access on our website, you tell us where you live in your own words. That is text you wrote, not a reading from a device, and it is not connected to any account.
What we collect
- Account information: your email address, used for sign in, and a display name.
- Profile details you choose to add, like an avatar icon and colour, interests, or an equipped title.
- Check in records: which park, when, which activity if you picked one, and whether your device confirmed you were near the park at that moment. Your device measures the distance itself. Only the yes or no result reaches us.
- A home turf, if you set one, as described above.
- XP, streaks, and achievements you earn.
- Anything you submit on purpose: photos, ratings, written reviews, park submissions, and issue reports. Photos have their location and device metadata stripped on your phone, before upload.
- If you report a photo, review, or profile: who reported it, what was reported, the reason you chose, and anything you add. This is used only to review the report. It is never shown to the person you reported.
- If the app crashes: an error message, a stack trace, your app version, and whether you are on iOS or Android, linked to your account if you are signed in, so we can find and fix the problem.
- If you write to us, apply for access, or join the waitlist through our website: your name, email address, the city and state you type, how often you say you visit parks, and anything you write in the message. This reaches us as an email. We keep applications while the alpha is running and delete them afterwards, and you can ask us to delete yours at any time.
- Which version of these documents you accepted, and when.
Some things stay on your device and never reach us at all. If you check in with no signal, the check in and any photo wait on your phone until it can sync. The app also keeps a copy of the park list locally so the map works offline. Deleting the app removes both.
What we do not do
- We do not read your location in the background, on a schedule, or while the app is closed.
- We do not sell your data, and we do not share it with advertisers.
- We do not build a movement history. The record is "you visited this park", not a timeline of where you have been.
- We do not run ads, and there is no analytics or tracking software in the app.
Who else touches your data
- Supabase hosts our database, sign in, file storage, and server functions. Everything in the list above that we store is stored there.
- Stadia Maps serves the map tiles. Their servers see which part of the map you are looking at, the same way any map in any app works. The underlying map data comes from OpenStreetMap; Stadia turns it into the styles the app shows.
- OpenStreetMap and Nominatim convert a single GPS reading into a city and state, only at the moment you set a home turf. They never receive your check in locations.
- Open-Meteo provides the weather shown on the noticeboard. The app asks it directly, using the rounded square described above, with nothing attached that identifies you.
- Cloudflare hosts our website and keeps short term request logs for it.
- Resend delivers the email when you write to us or apply through the website.
If we ever add a service that handles your information, it goes on this list before it is switched on, not after.
Your controls
- Edit or remove your profile details, home turf, and title at any time from Edit Profile.
- Delete your own review from the park's page, without deleting your account.
- Delete your account entirely from Settings, then Delete Account. You can also do this from getthicket.app/delete-account, or by emailing us if you cannot get into your account.
What deletion actually removes
Deleting your account removes your profile, check ins, XP, streaks, badges, achievements, reviews, reports, feedback, and the photos you uploaded, including the image files themselves. It revokes your sign in. It cannot be undone.
Two things survive on purpose, and neither is connected to you afterwards. A park you submitted stays on the map, because by the time it is approved other people are checking in there; the record of who submitted it is erased. Moderation decisions you made about someone else's content stay in that content's history, with your name removed.
If you owned a group, it passes to another member rather than closing. If you were its only member, it closes.
Live data goes immediately. Our host keeps encrypted backups for a limited period, so a copy of deleted data can persist in those backups until they age out. We do not use backups to restore individual accounts.
Security
We use reputable hosts, we keep the amount of personal information we hold small on purpose, and access to it is limited to people who run the service. No system is perfect. If a breach ever affects your information, we will investigate it and notify you where the law requires, or where you would want to know.
Children's privacy
thicket is for people 13 and over. It is not directed at children under 13, we do not knowingly collect information from them, and if we learn that an account belongs to someone under 13 we will delete it.
Changes
This policy will change as the app develops. The version and date are at the top. If we make a change that materially affects you, we will ask you to read and accept the new version in the app rather than quietly updating this page.
Questions
Questions about this policy? hello@getthicket.app