Laam — Privacy Policy

Effective 26 September 2026 · Last updated 1 October 2026

This Privacy Policy explains how Greenyak LLC ("we", "us") collects, uses, stores, and shares information when you use the Laam mobile application ("Laam", "the app"). Laam is an offline-first trekking companion for the Himalaya.

Our guiding principle: your personal trek data is yours and stays private to your account; only the community content you choose to post is public.

1. Summary (the short version)

• Your treks and location history are private to you. They are stored on your device and backed up to your own private account in our cloud. They are never shown to other users.
• Community posts you create are public. A trail report (post), vote, or photo-validation is visible to all Laam users and is tagged with your name and the location it describes.
• Laam can share content phone-to-phone over Bluetooth when offline (the "mesh"). This carries public community posts between nearby trekkers — including relaying other people's posts through your phone. You can turn this off anytime.
• Reading is anonymous; posting requires sign-in. You can browse without an account. Posting, voting, or validating requires signing in with Google or Apple.
• You can turn off background location, turn off mesh sharing, and delete your account and data from inside the app.

The sections below give the detail.

2. Information we collect

2.1 Location data

• What: Precise GPS location (latitude, longitude, altitude), barometric pressure, and movement, collected while you are actively recording a trek.
• When: Continuous location is recorded only during an active trek. With your separate permission, recording continues while the app is in the background or your screen is off, so your route stays accurate when your phone is pocketed. Outside of an active trek, the app does not continuously track you.
• One-time location readings: Separately from trek recording, the app takes a single, momentary location reading when you tap "recenter" on the map, attach a community post, or select a trail — to center the map on you, place your content, or orient your route to the nearest stop. These are discrete readings, not continuous tracking, and use the same "while using the app" permission. If that permission isn't already granted, these readings are simply skipped (selecting a trail never prompts you for location).
• Foreground vs background: Foreground location ("while using the app") is required to record a trek. Background location ("all the time") is optional and is requested with a separate in-app explanation; declining it only means tracking pauses when the app is backgrounded.
• Post location: When you create a community post, vote, or photo-validation, the location it concerns is attached to that content (see §2.3). This is inherent to the feature — a trail report is a report about a place.

2.2 Account and identity data

• Anonymous use: On first launch we create an anonymous account so the app works offline. Anonymous accounts can read the community feed but cannot post, vote, or validate.
• Sign-in: To contribute, you sign in with Google or Apple. We receive your display name and profile photo (and, depending on the provider, your email address) to attribute your contributions and maintain your community reputation.

2.3 Community content you create

• Posts, votes, photo-validations ("witnesses"). Content you choose to submit, including text, the post's category, the location it describes, and any photo or video you attach. Photos may contain embedded location and timestamp metadata, which is part of the validation's purpose (proving a condition at a place and time).

2.4 Sensor data

• Barometer (air pressure) for weather/storm awareness and altitude. While you record a trek, pressure readings are stored as part of your trek data (so they are kept locally and synced to your private cloud account along with the GPS series — see §4.1); they are not shared with other users.
• Step counts (with your motion/fitness permission, which is optional). While you record a trek, the app reads your phone's step-counter sensor and stores the trek's total step count as part of your trek data — private to your account, like the GPS series. Step readings are also used, on your device, to notice that you have started walking again after an automatic pause, and to judge whether a recording reflects travel on foot (rather than a vehicle) before it is allowed to contribute to anonymous, aggregated walking-time statistics. That judgment is a data-quality control: it is never shown publicly and never labels you to other users. Declining the motion permission disables step counting; trek recording still works.
• Accelerometer / significant motion for detecting whether you are moving (to save battery, wake tracking from an automatic pause, and drive the offline mesh duty cycle). This is processed on your device only and is not stored or uploaded.

2.5 Device and diagnostic data

• Crash and error reports (via Sentry) to keep the app stable, including crash traces, performance data, and basic device/OS information. We do not use this to identify you personally.

2.6 On-device AI assistant

• Laam includes an optional on-device AI assistant ("Ask Laam"). Your questions and its answers are processed on your phone. We do not receive or store them, with one exception: a weather question sends the place name you asked about — and then its coordinates — to our forecast provider (Open-Meteo), because a forecast cannot be computed offline. Downloading the optional AI pack transfers model files to your device; nothing about your conversations travels the other way.

We do not collect: contacts, browsing history outside the app, advertising identifiers, or microphone audio.

3. How we use your information

We do not sell your personal information, and we do not use it for advertising or behavioral profiling.

4. How your information is stored and shared

4.1 Private to you — your treks and location history

Your recorded treks (including the detailed GPS series and step counts) are stored locally on your device and uploaded to your own private space in our cloud database (Google Firebase / Firestore). Access is restricted by security rules so that only your account can read your trek data. It is not visible to other users. We may process this data with automated server functions (for example, to compute crowd-sourced walking-time statistics) in a form that is aggregated and not attributed to you publicly.

4.2 Public — community content you post

Content you submit (posts, comments, photo validations, disputes and resolves) is, by design, visible to all Laam users, attributed to your name and profile photo, and tagged with the location it concerns. Up and down votes are counted but never attributed: no other user can see who voted, or which way; only the totals are public. Anyone using Laam can see it on the map and in the feed. Do not post anything you would not want to be public. You can delete a post you created within a short window after posting (currently 5 minutes, and only before other users have interacted with it); after that, you can request its removal from inside the app and we will review the request (community interaction — votes, validations — creates reliance by other trekkers, which is why later removal is reviewed rather than immediate).

4.3 Offline sharing between phones (the Bluetooth "mesh")

Because trekkers spend days off the grid, Laam can pass public community posts directly between nearby phones over Bluetooth, so a trail report can travel up and down the mountain until a phone reaches Wi-Fi. This means:

• Your posts/validations may be received by, and relayed onward by, other trekkers' phones near you.
• Your phone may likewise carry and relay other users' public posts.
• This sharing covers community posts only. It never shares your private location history or treks.
• Bluetooth transmissions are short-range. You can turn mesh sharing off at any time in Profile (you will still be able to read everything); a one-time notice explains this on first launch.

4.4 Third-party service providers

We use these providers to operate the app; your data is processed under their terms:

• Google Firebase (Authentication, Firestore database, Storage, Cloud Functions, Hosting) — backend storage and sync.
• Google / Apple Sign-In — authentication.
• Sentry — crash and error reporting.

We do not otherwise share your personal data with third parties except where required by law.

5. Data retention

• On your device: trek GPS detail is kept locally until it is safely synced to your private cloud account, then cleared from the device to save space.
• In the cloud: your treks and your community contributions are retained while your account exists.
• After deletion: when you delete a trek, a post or your account (§7), a snapshot of the deleted material is kept in a restricted, admin-only cold store for a limited period — currently 30 days (counsel to confirm or adjust; this is a tunable constant) — solely for abuse prevention, dispute handling, and legal compliance, then destroyed. Community posts you leave behind at account deletion remain in the anonymized form described in §7.
• Re-registration control: on account deletion we retain a one-way cryptographic hash of your email address (not the address itself) for a limited period, to prevent immediate re-registration abuse of community reputation — (counsel to set the period; the mechanism is built but not enforced until then).

6. Your choices and controls

• Background location: optional; enable/disable via your device settings or the in-app prompt; manage under Profile → "Background trek tracking".
• Motion / step counting: optional; requested in-app when relevant; manage under the Trek screen's tracking-health row or your device settings. Declining it never blocks trek recording.
• Mesh sharing: on by default; turn off anytime under Profile → "Share & relay over mesh". A first-launch notice explains it.
• Hide other trekkers: you can hide any user's posts from your own feed (this affects only what you see and never notifies anyone); manage under Settings → Community → "Hidden trekkers".
• Posting: entirely optional. You can use Laam as a reader without ever signing in or posting.
• Permissions: location, motion, Bluetooth, camera, and photo access are each requested only when needed and can be revoked in your device settings.

7. Your rights — including in-app deletion

Depending on where you live (including under the EU/UK GDPR and the California CCPA/CPRA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at laam.trek@greenyak.net. We will respond within the timeframe required by applicable law.

• Access / export: request a copy of your trek and account data.
• Deletion — built into the app: Settings → Account & Data → delete your account. This works without contacting anyone and does the following:
  • Erased outright: all your treks and location history, your safety incident reports, your reputation/star history, and your sign-in identity.
  • Anonymized: community posts that other trekkers have relied on (voted, validated, commented) lose your name and photo permanently (shown as "Trekker"); the votes and validation counts other users earned against them are kept, unattributed. Your comments and support tickets are likewise anonymized.
  • Media purged: photos and videos you attached to public posts are deleted from storage even where the post's text remains (a photo of you is personal data even on a public report); the post shows "[photo removed]".
  • The deleted material passes through the time-limited cold store described in §5, then is destroyed.
• Delete one trek — without deleting your account: open the Journal, tap the trek, tap the bin icon at the top right, and confirm. The trek leaves your phone at once; its cloud copy — the trek and its full GPS route — is erased the next time your phone connects. It passes through the time-limited cold store described in §5, then is destroyed.
• Delete one post — without deleting your account: open your post and tap the bin icon at the top. Within 5 minutes of posting, and while no one has voted on, commented on or validated it, this deletes the post, its photo or video, and its discussion for everyone; copies already relayed to nearby phones over Bluetooth (§4) fade as those phones' caches turn over. After that, the post is part of the community record, and the same bin icon sends a removal request instead — a person reviews it, usually for privacy reasons or honest mistakes, and the post stays up until it is reviewed. A deleted post passes through the cold store described in §5, then is destroyed.
• Withdraw consent: disable background location, motion, or mesh sharing at any time as described above.

The in-app description of deletion (shown before you confirm) is maintained in a single reviewed registry and must always match this section.

8. Security

We use industry-standard measures including encrypted transport (HTTPS/TLS), server-side access-control rules that keep personal trek data private to its owner, and identity requirements for community contribution. No system is perfectly secure; we cannot guarantee absolute security. Note that Bluetooth mesh transmissions (§4.3) carry public community content and are not individually encrypted; they are limited to short Bluetooth range.

9. Children's privacy

You must be 18 or older to create a Laam account, and you confirm this when you sign in. Laam is not directed to children, and we do not knowingly collect personal data from anyone under 18 (founder ruling 2026-09-07 — 18 clears COPPA, every EU/UK consent age and India's DPDP under-18 rule; counsel to confirm). If you believe a person under 18 has provided us personal data, contact us and we will delete it.

10. International users

Laam serves trekkers globally. Your data may be processed and stored on servers operated by our providers (§4.4) in locations that may differ from your country of residence. Where required, we rely on appropriate safeguards for international transfers (to be confirmed by counsel).

11. Changes to this policy

We may update this policy as the app evolves. We will revise the "Last updated" date and, for material changes, provide notice in the app. Continued use after an update constitutes acceptance of the revised policy.

12. Contact

Greenyak LLC 2823 Greenbower Way, Ellicott City, MD 21042, USA laam.trek@greenyak.net