Privacy Policy

Who We Are

Phantom Trace is a paranormal investigation management app operated by DawnForge Labs, based in Muskegon, Michigan. Phantom Trace is the companion app to the West Michigan Mystery Machine website. Questions or data requests can be directed to [email protected].

Data We Collect

Phantom Trace collects only the data necessary to operate the investigation management features of the app. We do not collect data for advertising, profiling, or sale to third parties.

Account Information

• Email address — required to create and log in to your investigator account.
• Password — stored as a hashed credential by Supabase Auth. We never see your plaintext password.
• Name (optional) — if you sign in with Google, we receive your display name from Google.
• Session token — stored in a secure first-party cookie (wmm_u) to keep you signed in across pages.

Investigation Evidence

• Photos captured during active investigations — stored in your private evidence archive.
• Short video clips captured during active investigations — stored in your private evidence archive.
• Sensor readings (magnetometer / EMF, accelerometer, barometer, compass) logged during sessions.

Location Data

• Precise GPS coordinates (latitude, longitude, altitude, accuracy) — collected during active investigation sessions when you grant location permission. Used solely to geo-tag evidence captures and sensor readings to your case file. Location data is never collected in the background or when the app is not in use.

Device Sensors

• Magnetometer (compass / EMF readings) — read in real time during investigations.
• Accelerometer / motion sensor — read in real time during investigations.
• Barometric pressure sensor — read in real time during investigations, where supported.

Camera and Microphone

• Camera — used to capture investigation photos and video clips within the app. We do not access your camera roll or existing photos unless you explicitly choose to import them from your gallery.
• Microphone — requested as a system-level requirement for video recording on Android. The app does not record audio independently of video, and does not transmit audio without user action.

Payments

• All payments for Pro subscriptions and Spectral Token bundles are processed by Stripe. Stripe receives your card details directly through their secure checkout — we never see, transmit, or store your full card number. We retain only a Stripe customer ID and your subscription status (active / canceled / past due).

What We Do NOT Collect

• No analytics, usage tracking, or behavioral data.
• No device identifiers, advertising IDs, or fingerprinting.
• No contacts, calendar, or SMS data.
• No data from other apps on your device.

How We Use Your Data

All collected data is used exclusively to operate Phantom Trace and the West Michigan Mystery Machine website:

• Your email is used for authentication, account recovery, and (if you opt in) closed alpha tester onboarding.
• Evidence files (photos, videos) are stored in your private, access-controlled archive linked to your account.
• Sensor readings and GPS coordinates are stored with your case files for investigation record-keeping.
• Payment information is handled entirely by Stripe — we never see or store your card number.
• Standard server logs (IP address, user agent, timestamp) are retained by Cloudflare for security and abuse prevention.
• No data is used to train AI models, build advertising profiles, or sold to any third party.

Data Storage and Security

• All data is stored in Supabase (PostgreSQL), hosted in the United States.
• All data in transit is encrypted via HTTPS / TLS. Supabase does not support unencrypted connections.
• Evidence files are stored in a private storage bucket. Signed URLs with a 1-hour expiry are used to display evidence within the app — files are never publicly accessible.
• Row-Level Security (RLS) policies enforce that each user can only access their own data.
• Evidence retention: Evidence and case data are retained for 2 years from the date a case is closed. After that period, data is eligible for deletion. Active cases are retained until you delete them.

Data Sharing

We do not sell, rent, or share your personal data with third parties, advertisers, or data brokers.

The third-party services we use are:

• Supabase — database, authentication, and file storage provider. Supabase processes data only as a data processor on our behalf and does not use your data for its own purposes. See supabase.com/privacy.
• Stripe — payment processor for Pro subscriptions and Spectral Token bundles. When you make a payment, your card details are sent directly to Stripe and are never stored on our servers. We receive only a customer ID and subscription status. See stripe.com/privacy.
• Google (Sign-In + Google Play) — used for optional Google account sign-in and for distributing the Phantom Trace Android app via Google Play. When you sign in with Google, we receive your name and email address only. See policies.google.com/privacy.
• Cloudflare — hosts the West Michigan Mystery Machine website and serves as our CDN and DNS provider. Cloudflare may log standard request metadata (IP address, user agent, timestamp) for security and abuse prevention. See cloudflare.com/privacypolicy.
• AI processing (self-hosted) — features such as AI trip generation, location intelligence, and photo evidence analysis run on a self-hosted AI server operated by DawnForge Labs. Your data is sent to this server only when you trigger an AI feature, is processed in real time, and is not retained after the response is returned. No third-party AI provider (OpenAI, Anthropic, Google, etc.) receives your data.

Your Rights

• Delete your account and data: You can request full deletion of your account, case files, evidence, and all associated data by emailing [email protected]. Requests are fulfilled within 30 days.
• Export your data: You can request a copy of your data in CSV or JSON format by contacting us at the same address.
• Correct your data: You can update your email and password from within the app. Case data can be edited or deleted at any time from within the app.

Children

Phantom Trace is intended for users aged 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us at [email protected] and we will delete the account promptly.

Advertising

Phantom Trace contains no advertising. We do not use advertising SDKs, ad networks, or interest-based targeting of any kind.

Changes to This Policy

If we make material changes to this policy, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via the email associated with your account.

Contact

For any privacy questions, data requests, or account deletion requests, contact:

DawnForge Labs
Muskegon, Michigan
[email protected]