1. About this policy
Summitodoro is a virtual focus-expedition application. This policy explains how we collect, use, share, retain, and protect information when you use the service. Questions, privacy requests, and account-deletion requests can be sent to summitodoro@louienismal.com.
2. Information we collect
Google sign-in and account information
When you choose Google sign-in, Google and Amazon Cognito provide the identifiers and basic profile information needed to authenticate you. This can include your Google account identifier, email address, name, and profile picture. Summitodoro requests only the openid, email, and profile scopes. It does not request access to Google Drive, Gmail, Calendar, contacts, or your Google password.
Profile and activity information
We store information you create or earn while using the service:
- Your hiker display name and optional profile-picture URL.
- Tasks, focus-session timing, completed summits, checkpoints, XP, focus chains, Trail Coins, and mountain unlocks.
- Friend-room membership, readiness, presence, trail progress, and multiplayer rewards when you use co-op expeditions.
Browser and operational information
Summitodoro uses browser local and session storage to keep your sign-in session, active timer, cached profile and tasks, room code, and onboarding state available in your browser. This is necessary for core functionality; we do not use advertising cookies. AWS operational logs record limited service information such as request identifiers, routes, response status, latency, and application errors. These logs are currently configured to expire after 14 days.
3. How we use information
We use information to:
- Authenticate you and protect access to your account.
- Save and synchronize your tasks, progress, and rewards.
- Operate co-op rooms and display participating hikers.
- Prevent duplicate rewards, abuse, and unauthorized access.
- Diagnose errors and maintain the reliability of the service.
We do not sell your personal information or use Google account data for advertising.
4. How information is shared
Summitodoro relies on Amazon Web Services for hosting, authentication, APIs, databases, operational state, and logs. The relevant services include Amplify Hosting, CloudFront, Cognito, API Gateway, Lambda, Aurora, DynamoDB, and CloudWatch. These providers process information only to provide infrastructure and related support for the service.
When you join a co-op expedition, other room members can see the display name, avatar (if any), readiness, presence, and trail progress associated with that room. The application also loads map resources based on OpenStreetMap data through OpenFreeMap and offers optional YouTube streams using YouTube's privacy-enhanced embed domain. Those providers may receive ordinary network information, such as your IP address and browser details, under their own privacy policies. Summitodoro does not send them your AWS account record or task content.
We may also disclose information when reasonably necessary to comply with law, enforce our terms, protect the service and its users, or address fraud, security, or technical incidents. We do not sell personal information or use Google account data for advertising.
5. Retention and deletion
Account and activity information is generally retained while your account remains active so your expedition can continue across devices. Some records can remain temporarily in encrypted backups or security logs until their normal retention periods expire.
To request deletion of your Summitodoro account and associated application data, email summitodoro@louienismal.com from the Google account connected to Summitodoro. We may ask you to verify ownership before completing the request. You can remove local browser data separately through your browser's site-data controls.
6. Security and international processing
We use access controls, encrypted HTTPS connections, managed authentication, isolated database networking, and limited service permissions to protect information. No online service can promise absolute security. AWS and other providers may process information in countries outside your own, subject to their safeguards and applicable law.
7. Children
Summitodoro is not directed to children under 13. Do not use the service if local law requires you to be older to consent to online data processing unless a parent or legal guardian has provided the required consent.
8. Your choices and policy changes
You can sign out, clear local site data, stop using co-op features, revoke Summitodoro's Google access from your Google Account, or request access to, correction of, or deletion of your account data by contacting us. Some requests may be limited by applicable law or by information we need to maintain for security or legal purposes. If this policy changes materially, we will update the date above and provide an appropriate notice in the service.