TreeMiles Privacy Policy

a) Information you provide to us

• Waitlist and contact forms: work email address, company name, company size, and any message you choose to include.
• Account registration: first and last name, email address, and, for challenge organizers, company name, phone number, and billing/payment information (payment card details are processed by our payment processor and are not stored by us).
• Manually logged activities: activity type (e.g., walking, running, cycling, swimming), distance, duration, and date.
• Support requests: any information you include when you contact us.

b) Activity, fitness, and health-related information (with your permission)

• Step and activity data from your device: if you enable the integration, we collect step counts and related activity data through Apple HealthKit (iOS) or Google Health Connect (Android). We only read the data types you explicitly authorize. We do not use HealthKit or Health Connect data for advertising, marketing, or data mining, and we do not sell it.
• Strava: if you choose to connect your Strava account, we automatically import your activities from Strava, including activity type, distance, date, and duration. You can disconnect Strava at any time in the App ("My Integrations"), which stops further imports.

c) Location information (with your permission)

Precise GPS location is collected only while you are actively recording an activity in the App (from the moment you press "start" until you stop the recording). We do not track your location in the background or when you are not recording. Route data is used to calculate distance, verify activity plausibility, and display your route to you. You can revoke location permission at any time in your device settings; in that case, in-app GPS recording will not be available, but you can still log activities manually or via Strava.

d) Information collected automatically

• Device and usage data: IP address, device type and model, operating system, app version, browser type, language settings, unique device identifiers, pages/screens viewed, time spent, and diagnostic and crash data.
• Push notification tokens: if you enable push notifications, we use Firebase Cloud Messaging (Google) to deliver them. You can disable push notifications in your device settings at any time.
• Cookies and similar technologies on the Site — see Section 6.

e) Information we receive from your employer or challenge organizer

If you join a challenge organized by your employer, the organizer may provide us with your work email address or an invitation identifier so you can join the company event.

We use the information we collect to:

• provide, operate, and maintain the Services, including recording activities, converting miles into trees, and displaying individual and team rankings;
• create and manage your account and your company's challenge;
• process payments from challenge organizers;
• communicate with you about the Services, including waitlist updates, challenge notifications, and support responses;
• send marketing communications about TreeMiles, where permitted by law (you can opt out at any time — see Section 7);
• generate aggregated, de-identified statistics and impact reports (e.g., total miles and trees for a company challenge);
• monitor, analyze, and improve the Services, including detecting anomalous or fraudulent activity entries;
• ensure security, prevent abuse, and enforce our Terms of Service;
• comply with legal obligations.

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising.

We share personal information only in the following circumstances:

• With your employer / challenge organizer: if you participate in a company challenge, the organizer and other participants can see your display name, logged distances, earned trees, badges, and your position in individual and team rankings. Organizers do not receive your GPS routes, raw health data from HealthKit/Health Connect, or your precise location.
• Service providers (processors) that help us operate the Services, such as cloud hosting and backend infrastructure, payment processing, email delivery, push notification delivery (Firebase / Google), and analytics providers (see Section 6). These providers may only process personal information on our instructions.
• Reforestation partners: we share only aggregated challenge results (total trees to plant) — never participant-level personal information.
• Legal reasons: when required by law, subpoena, or other legal process, or to protect the rights, safety, and property of TreeMiles, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of the transaction, subject to this Privacy Policy.

Some information we collect — such as step counts, physical activity data, and precise geolocation collected during activity recording — may be considered "consumer health data" under laws such as the Washington My Health My Data Act and the Nevada consumer health data law.

• What we collect: activity type, distance, duration, step counts (via HealthKit / Health Connect, with your permission), and precise location during active recording.
• Why: to provide the core functionality of the Services (logging miles and converting them into trees), display your progress and rankings, and detect fraudulent entries.
• Sources: you (manual entries), your device's health platform (with permission), Strava (if connected), and the App's GPS recorder (with permission).
• Sharing: as described in Section 3. We do not sell consumer health data, and we do not share it with advertisers.
• Your rights: you may withdraw consent (by revoking device permissions or disconnecting integrations), request access to or deletion of your consumer health data, and appeal our decision, by contacting us at the address in Section 12.

• Health data permissions: manage HealthKit / Health Connect access in your device settings at any time.
• Location: revoke location permission in your device settings; GPS recording will stop working, other features remain available.
• Strava: disconnect at any time in the App under "My Integrations" (and/or in your Strava account settings).
• Push notifications: disable in your device settings.
• Marketing emails: every marketing email contains an unsubscribe link. Opting out of marketing does not affect transactional messages (e.g., account or challenge notifications).
• Account deletion: you can delete your account and associated personal data directly in the App (Settings → Delete Account) or by emailing us at privacy@treemiles.app. Deletion instructions are also available at treemiles.app/delete-account.

The Site uses cookies and similar technologies for essential functionality, analytics, and measuring the effectiveness of our communications. We use tools such as Google Tag Manager and Microsoft Clarity (session analytics such as heatmaps and session replays) to understand how visitors use the Site and improve it. Clarity may collect device, usage, and interaction data on our behalf; for more information, see Microsoft's privacy statement.

You can control cookies through your browser settings. Because there is no industry standard for responding to "Do Not Track" browser signals, the Site does not currently respond to DNT signals. Where required by applicable state law, we treat Global Privacy Control (GPC) signals as a valid opt-out of sale/sharing (note: we do not sell or share personal information for cross-context behavioral advertising).

If you join the waitlist or otherwise agree to be contacted, we may send you emails about TreeMiles, including launch updates and offers. You can opt out at any time using the unsubscribe link in any marketing email or by contacting us. We honor opt-out requests promptly, as required by the CAN-SPAM Act.

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws), you may have the right to:

• Know / access the personal information we have collected about you;
• Correct inaccurate personal information;
• Delete your personal information;
• Portability — receive a copy of your personal information in a portable format;
• Opt out of the sale of personal information, sharing for cross-context behavioral advertising, and certain profiling (note: we do not sell personal information or share it for cross-context behavioral advertising);
• Limit the use of sensitive personal information (California). We use sensitive personal information — precise geolocation collected during activity recording — only to provide the Services you request;
• Non-discrimination for exercising your rights;
• Appeal a refusal of your request (in states that provide an appeal right).

How to exercise your rights: email privacy@treemiles.app with your request. We will verify your identity (e.g., by confirming control of the email address associated with your account) and respond within the timeframe required by applicable law. You may designate an authorized agent to submit a request on your behalf where permitted.

Categories of personal information collected (California notice): identifiers (name, email, IP address, device identifiers); commercial information (challenge purchases by organizers); internet or network activity (usage data); geolocation data (precise, during recording only); sensory or health-related information (activity and fitness data); professional information (employer, company size); inferences (challenge progress and rankings). Sources, purposes, and disclosures are described in Sections 1–3. We retain each category as described in Section 9.

We retain personal information for as long as your account is active or as needed to provide the Services, and afterwards only as long as necessary to comply with legal obligations, resolve disputes, and enforce agreements. Specifically:

• account data — until account deletion, then deleted or de-identified within 30 days;
• activity and GPS data — for the duration of the account; deleted with the account;
• waitlist data — until launch communications conclude or you unsubscribe;
• billing records — as required by tax and accounting law.

Aggregated, de-identified statistics (e.g., total trees planted by a company) may be retained indefinitely.

We use administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption in transit, access controls, and activity anomaly monitoring. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

TreeMiles is operated from Poland, and your information is processed and stored on servers located in the European Union and, for certain service providers, in the United States. By using the Services, you understand that your information will be transferred to and processed in countries other than your own. EU-based processing is subject to the EU General Data Protection Regulation (GDPR), which provides a high standard of data protection.

The Services are intended for working adults and are not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where a higher age applies). If you believe a child has provided us with personal information, contact us and we will delete it.

TreeMiles (Posadzimy.pl Sp. z o.o.)
ul. Świeradowska 51/57, 50-559 Wrocław, Poland
Email: privacy@treemiles.app

If you are a challenge participant, note that your employer (the challenge organizer) is responsible for its own handling of any workplace data outside the Services.

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date and, for material changes, notify you by email or in-App notice. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.