Privacy Policy

This Privacy Policy explains how Spradlin Managing & Investments, LLC (21 Ranchette Road, Conway, AR 72032) collects, uses, and protects your information when you use ETA Club. Short version: we collect what the app needs to work, your location is visible only to people you explicitly share it with, and we never sell your personal data.

1. What we collect, why, and how long we keep it

• Account information — name, email address, and password (stored hashed by our authentication provider). Used to create and secure your account and show your name to people and clubs you join. Kept until you delete your account.
• Precise location (real time) — your GPS position while a navigation or sharing session is active. Used to compute your ETA, update the map, and share your position with people you choose. Kept: your moment-to-moment location trail is processed in your browser and is not stored on our servers.
• Trip & ETA history — for each completed run: route or destination name, start/end time, duration, distance, and top speed. Used for your personal history and any club features you join. Kept until you delete the trip or your account — you can delete any trip at any time in the app.
• Trip planning records — destinations you enter when planning (which can reveal places you go). Auto-deleted after 90 days.
• Saved routes (“legs”) — start/end points you save on purpose. Kept until you delete them or your account.
• Contacts, groups & clubs — the people or clubs you share with, including email addresses you invite. Used only to provide the sharing you set up. Kept until the membership or your account is deleted.
• Device & browser data — IP address, browser type, and basic logs. Used for security, abuse prevention, and to record your acceptance of our terms. Kept up to 12 months in logs; consent records are kept while your account exists.

2. Who can see your location

Only the people, groups, or clubs you explicitly choose to share with — sharing is always opt-in, per person or group, and defaults to private. Nobody at Spradlin Managing & Investments, LLC watches your location, and there is no public feed of anyone’s position. When you stop sharing, viewers stop seeing you.

3. We never sell your data

We do not sell personal data, and we do not share it with third parties for cross-context behavioral advertising. There are no data brokers, ad networks, or lookalike audiences here.

4. Third-party processors

We use a small number of service providers who process data only on our instructions:

• Hosting: [Vercel Inc. — REPLACE/CONFIRM] (application hosting, USA)
• Database & authentication: [Supabase Inc. — REPLACE/CONFIRM] (account data, trip history, consent records, USA)
• Mapping & geocoding: [HERE Global B.V. — REPLACE/CONFIRM] (route planning and address lookup; receives the coordinates and addresses needed to compute a route)
• Analytics: [NONE CURRENTLY IN USE — update if added]
• Email delivery: [PROVIDER — REPLACE] (invites and account emails)

5. Your rights

You can access, correct, delete, or export your data at any time: Settings → your profile has “Download my data” and “Delete my account and data.” You can also email [privacy@YOUR-DOMAIN.com] — we respond to privacy requests within 30 days. Deleting your account removes your profile, trips, saved routes, club memberships, and sharing relationships.

6. Children

ETA Club is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly, as required by the Children’s Online Privacy Protection Act (COPPA). Users 13–17 require parent or guardian consent, as described in the Terms of Service. Parents or guardians may contact [privacy@YOUR-DOMAIN.com] to review or delete a minor’s information.

7. State privacy rights (California and similar states)

If you live in California or another state with a comprehensive privacy law (e.g., Colorado, Connecticut, Texas, Virginia), you have the rights to know, access, correct, delete, and obtain a portable copy of your personal information, and the right not to be discriminated against for exercising them. In the last 12 months we collected these categories: identifiers (name, email, IP), geolocation data (precise, as described above), internet activity (basic logs), and inferences limited to trip statistics. We do not sell or share personal information for cross-context behavioral advertising, and we do not use or disclose sensitive personal information beyond what is necessary to provide the Service. Exercise any right in Settings or by emailing [privacy@YOUR-DOMAIN.com]; we will verify your request via your account email and respond within the legally required window (at most 30 days unless the law allows an extension, which we will explain). You may use an authorized agent where the law provides for one.

8. Security and breach notification

Data is encrypted in transit (TLS) and at rest by our database provider; access is controlled by row-level security so each account can only read its own private data; passwords are hashed, never stored in plain text. No system is perfectly secure — if a breach affects your personal data, we will notify you and the relevant authorities without undue delay, consistent with applicable law, and tell you what happened, what data was involved, and what we are doing about it.

9. Changes to this policy

If we make a material change, we will notify you in the app and require you to review and accept the updated policy before continuing. The version and date at the top of this page always reflect the current policy.

10. Contact

Privacy requests: [privacy@YOUR-DOMAIN.com] · Spradlin Managing & Investments, LLC, 21 Ranchette Road, Conway, AR 72032