Security, privacy and procurement

Where data is stored

• Accounts, team maps, shared field data, backups and sign-in are stored with Supabase (database, file storage and login). As our privacy policy says, data is stored and processed in the United States.
• The website and its API run on Vercel. Server code runs in Vercel’s Washington, D.C., USA region (iad1); pages and images may be served from Vercel’s cache nearest the visitor.
• Payments and invoices are held by Stripe. We never see or store full card numbers.
• On the phone, downloaded maps, the live GPS position and app settings stay in the app’s storage on the device. Tracks and placemarks leave the device only when the member is signed in with backup on, shares them with the team, or makes a share link.

What admins can see

A team’s owner and admins can see:

• Each member’s email address and name, when their app last synced, and its version.
• Placemarks, tracks, photos and form answers a member shares with the team, one by one or with collection mode on.
• A member’s live position while they share it in a group location with the team, for up to 30 minutes after the last update.
• A member’s overdue trip check-in, when the member ticked “Also tell the admins”.
• The last Garmin inReach position of a member whose public MapShare feed an admin added.

They never see a member’s other tracks, places or backup. The app shows members this, and asks them to accept it, before they share anything. The organization decides what it does with what members share, and is responsible for having the right to collect it (for example under employment law and with members’ consent).

How long data is kept

Account data

While the account is open; removed at once when it is deleted. Copies in encrypted database backups are overwritten within 30 days.

What members share with the team (placemarks, tracks, photos, form answers)

Kept by the organization; it stays with the organization when a member leaves or is removed.

Live positions in a group location

Only the latest position, never a history. Admins see it on the dashboard for up to 30 minutes after the last update; it is deleted when the member stops sharing, leaves or the group ends (at most 3 days).

Trip check-ins (plan, contact, route and position)

90 days after the trip ends, then deleted.

Team activity log (invitations, joins, removals, exports)

For as long as the organization has an account.

Purchase and payment records

7 years, as tax and accounting law requires; kept without name or email after an account is deleted.

Download logs

12 months.

Error reports

30 days after the same error was last seen; never linked to an account.

Support emails

2 years.

The full list is in the privacy policy. Trip check-ins, download logs and error reports are deleted by scheduled jobs in the database, not by hand.

Encryption and access

• In transit: cartahaven.com and the map app at app.cartahaven.com are served only over HTTPS. Plain HTTP requests are redirected to HTTPS, and browsers are told to use HTTPS for two years (HSTS).
• Backups: database backups are encrypted.
• Passwords are stored only as a secure hash by our login provider; we can’t read them.
• Private maps are delivered through signed download links that expire after 15 minutes, and only to signed-in members of the team.
• Removing a member ends their access to the team’s private maps at once; the next time their app syncs, it deletes the team’s maps from the phone.
• Pin photos backed up with Plus go to private storage that only the member’s account can read.
• Activity log: invitations, joins, removals and exports are logged for the organization’s admins.

Deleting an account

Anyone can delete their own account at any time, on cartahaven.com/account/delete or in the map app (Settings, Delete my account). That removes their account data, backups, share links and download history at once; purchase records are kept without name or email, as tax law requires. Items a member already shared with a team stay with that team. An organization that wants its team data removed when it leaves can email us; an account that owns a team or a publisher store is closed with support.

Getting your data out

• Team field data: admins export what members shared as CSV, GeoJSON, KML or a zipped shapefile from the dashboard, filtered by member, form, kind and date.
• Your own tracks and placemarks: export from the map app as GPX, KML or GeoJSON at any time.
• Maps you uploaded stay yours; keep your originals, and new editions are uploaded the same way.
• Everything else we hold about a person: email support@cartahaven.com and we will answer within 30 days.

Subprocessors

Service providers that process personal data for us, under contract, as listed in the privacy policy:

Some map app features fetch public data straight from its source (the National Weather Service, the US Geological Survey, Esri, the National Interagency Fire Center, avalanche.org, the USDA (Forest Service and NRCS), the US Census Bureau, state wildlife and GIS services). Those requests carry a place or an area, never an account, tracks or files.

Procurement

• Invoice and purchase order: choose invoice in the dashboard and add your PO number. Stripe emails an invoice payable within 30 days, by card or bank transfer. Agency plans (from $2,499 a year) are always invoiced.
• W-9: on request. Email support@cartahaven.com.
• Data processing agreement (DPA): on request. Email support@cartahaven.com with your organization’s name.
• Quotes and vendor forms: use the contact form on the Teams page.
• Free trial without a card, so you can evaluate before any paperwork. Prices, seats and discounts are on the Teams page.

What we don’t have

So your review doesn’t have to find out the hard way:

• No security certifications or audit reports: we do not hold SOC 2, ISO 27001, FedRAMP or similar.
• No single sign-on (SAML or OIDC with your identity provider) and no two-factor sign-in yet.
• No choice of data region: data is stored in the United States.
• The Android and iPhone apps are not in the app stores yet; members use the map app in their phone’s browser, where it installs to the home screen and works offline.