PRIVATE PREVIEW / WORKING DRAFT

Privacy, without
the fine-print tricks.

These are explanatory draft notes, not finalized terms or a legal-compliance guarantee. Crawlist is not publicly launched. The operator's legal identity, service address and working rights/copyright contact must be supplied and legally reviewed before a public launch. No agreement is collected on this page.

Conversations

Chats are not end-to-end encrypted. The app uses HTTPS to communicate with Supabase. Authorized administrators can inspect route-group messages. Private conversations are not an unrestricted admin inbox: reported messages and eligible report context may be reviewed through the server's moderation tools, and evidence access is logged.

Under notice 2026-10-16-v3, a report includes the reported message and the latest 50 eligible messages in that chat at report time. This can include messages after the reported one and eligible deleted text. Nothing sent after the report is included. Only messages sent under the new notice qualify for this expanded context; older notices retain their narrower preceding-message scope. Deleting hides a message from participants immediately. Eligible deleted text may be retained for up to 90 days after deletion, and report evidence has its own 90-day access limit after the report. Account deletion scrubs the author's retained evidence text.

Your routes, your work

Creating a route does not transfer ownership of your original writing or photos to Crawlist. The intended terms grant only the non-exclusive permissions needed to host and display content to the audience you choose. Do not upload other people's photos, copied guide text, private information or misleading sponsorships without the appropriate rights.

Reporting & appeals

In-app reporting covers routes, comments, messages, public stop notes and profile photos. A report is not proof of wrongdoing. Moderators should review the context, record a reason and apply a proportionate response. A working external channel for copyright notices, appeals and privacy requests must be established before launch; this draft does not pretend an unconfigured mailbox works.

Accounts & admin access

Public profiles and public content can be visible to other explorers. Full login email addresses are not public profile fields. Journey progress and unshared journal notes are account-private. Admin permissions are enforced on the server, not by a browser flag or email-name match. This web desk keeps authentication tokens in memory only, signs out after inactivity and does not send data to analytics or external font providers.

Moderators may send in-app account warnings and restrict chat access, comments/ratings/public notes, route publishing or the whole account for a stated duration. Active reasons and expiries appear in Account notices, and timed restrictions expire automatically. Warnings do not send email or background push. Moderators may waive a particular account's next photo or local-city change cooldown; the normal cooldown resumes after that change. Only the super administrator may grant or remove ordinary admin roles. Account actions are audited. Appeals must remain possible through an external contact channel before public release.

Optional notifications

Profile > Message notifications controls foreground banners and optional Apple push alerts. Push requires a separate iOS permission prompt. Supabase stores the device token, delivery environment and live session reference; Apple receives the token, app identifier and a generic new-message alert, never message text, names, universities, route locations or Journal notes. Apple also processes network and delivery information. The sender rechecks live session, account restrictions, blocking, membership, route access and read status. Alerts already accepted by Apple cannot be recalled and delivery is not guaranteed. Events and delivery/retry status have a seven-day retention target; daily cleanup can lag by 24 hours. Inactive registrations expire after 90 days, and session/account deletion removes them. Disable push on the device in the app or revoke permission in iOS Settings. This does not authorize marketing.

Optional friend-request pushes also include an opaque event ID and Accept/Decline actions, never the sender's identity. Actions require unlocking, a signed-in account and current recipient/pending-request checks. Cancelled, replaced and already answered requests cannot be replayed. The app asks for permission once on its first supported distribution launch; declining does not prevent using the app. Administrators may waive one username-change cooldown with an audited reason, after which the usual 14-day interval resumes. A profile's public-route list does not expose private routes shared through friends-only posts.

External services

Supabase hosts authentication, storage and the database; Resend sends authentication email. Apple provides native maps and optional push delivery. Apple sign-in is not offered in the app. Opening a navigation provider or an optional translation website shares the selected information with that provider. Provider locations, retention, international-transfer safeguards, age policy and legal grounds require operator-specific review before launch.

Friends, likes & tags

Private routes are excluded from public discovery. Their creator may share one in a friends-only post, granting their current accepted friends access while that post remains visible. Removing all such posts or the friendship revokes access, not copies already made. Reviews inherit the route audience. Posts and photos are visible to accepted friends of the author, subject to route visibility and blocking. Like counts and optional tags of accepted friends are visible to that same audience; tags do not expand access. You can unlike a post or edit your post's tags. Reported post photos are private evidence available to authorized moderators for up to 90 days; access is logged, including when the original post was deleted. Public usernames can normally change once every 14 days. New direct conversations between non-friends require recipient acceptance before messages can be sent; existing conversations are preserved. A request carries no message text.

Activity & support

The existing post audience can see the names and small profile photos of up to three recent likers. The in-app Notifications inbox contains non-chat social activity, editorial updates, account notices and support replies, with read status. Opening a notification automatically marks that item read; it does not mark other items read. It does not expand access to blocked, removed or no-longer-visible content. Activity records expire after 90 days, with daily cleanup that can lag by 24 hours. This inbox is separate from optional Apple push and does not send marketing email.

Reach support shares a signed-in explorer's subject and conversation only with authorized Crawlist administrators. Requests and successive replies are kept as private conversation history; inspection and staff replies are logged. Wait for a staff response before sending another message. Open means your last message awaits staff; Answered means staff awaits your reply. Closed requests cannot receive further replies. Never send passwords, verification codes or unnecessary sensitive information. This is not an emergency service. Answered or closed requests and their conversation history expire 180 days after their last update through daily cleanup; unresolved requests remain while being handled. Account deletion removes your requests. A signed-in support tool is not a substitute for the external rights/appeals contact required for banned, signed-out and former users before public launch.

Journey previews & collections

An account-bound, device-only protected Keychain copy keeps the active journey's stop details and saved progress readable during connection failures. It expires after seven days and is cleared on sign-out, revoked-session handling or confirmed route removal. It contains no Journal notes. Map tiles and trip changes require a connection; this is not new authorization or guaranteed offline map access. Authorized administrators can view account usernames and login email addresses for moderation and support, not passwords or verification codes. Those addresses are not exposed in public profiles. Editorial banner collections do not change the home filters or expand access to private routes.

Draft updated 18 October 2026. Copyright/brand registration and encryption are different subjects. Neither a domain purchase nor an App Store name reservation establishes trademark clearance.