Privacy Policy

1. Information We Collect

This website and the Aventerra application are operated by Aventerra Technologies Inc., a corporation based in Drummondville, Quebec ("Aventerra", "we", "us").

When you join our early access waitlist, we collect your email address, primary backcountry activity, and region. We use this information solely to notify you when Aventerra launches in your area.

When you use the Aventerra app, we collect the information needed to run your account and the features you use: your email address, display name, username and profile photo; a phone number if you choose to add one; your location when you share it with others, record an activity or use location features; the content you create (tracks, routes, saved places, posts, photos, reports and messages); and technical information such as device type, app version and push notification tokens. Location data is processed on-device whenever possible. We collect only the minimum information needed to provide the service you have asked for.

2. How We Use Your Information

We use the information we collect to:

• Send you your early access notification (waitlist only)
• Provide and improve the Aventerra app and services
• Ensure the safety features of the app function correctly
• Diagnose crashes and errors (see section 3)
• Understand how the app is used, only if you opt in to usage analytics (see section 3)

We do not sell your personal information to third parties. We do not use your personal information for purposes incompatible with those listed above without your consent.

3. Analytics and Crash Reports

This website counts visits with PostHog in cookieless mode: nothing is stored in your browser, no cookies, and visits are counted with a hash computed on PostHog's servers that changes every day, so you cannot be recognised from one day to the next or across websites. No cookie-consent banner is required.

Usage analytics in the app (PostHog) is off by default. We ask you during onboarding, and nothing is collected unless you turn it on. If you opt in, we record which screens and features are used so we can improve the app. You can turn it off at any time in the app's Settings, and collection stops immediately.

Crash reports (Sentry) are on by default because they are how we find and fix bugs that could affect your safety in the field. A crash report contains technical details about the error, your device and the app version. It does not contain your email address, your location or screenshots of your screen. You can turn crash reports off at any time in the app's Settings.

4. Location Sharing

Location sharing is off until you turn it on. When you set up the app, you choose who can see where you are. We recommend friends only, so that only people you have accepted as friends can see you. You can change this setting or turn sharing off at any time in the app.

Your live location is visible only to the people you share it with. If it stops updating, for example when you lose signal, your last known position stays visible to them for up to 72 hours after the last update so they can help find you if you go missing, and is then deleted. Turning off sharing erases your position from our servers immediately. Location shared in a group conversation stops at the end time you choose. Activities you record are kept in your account until you delete them.

5. Finding Friends From Your Contacts

Finding friends from your contacts is optional and only runs when you start it and grant access to your contacts. The app reads the phone numbers in your address book (not names, emails or other fields) and sends them to our server over an encrypted connection. The server converts each number into a salted hash, compares it with the hashed numbers of Aventerra users who have added a phone number to their profile, and returns only the matching accounts. The phone numbers from your address book are not stored and are not shared with other users.

If you add your own phone number to your profile, it is stored with a salted hash so that friends who have your number can find you. The number itself is visible only to you and to your accepted friends. You can remove it at any time in Settings.

6. Data Storage, Retention, and Cross-Border Transfers

Waitlist information is stored securely using Supabase. We retain waitlist information until we send you the launch notification, plus 90 days, after which the entry is deleted unless you have separately subscribed to ongoing communications. You can request deletion of your waitlist entry at any time by writing to [email protected].

App data is stored by Supabase in Canada, in Montréal, Quebec (AWS region ca-central-1). Some of the service providers listed in section 11 process information in the United States or elsewhere, so some of your information is transferred outside Quebec and Canada. Before communicating personal information outside Quebec, we assess whether it will receive adequate protection, taking into account its sensitivity, the purpose for which it is used, the safeguards in place and the legal framework of the destination. Our safeguards include written agreements with our providers that limit their use of your information to the services they provide to us, encryption in transit and at rest, and access restricted to what each provider needs. Information held outside Canada may be accessible to the courts and authorities of the country where it is held.

We keep information only as long as we need it:

• Friend locations: your last known position is deleted 72 hours after its last update, or immediately when you turn off sharing
• Your account: when you delete your account in the app, your profile and the data linked to it (tracks, saved places, posts, photos, messages and media) are deleted from our database and storage. Residual copies in our providers' backups are removed on their regular backup cycle
• Content removed by moderation: purged 90 days after removal. A record of the moderation decision (what was decided, by whom and when) is kept as an audit trail, and the snapshot of the removed content attached to it is deleted after one year
• In-app notifications: deleted after 90 days
• Crash reports and, if you opted in, usage analytics: kept for a limited period under the retention settings of our providers, then deleted
• Consent records: each consent you give or withdraw in the app is kept as long as your account exists, and deleted with it

If Aventerra does not launch, is wound down, or is acquired by another entity, we will either delete waitlist information or notify you in advance so you can choose to delete your entry or have it transferred to the successor entity.

7. Safeguards

We use reasonable physical, administrative, and technical measures to protect your personal information against loss, theft, and unauthorized access, use, or disclosure. These include encryption of data in transit (HTTPS/TLS), encryption at rest by our database provider, row-level access rules so each account can only read the data it is allowed to see, restricted access to personal information on a need-to-know basis, and periodic review of our service providers' security practices.

No method of transmission or storage is perfectly secure. While we work to protect your information, we cannot guarantee absolute security.

8. Data Breach Notification

In accordance with Law 25, if a confidentiality incident involving your personal information occurs and presents a risk of serious injury, we will notify you and the Commission d'accès à l'information du Québec (CAI) without delay, take reasonable measures to reduce the risk, and keep a register of confidentiality incidents as required by law.

9. Your Rights

If you are a Quebec resident, the Act respecting the protection of personal information in the private sector ("Law 25") gives you the following rights with respect to your personal information:

• Right of access: request a copy of the personal information we hold about you
• Right of rectification: request correction of inaccurate or incomplete information
• Right to deletion: request that we delete your personal information
• Right to data portability: request your personal information in a structured, commonly used technical format
• Right to withdraw consent: withdraw your consent to our collection or use of your information at any time
• Right to lodge a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca)

We record each consent you give or withdraw in the app (the Terms of Service and this Privacy Policy, usage analytics, crash reports, the community guidelines and the backcountry safety notice) with its date, the version of the document where one applies, and where in the app it happened. Withdrawing a consent adds a new record rather than erasing the earlier one, so the history shows what you agreed to and when. These records are part of your account and are included when you request access to your information. To exercise any of these rights, contact our Privacy Officer at [email protected]. You can also delete your account yourself at any time in the app's Settings. We do not use your personal information to make decisions based exclusively on automated processing.

10. Privacy Officer

In accordance with Law 25, the person responsible for the protection of personal information at Aventerra is our Privacy Officer, Simon Villiard. You can reach the Privacy Officer at [email protected] for any question, request, or complaint regarding your personal information.

11. Service Providers

We use the following service providers to operate the website and the app. Each processes information only to provide its service to us and is governed by its own privacy policy:

• Supabase (Canada, AWS ca-central-1 in Montréal): database, authentication and file storage
• Cloudflare (global network): website hosting, map and data delivery, and video storage
• Sentry (United States): crash reports
• PostHog (United States): usage analytics, only if you opt in
• PostHog (United States): cookieless visit counts for this website, with no profile and no cookies
• Resend (United States): account and transactional emails
• Firebase and Google (United States): push notifications and Sign in with Google
• RevenueCat (United States): in-app purchases and subscription status
• Mapbox (United States): map display and place search
• Anthropic (United States): AI route assistant, currently disabled. If it is enabled, the messages you type to the assistant and the route context are sent to Anthropic to generate a reply
• Giphy (United States): GIF search in conversations. Searches go through our servers; the GIFs themselves load from Giphy's servers
• Open-Meteo (Europe): weather forecasts, requested through our servers for map coordinates without your identity

12. Minimum Age

You must be at least 16 years old to use the Aventerra app, and you confirm your age the first time you sign in. Aventerra is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe someone under 16 has provided us with personal information, please contact us at [email protected] and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any changes on this page with an updated revision date. For material changes, we will notify early access subscribers by email and ask app users to review the updated policy in the app.

14. Contact

Questions about this Privacy Policy? Contact our Privacy Officer at [email protected]. For anything else, write to [email protected].