Privacy Policy

Who We Are

Phantom Trace is a paranormal investigation management app operated by DawnForge Labs, based in Muskegon, Michigan. Phantom Trace is the companion app to the West Michigan Mystery Machine website. Questions or data requests can be directed to jon@DawnForgeLabs.com.

Data We Collect

Phantom Trace collects only the data necessary to operate the investigation management features of the app. We do not collect data for advertising, profiling, or sale to third parties.

Account Information

• Email address — required to create and log in to your investigator account.
• Password — stored as a hashed credential by Supabase Auth. We never see your plaintext password.
• Name (optional) — if you sign in with Google, we receive your display name from Google.
• Session token — stored in a secure first-party cookie (wmm_u) to keep you signed in across pages.

Investigation Evidence

• Photos captured during active investigations — stored in your private evidence archive.
• Short video clips captured during active investigations — stored in your private evidence archive.
• Sensor readings (magnetometer / EMF, accelerometer, barometer, compass) logged during sessions.

Location Data

• Precise GPS coordinates (latitude, longitude, altitude, accuracy) — collected during active investigation sessions when you grant location permission. Used solely to geo-tag evidence captures and sensor readings to your case file. Location data is never collected in the background or when the app is not in use.

Device Sensors

• Magnetometer (compass / EMF readings) — read in real time during investigations.
• Accelerometer / motion sensor — read in real time during investigations.
• Barometric pressure sensor — read in real time during investigations, where supported.

Camera and Microphone

• Camera — used to capture investigation photos and video clips within the app. We do not access your camera roll or existing photos unless you explicitly choose to import them from your gallery.
• Microphone — requested as a system-level requirement for video recording on Android. The app does not record audio independently of video, and does not transmit audio without user action.

Payments

• All payments for Pro subscriptions and Spectral Token bundles are processed by Stripe. Stripe receives your card details directly through their secure checkout — we never see, transmit, or store your full card number. We retain only a Stripe customer ID and your subscription status (active / canceled / past due).

What We Do NOT Collect

• No analytics, usage tracking, or behavioral data.
• No device identifiers, advertising IDs, or fingerprinting.
• No contacts, calendar, or SMS data.
• No data from other apps on your device.

How We Use Your Data

All collected data is used exclusively to operate Phantom Trace and the West Michigan Mystery Machine website:

• Your email is used for authentication, account recovery, and (if you opt in) closed alpha tester onboarding.
• Evidence files (photos, videos) are stored in your private, access-controlled archive linked to your account.
• Sensor readings and GPS coordinates are stored with your case files for investigation record-keeping.
• Payment information is handled entirely by Stripe — we never see or store your card number.
• Standard server logs (IP address, user agent, timestamp) are retained by Cloudflare for security and abuse prevention.
• No data is used to train AI models, build advertising profiles, or sold to any third party.

Data Storage and Security

• All data is stored in Supabase (PostgreSQL), hosted in the United States.
• All data in transit is encrypted via HTTPS / TLS. Supabase does not support unencrypted connections.
• Evidence files are stored in a private storage bucket. Signed URLs with a 1-hour expiry are used to display evidence within the app — files are never publicly accessible.
• Row-Level Security (RLS) policies enforce that each user can only access their own data.
• Evidence retention: Evidence and case data are retained for 2 years from the date a case is closed. After that period, data is eligible for deletion. Active cases are retained until you delete them.

Data Sharing

We do not sell, rent, or share your personal data with third parties, advertisers, or data brokers.

The third-party services we use are:

• Supabase — database, authentication, and file storage provider. Supabase processes data only as a data processor on our behalf and does not use your data for its own purposes. See supabase.com/privacy.
• Stripe — payment processor for Pro subscriptions and Spectral Token bundles. When you make a payment, your card details are sent directly to Stripe and are never stored on our servers. We receive only a customer ID and subscription status. See stripe.com/privacy.
• Google (Sign-In + Google Play) — used for optional Google account sign-in and for distributing the Phantom Trace Android app via Google Play. When you sign in with Google, we receive your name and email address only. See policies.google.com/privacy.
• Cloudflare — hosts the West Michigan Mystery Machine website and serves as our CDN and DNS provider. Cloudflare may log standard request metadata (IP address, user agent, timestamp) for security and abuse prevention. See cloudflare.com/privacypolicy.
• AI analysis (operated by DawnForge Labs) — optional AI features (sensor-reading analysis, investigation reports, location intelligence, and photo evidence analysis) send data to an AI server operated by DawnForge Labs. The app asks for your explicit consent in-app before any data is sent. Depending on the feature, the data sent includes: the sensor readings you logged (EMF/magnetometer, motion, pressure), the case title and location name, photos you choose to analyze, and notes or report details you enter. This data is transmitted over HTTPS, used only to generate the analysis you requested, is not retained after the response is returned, and is not used to train AI models, for advertising, or sold. DawnForge Labs operates this service under the same data-protection commitments described in this policy. No third-party AI provider (OpenAI, Anthropic, Google, etc.) receives your data.

Your Rights

• Delete your account and data: You can permanently delete your account and all associated data (case files, evidence, sensor logs, and notes) at any time from within the app: open Account → Delete Account and confirm. Deletion is immediate and cannot be undone. You may also email jon@DawnForgeLabs.com and we will complete the request within 30 days.
• Export your data: You can request a copy of your data in CSV or JSON format by contacting us at the same address.
• Correct your data: You can update your email and password from within the app. Case data can be edited or deleted at any time from within the app.

Children

Phantom Trace is intended for users aged 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us at jon@DawnForgeLabs.com and we will delete the account promptly.

Advertising

Phantom Trace contains no advertising. We do not use advertising SDKs, ad networks, or interest-based targeting of any kind.

Changes to This Policy

If we make material changes to this policy, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via the email associated with your account.

Contact

For any privacy questions, data requests, or account deletion requests, contact:

DawnForge Labs
Muskegon, Michigan
jon@DawnForgeLabs.com