Privacy Policy

DriftLine Co. LLC, doing business as Baseline Maps ("Baseline Maps," "Company," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use the Baseline Maps mobile application (formerly DriftLine) and web application (collectively, the "App"). By accessing or using the App, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy and our Terms of Use.

IF YOU DO NOT AGREE WITH THE TERMS OF THIS PRIVACY POLICY, PLEASE DO NOT ACCESS OR USE THE APP.

1. Information We Collect

1.1 Categories of Personal Information Collected

The following table describes the categories of personal information we may collect, as defined under various U.S. state privacy laws:

Category	Examples	Collected
Identifiers	Email address, device identifiers, IP address	Yes
Customer Records	Name, address, phone number, payment info	No
Protected Classifications	Race, religion, sexual orientation, disability	No
Commercial Information	Subscription status, purchase history	Yes (subscription status only)
Biometric Information	Fingerprints, face recognition, voiceprints	No
Internet/Network Activity	Browsing history, App interactions, logs	Limited
Geolocation Data	Precise GPS location (with consent)	Yes*
Sensory Data	Audio, visual, thermal, olfactory	Photos only** (no audio stored)
Professional/Employment	Job title, employer, work history	No
Education Information	School records, grades	No
Inferences	Profiles reflecting preferences, behavior	No
Sensitive Personal Information	SSN, financial accounts, precise geolocation, health data, racial/ethnic origin	Geolocation only*

* Precise geolocation is collected only with your explicit consent. Location is accessed in the foreground for map display. If you enable Track Recording or join a Fireteam, location is also collected in the background (with the screen locked) to record your trail or to share your live position with your teammates — see Section 1.4 for details. Track data is stored on your device and synced to your account.
** Photos are collected only if you voluntarily upload them to the catch log, hunting journal, waypoint, or alert reporting features.

1.2 Information You Provide Directly

• Email Address: If you join our waitlist or create an account, we collect your email address for authentication and communication purposes.
• Catch Log Data: If you use our catch logging feature, we collect information you voluntarily provide including fish species, location codes, dates, and any photos you upload.
• Hunting Journal Data: If you use our hunting journal feature, we collect information you voluntarily provide including harvest records, species, location data, dates, and any photos you upload.
• Trip Notes: If you use the trip notes feature, we collect text notes and timestamps you voluntarily provide.
• Waypoints: If you save waypoints, we collect the GPS coordinates, names, descriptions, and any photos you attach.
• Track Recording Data: If you use the track recording feature, we collect GPS trail points recorded during your session, including coordinates, altitude, and timestamps. See Section 1.4 for details on foreground and background location collection.
• Fireteam (Live Position Sharing): If you create or join a Fireteam, we collect your display name and your live position (coordinates, accuracy, heading, speed, and device battery level) for as long as the team is active — including in the background — and share it with the other members of that team. Only your latest position is kept on our servers; we do not keep a trail. Position data is deleted automatically when the team ends or goes idle (see Section 6.3). Leave the team at any time to stop sharing.
• Swipe Feed: If you submit a photo to the Swipe feed, we collect the photo, an optional caption and category, and any social media handles you add to your Swipe profile, and show them to other App users in a public feed. Other users' votes on your photo are counted toward public weekly leaderboards.
• Float Trips: If you use the Float Planner, when a float ends we save a trip record to your Fishing Journal: the river section (put-in, take-out, river miles, and route geometry), how long it took, how many spots were fished, the water and weather conditions during the float, and any photos you attach.
• Forum Posts: If you participate in the community forum, we collect your display name, the text content of your posts, and any images you attach (up to 5 per post). Forum posts and display names are visible to other App users. Images attached to forum posts are automatically deleted from our storage 365 days after they are uploaded, even if the post itself remains.
• Voice Input: If you use the voice dictation feature, audio is processed by the speech recognition service built into your device (Apple Speech on iOS, Google speech services on Android) to convert speech to text. Depending on your device and settings, that service may send audio to Apple's or Google's servers for recognition under their own privacy policies. We receive only the resulting text and never store audio recordings.
• Subscription Information: If you subscribe to Baseline Pro, we receive your subscription status, entitlement information, and transaction identifiers from RevenueCat (our subscription management provider). We do not receive or store your payment card details — all payment processing is handled by Apple or Google.
• Display Name: If you set a display name (typically a first name), it is used to identify your forum posts and community contributions. This is not required to be your legal name.
• Guide Directory Information: If you are a fishing or hunting guide and claim a profile, we collect information you voluntarily provide including your business name, guide license number, license state, contact information (phone, email, website), social media handles, specialties, regions served, bio, certifications, and photos.
• Community Photos: If you submit photos of water access points or other community-contributed content, we collect the images and associated metadata.
• Photo Moderation: Photos you upload (catch logs, hunting journal, waypoints, forum posts, community photos) are automatically screened using AWS Rekognition, an automated content moderation service, to detect content that violates our Community Guidelines (such as explicit, violent, or otherwise inappropriate content). This is automated processing — no human reviews your photos unless they are flagged by the moderation system. If a photo is flagged, it may be removed or held for manual review. You may contact us at info@getdriftline.com to appeal a moderation decision.
• AI-Powered Features: If you use the AI-powered fishing or hunting intelligence features, we collect the queries, species selections, and contextual data you provide (including your location if enabled) to generate AI-powered reports. Your queries are transmitted to our servers and processed using AI models hosted on Amazon Bedrock. See Section 2.2 for details.
• User Preferences: Settings, favorites, and preferences you configure within the App.
• Communications: Any information you provide when you contact us for support or feedback.

1.3 Information Collected Automatically

• Device Information: Device type, operating system version, unique device identifiers, and platform information (iOS/Android) to ensure proper App functionality.
• Push Notification Tokens: If you enable push notifications, we store a device-specific token to deliver river flow alerts. This token does not by itself identify you, but we treat it as personal information. It is kept until you disable notifications, sign out, or delete your account.
• Product Analytics (PostHog): We use PostHog to understand how the App is used. When you are signed in, PostHog receives your account ID and email address, your subscription tier, the screens you view, and product events such as viewing a river, logging a catch, or saving a scouting spot, together with device information and an approximate location derived from your IP address. PostHog processes this data on our behalf in the United States and does not use it for advertising. This data is identified, not anonymous; see Sections 5 and 6.3.
• Place Names (Geocoding): When the App shows a place name for a location — for example, to confirm your state or province during onboarding or to label a weather forecast location — it sends the coordinates to the geocoding service built into your device (Apple Maps on iOS, Google on Android). Those services process the request under their own privacy policies; we do not send your account information with it.
• Log Data: Our servers may automatically record information including your IP address, access times, and App crashes for debugging and security purposes.
• Web Properties: When you visit our website (including this Privacy Policy and Terms of Use pages), we use analytics that are not linked to your App account. On baselinemaps.io we use PostHog in cookieless mode (memory-only, no persistent identifier) to collect page views and store-link clicks, and no cookies are set. Our legacy website, getdriftline.com, uses AWS CloudWatch Real User Monitoring (RUM) to collect performance and error telemetry and may set a session cookie. Standard HTTP request data (IP address, browser type, page requested) is processed to serve the page.

1.4 Precise Geolocation Information

• Foreground Location: With your explicit opt-in consent, we access your device's GPS location to display your position on the map and show nearby rivers and features. Foreground location data is used in real time and is not stored on our servers.
• Background Location (Track Recording and Fireteam): If you enable the Track Recording feature, the App collects your GPS location in the background — including when the screen is locked or the App is not in the foreground — to record your trail so you can retrace your route. If you join a Fireteam, the App also sends your position to our servers in the background so your teammates can see where you are (see Section 1.2). On Android, a persistent notification is displayed while background location is active. Background location is collected only while a track recording session or Fireteam session is active and stops when you end the recording or leave the team.
• Track Data Storage: GPS trail points from track recording sessions (coordinates, altitude, timestamps) are stored on your device and synced to your account on our servers. You can delete individual tracks at any time, and all track data is deleted when you delete your account.
• Who Receives Your Location: Your coordinates are sent only to the service providers needed to answer your request: Mapbox (map tiles, directions, and terrain queries), Stormglass (marine weather and tides, via our servers), Amazon Bedrock (AI intelligence reports, via our servers — see Section 2.2), the Apple or Google geocoding service built into your device (place names), and Sentry (a crash report may include the coordinates in the address of a request the App was making). If you join a Fireteam, your live position is also shared with the members of that team. We do not sell location data or share it with advertisers.
• Your Control: You may revoke location permissions at any time through your device settings. You can stop any active track recording at any time. The App will continue to function without location access, though map positioning and track recording features will be unavailable.

1.5 Sensitive Personal Information

Under various state privacy laws, precise geolocation is considered "sensitive personal information." We collect precise geolocation only with your explicit opt-in consent and use it solely to provide location-based features within the App. We do not use sensitive personal information for profiling, advertising, or any purpose beyond providing the core App functionality you requested.

1.6 Information We Do NOT Collect

• Full legal names or government-issued personal identifiers beyond email address (we may collect an optional display name you choose)
• Phone numbers
• Physical addresses or payment information
• Social Security numbers or government-issued IDs
• Financial account information
• Health or medical information
• Biometric data (fingerprints, facial recognition)
• Racial or ethnic origin, religious beliefs, or political opinions
• Sexual orientation or gender identity
• Browsing history outside the App
• Data from minors under 13 (14 in Quebec, or 16 in certain jurisdictions)

1.7 Sources of Personal Information

We collect personal information from the following sources:

• Directly from you: When you create an account, submit catch logs, hunting journals, trip notes, waypoints, forum posts, or contact us
• Automatically from your device: When you use the App (device info, usage data, crash logs)
• With your consent: Location data when you grant permission

We do NOT purchase personal information from data brokers or collect information from third-party sources about you.

2. How We Use Your Information

2.1 Business Purposes

We use the information we collect for the following business purposes:

• Service Delivery: To provide, maintain, and improve the App's features and functionality
• Notifications: To send push notifications about river flow conditions, weather conditions, and hunting-related alerts you've configured
• Communications: To respond to your inquiries, provide customer support, and send service-related announcements
• Product Updates: To send periodic updates about new features, improvements, and company news (you may unsubscribe at any time)
• Analytics: To analyze how the App is used and improve the user experience (using PostHog product analytics as described in Section 1.3, and aggregated reporting)
• Security: To detect, prevent, and address technical issues, fraud, or security threats
• Debugging: To identify and repair errors that impair App functionality
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

2.2 AI-Powered Features

When you use the App's AI-powered fishing or hunting intelligence features, the following data may be transmitted to our servers for processing by AI systems:

• Your location (if location access is enabled)
• The species, location, and activity type you select
• Custom questions or prompts you enter
• Environmental context (weather conditions, water data, regulation information relevant to your query)

This data is processed on our backend servers using Amazon Bedrock, an Amazon Web Services (AWS) service that hosts third-party AI models. Our AI features use models from Anthropic (Claude) and Amazon (Nova), hosted by AWS in United States regions — primarily us-east-1 (Northern Virginia), with some features processed in us-west-2 (Oregon). We do not send your email address or account ID to the AI models. Your location, selections, and question are sent as context without your name, email, or account ID; a free-text question could still identify you if you include personal details in it, so please do not. AWS does not use Bedrock inputs or outputs to train models, and we do not use your queries or responses for training. AI-generated responses may be cached on our servers for up to 24 hours to improve performance. We also keep a request log — your account ID, the coordinates and options in the request, and the time — for up to 12 months for abuse prevention, rate limiting, and cost control. AI reports are generated automatically and may contain errors; they are not decisions about you.

2.3 We Do NOT Use Your Information For:

• Selling your personal information to third parties
• Sharing your personal information for cross-context behavioral advertising
• Targeted advertising or ad personalization
• Building consumer profiles for marketing purposes
• Automated decision-making that produces legal or similarly significant effects
• Profiling in furtherance of decisions that produce legal or similarly significant effects

3. Legal Basis for Processing

3.1 For All Users

We process your personal information based on the following legal grounds:

• Contractual Necessity: Processing necessary to provide the App services you requested
• Consent: Where you have given explicit, informed consent (e.g., push notifications, location access, email communications)
• Legitimate Interests: Processing necessary for our legitimate business interests (e.g., improving the App, ensuring security, preventing fraud), balanced against your rights and interests
• Legal Obligation: Processing necessary to comply with applicable laws and regulations

3.2 Withdrawing Consent

Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal. To withdraw consent:

• Push Notifications: Disable in device settings or App settings
• Location Access: Revoke in device settings
• Email Communications: Click "unsubscribe" in any email or contact us
• Account/Data: Contact info@getdriftline.com to request deletion

4. Data Sharing and Disclosure

4.1 We Do Not Sell Your Personal Information

Baseline Maps does NOT sell your personal information. We have not sold personal information in the preceding 12 months and do not have plans to sell personal information in the future.

4.2 We Do Not Share for Targeted Advertising

Baseline Maps does NOT share your personal information for cross-context behavioral advertising or targeted advertising purposes.

4.3 Limited Disclosure for Business Purposes

We may disclose your information only in the following limited circumstances:

Recipient Category	Purpose	Categories of PI Disclosed
Cloud Service Providers (AWS)	Data hosting and storage	Identifiers, user content, usage data
Push Notification Services (Expo)	Delivering push notifications and App update checks	Device tokens; device metadata and IP address for update checks
Product Analytics (PostHog)	Understanding how the App is used	Account ID, email address, subscription tier, in-app events, device info, IP-derived approximate location
AI Model Hosting (Amazon Bedrock — Anthropic and Amazon models)	Generating AI fishing, hunting, foraging, and scouting reports	Location, selections, and questions submitted to AI features (no account identifiers)
Device Platform Services (Apple / Google geocoding and speech recognition)	Place names for coordinates; voice dictation	Coordinates for geocoding; audio for speech-to-text
Other App Users (Fireteam, forum, Swipe feed)	Features you choose to share in	Display name; live position (Fireteam members only); content you post
Map Services (Mapbox)	Map display functionality	Anonymous usage metrics
Subscription Management (RevenueCat)	Managing subscriptions, entitlements, and purchase verification	Anonymous user ID, subscription status, transaction IDs
Payment Processing (Apple/Google)	Processing subscription payments	None directly from us — managed by your app store account
Legal/Government Authorities	Legal compliance, law enforcement	As required by law
Professional Advisors	Legal, accounting, audit services	As necessary for services
Business Transferees	Merger, acquisition, or sale	All categories (with notice)

4.4 Service Provider Requirements

All service providers who receive personal information are contractually required to:

• Use personal information only for the specified business purpose
• Not sell or share the personal information
• Not use the information for their own purposes
• Implement appropriate security measures
• Notify us of any data breaches
• Delete or return personal information upon request
• Allow audits of their data handling practices

4.5 Legal Disclosures

We may disclose personal information if required or permitted by law, including:

• In response to a subpoena, court order, or other legal process
• To comply with applicable laws and regulations
• To protect our rights, property, or safety, or that of our users or the public
• To investigate potential violations of our Terms of Use
• To cooperate with law enforcement investigations

5. Third-Party Services

The App integrates with the following third-party services. Each operates under its own privacy policy, which we encourage you to review:

Service	Purpose	Data Shared	Privacy Policy
Amazon Web Services (AWS)	Cloud hosting and storage	Account data, catch logs (encrypted)	AWS Privacy
Mapbox	Map display and navigation	Anonymous telemetry per their policy	Mapbox Privacy
Expo	Push notification delivery and App update checks (EAS Update)	Device push tokens; device metadata and IP address during update checks	Expo Privacy
RevenueCat	Subscription management and entitlement verification	Anonymous user ID, subscription status, purchase transactions	RevenueCat Privacy
Apple App Store / Google Play Store	Payment processing for subscriptions	No personal data shared by us — payments handled by your platform account	Apple / Google
Apple Sign-In	Authentication (optional sign-in method)	Apple identity token exchanged for app authentication	Apple Privacy
Google Sign-In	Authentication (optional sign-in method)	Google identity token exchanged for app authentication	Google Privacy
PostHog	Product analytics (App and website)	App: account ID, email, subscription tier, screen views and product events, device info, IP-derived location. Website (baselinemaps.io): cookieless page views only	PostHog Privacy
Amazon Bedrock (AWS)	Hosting the Anthropic (Claude) and Amazon (Nova) AI models behind our intelligence features, in us-east-1 and us-west-2	Location, selections, and questions you submit to AI features; no account identifiers. Not used for model training	AWS Privacy
Apple / Google device services	Geocoding (place names) and speech recognition (voice dictation) built into your device	Coordinates for geocoding; audio for speech-to-text, which may be processed on their servers	Apple / Google
Sentry	Crash reporting and performance monitoring	Anonymous user ID, app version, device info, crash stack traces, navigation breadcrumbs (no email, passwords, or tokens)	Sentry Privacy
USGS Water Services	River flow data	No personal data shared	Government public data
Water Survey of Canada	Canadian river flow data	No personal data shared	Government public data
NOAA NWRFC	Forecast data	No personal data shared	Government public data
Stormglass.io	Marine weather, tides, astronomy	Anonymous location coordinates for weather lookup	Stormglass Privacy
WDFW / Data.WA	Fishing regulations, fish stocking data	No personal data shared	Government public data
USDA NAIP (via Mapbox)	Aerial imagery	No personal data shared	Government public data

We are not responsible for the privacy practices of third-party services. When you interact with these services, their privacy policies govern.

6. Data Storage, Security, and Retention

6.1 Data Storage Location

Your data is stored securely using Amazon Web Services (AWS) infrastructure located in the United States. Your account data and content are stored in the us-west-2 (Oregon) region. AI intelligence requests are processed by Amazon Bedrock in us-east-1 (Northern Virginia) and us-west-2 (see Section 2.2). By using the App, you acknowledge that your information is transferred to and stored in the United States. Canadian residents: see Section 10.5 for the notice about access by U.S. authorities.

6.2 Security Measures

We implement industry-standard technical, administrative, and physical security measures including:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Encryption at Rest: Stored data is encrypted using AES-256 encryption
• Access Controls: Strict role-based access controls limiting employee access to personal data
• Authentication: Secure authentication mechanisms for all system access
• Monitoring: Continuous monitoring for security threats and unauthorized access
• Regular Assessments: Periodic security assessments and penetration testing
• Incident Response: Documented incident response procedures

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data. You acknowledge and accept this inherent risk when using the App.

6.3 Data Retention Schedule

Data Type	Retention Period	Deletion Trigger
Push Notification Tokens	Until you disable notifications, sign out, or delete your account	User action or account deletion
Account Data (email address)	Until you delete your account (we do not currently delete accounts for inactivity)	In-app deletion or email request
Catch Log Data	Until deleted by user or account deletion	User-initiated deletion
Catch Log Photos	Until deleted by user or account deletion	User-initiated deletion
Hunting Journal Data	Until deleted by user or account deletion	User-initiated deletion
Hunting Journal Photos	Until deleted by user or account deletion	User-initiated deletion
Trip Notes	Until deleted by user or account deletion	User-initiated deletion
Hunt Notes	Until deleted by user or account deletion	User-initiated deletion
Waypoints	Until deleted by user or account deletion	User-initiated deletion
Track Recording Data	Until deleted by user or account deletion	User-initiated deletion
Forum Posts	Until deleted by user or account deletion	User-initiated deletion
Forum Post Images	365 days after upload, or earlier if you delete the post or your account	Automatic expiration or user-initiated deletion
Fireteam Position Data	Latest position only, while the team is active; deleted automatically 7 days after a timed team ends, or after 30 days without activity for an open-ended team	Automatic expiration or leaving the team
Swipe Feed Photos and Captions	Until removed by you or by moderation	User-initiated removal or moderation
Float Trips	Until deleted by you	User-initiated deletion
Guide Directory Profile Data	Until deleted by guide or account deletion	User-initiated deletion or claim withdrawal
AI Intelligence Queries & Responses	Cached responses up to 24 hours; request logs (account ID, coordinates, options, time) up to 12 months	Automatic expiration
Community-Submitted Photos	Until removed by moderation or account deletion	Moderation review or account deletion
App Preferences/Settings	Until account deletion	Account deletion
Server Logs (IP, access)	90 days	Automatic rotation
Crash Reports	12 months	Automatic deletion
Product Analytics (PostHog)	Identified event data until you ask us to delete it; aggregated statistics that no longer identify you are kept indefinitely	Request to our Privacy Officer (Section 16)

Upon account deletion, we will delete or anonymize your personal information within 45 days, except as required to comply with legal obligations, resolve disputes, or enforce our agreements.

7. Your Rights and Choices - All Users

Regardless of your location, all Baseline Maps users have the following rights:

• Access: Request information about what personal data we have collected about you
• Deletion: Request deletion of your personal information
• Correction: Request correction of inaccurate personal information
• Data Portability: Request a copy of your data in a portable format
• Opt-Out of Communications: Unsubscribe from marketing emails at any time
• Push Notifications: Disable at any time via device settings or within the App
• Location Access: Revoke permissions in your device settings at any time

To exercise any of these rights, contact us at info@getdriftline.com.

7.1 How to Delete Your Account

Option 1: Delete In-App (Recommended)

1. Open the Baseline Maps app
2. Go to More → Settings
3. Scroll down and tap Delete Account
4. Confirm your decision

Your login and the data listed below are permanently deleted immediately. A small number of records that are not yet covered by our automated deletion (see "What Gets Deleted") are removed by us within 45 days of your request.

Option 2: Request Deletion via Email

If you cannot access the app, you may request account deletion by emailing:

info@getdriftline.com

Please include the email address associated with your account. We will process your request within 3 days and confirm deletion.

What Gets Deleted

• Your account credentials and profile
• All catch log entries and associated photos
• All hunting journal entries and associated photos
• All trip notes and hunt notes
• All track recording data and track photos
• All forum posts and community-submitted photos
• Float trips, routes, drawings, and RidgeLine hunt items
• Swipe feed photos, captions, and votes, and game scores
• Fireteam memberships and positions
• Subscription entitlement record (this does not cancel your app store subscription — see below)
• Guide directory profile data you entered when claiming a listing (if applicable)
• Saved waypoints and preferences
• Alert configurations
• AI intelligence request logs (expire automatically within 12 months of the request)
• Any other data associated with your account

Float trips, routes, RidgeLine items, Swipe feed content, game scores, the entitlement record, track photos, and guide profile data are currently removed by us within 45 days of your request rather than instantly; we are extending automated deletion to cover them. We also ask RevenueCat and PostHog to delete their records for your account ID. Crash reports in Sentry are not deleted individually and expire under Sentry's retention period. If you redeemed a promotional code, a hashed record of the redemption is kept to prevent reuse.

Note: Deletion is permanent and cannot be undone. Aggregated analytics data that can no longer be linked to you may be retained. Backup copies are purged within 45 days.

Important — Active Subscriptions: Deleting your account does not automatically cancel your app store subscription. If you have an active Baseline Pro subscription, you must separately cancel it through your device's account settings (Apple ID settings on iOS, Google Play subscriptions on Android) to stop future charges. Baseline Maps is not responsible for charges incurred after account deletion if you have not independently cancelled your subscription with the applicable app store.

8. U.S. State Privacy Rights

This section provides additional disclosures required under various U.S. state privacy laws. If you are a resident of any of the following states, you may have additional rights as described below.

8.21 Summary of State Privacy Rights

State	Law	Effective Date	Appeal Right	GPC Required
California	CCPA/CPRA	Jan 2020/2023	No	Yes
Virginia	VCDPA	Jan 1, 2023	Yes (60 days)	No
Colorado	CPA	Jul 1, 2023	Yes (45 days)	Yes
Connecticut	CTDPA	Jul 1, 2023	Yes (60 days)	Yes
Utah	UCPA	Dec 31, 2023	No	No
Texas	TDPSA	Jul 1, 2024	Yes (60 days)	Yes (2025)
Oregon	OCPA	Jul 1, 2024	Yes (45 days)	Yes
Montana	MCDPA	Oct 1, 2024	Yes (60 days)	Yes
Delaware	DPDPA	Jan 1, 2025	Yes (60 days)	Yes (2026)
Iowa	ICDPA	Jan 1, 2025	No	No
Nebraska	NDPA	Jan 1, 2025	Yes (60 days)	Yes
New Hampshire	NHPA	Jan 1, 2025	Yes (60 days)	Yes (2027)
New Jersey	NJDPA	Jan 15, 2025	Yes (45 days)	Yes (Jul 2025)
Tennessee	TIPA	Jul 1, 2025	Yes (60 days)	No
Minnesota	MCDPA	Jul 31, 2025	Yes (45 days)	Yes (2026)
Maryland	MODPA	Oct 1, 2025	Yes (60 days)	Yes (2027)
Indiana	ICDPA	Jan 1, 2026	Yes (60 days)	No
Kentucky	KCDPA	Jan 1, 2026	Yes (60 days)	No
Rhode Island	RIDPA	Jan 1, 2026	Yes (60 days)	Yes (2027)

9. International Privacy Rights (GDPR)

9.1 European Economic Area, United Kingdom, and Switzerland

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and equivalent laws:

• Right of Access (Article 15): Request confirmation of whether we process your personal data and receive a copy
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete personal data
• Right to Erasure (Article 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing (Article 18): Request limitation of how we process your data
• Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format and transmit it to another controller
• Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing
• Right Not to be Subject to Automated Decision-Making (Article 22): Not be subject to decisions based solely on automated processing that produce legal effects. Note: We use automated photo moderation (AWS Rekognition) to screen uploaded images for content policy violations. This processing does not produce legal effects — flagged content may be removed from the platform. You may contact us to appeal any automated moderation decision.
• Right to Withdraw Consent (Article 7): Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint: File a complaint with your local supervisory authority (Data Protection Authority)

9.2 International Data Transfers

Your personal data may be transferred to and processed in the United States, where our servers are located. The United States may not have the same level of data protection as your home country. We implement appropriate safeguards for international transfers, including:

• Standard Contractual Clauses approved by the European Commission
• Reliance on adequacy decisions where applicable
• Your explicit consent to the transfer

9.3 Data Protection Officer

For GDPR-related inquiries, you may contact us at info@getdriftline.com. We will respond to your request within 30 days as required by GDPR.

9.4 Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data infringes applicable law.

10. Canadian Residents (PIPEDA, BC PIPA, Alberta PIPA, Quebec Law 25)

This section applies if you live in Canada. It adds to Sections 1 through 7 and, where it differs from them, it governs. Your personal information is protected by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, depending on your province, by British Columbia's Personal Information Protection Act (BC PIPA), Alberta's Personal Information Protection Act (Alberta PIPA), or Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25). Under these laws, "personal information" is any information about an identifiable individual — including your email address, IP address, device and push-notification identifiers, location, tracks, waypoints, photos, and journal entries.

10.1 Who Is Accountable (Privacy Officer)

Our Privacy Officer is responsible for how we handle your personal information and for our compliance with the principles in this section:

Privacy Officer: Managing Member, DriftLine Co. LLC
Mailing Address: 16749 Littlerock Rd SW, Rochester, WA 98579, United States
Email: info@getdriftline.com

You may contact the Privacy Officer to ask about our practices, exercise your rights, or challenge our compliance with these principles. In Quebec, the Privacy Officer is the person in charge of the protection of personal information.

10.2 PIPEDA Fair Information Principles

We comply with the ten fair information principles under PIPEDA:

• Accountability: We are responsible for personal information under our control and have designated the Privacy Officer named in Section 10.1
• Identifying Purposes: We identify the purposes for collecting personal information at or before the time of collection (Sections 1 and 2)
• Consent: We obtain your knowledge and consent for the collection, use, or disclosure of personal information, except where inappropriate or not required by law (Section 10.4)
• Limiting Collection: We limit our collection of personal information to what is necessary for the identified purposes
• Limiting Use, Disclosure, and Retention: We use or disclose personal information only for the purposes for which it was collected, and retain it only as long as necessary (Section 6.3)
• Accuracy: We keep personal information as accurate, complete, and up-to-date as necessary for the purposes for which it is to be used
• Safeguards: We protect personal information with security safeguards appropriate to the sensitivity of the information (Section 6.2)
• Openness: We make information about our policies and practices relating to personal information management readily available
• Individual Access: Upon request, we inform you of the existence, use, and disclosure of your personal information and provide access to that information
• Challenging Compliance: You may challenge our compliance with these principles by contacting our Privacy Officer

10.3 Your Rights (All Canadian Residents)

You may ask us to:

• Access: Confirm what personal information we hold about you and how it has been used and disclosed
• Correction: Correct errors or omissions in your personal information
• Portability: Give you a copy of the personal information you provided to us in a common, portable format
• Withdraw Consent: Withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice (Section 10.4)
• Deletion: Delete your account (Section 7.1)
• Complain: File a complaint with our Privacy Officer or with the regulator for your province (Section 10.9)

If you are a resident of British Columbia, BC PIPA gives you these rights of access and correction with respect to personal information in our custody or control, together with the right to be informed of our policies and practices. If you are a resident of Alberta, Alberta PIPA provides equivalent rights. If you are a resident of Quebec, see also Section 10A.

10.4 How We Get Your Consent

We ask for your express consent before collecting sensitive information: precise location (through your device's permission prompt), background location for Track Recording and Fireteam (a separate in-App prompt), and any photo you choose to upload. For less sensitive information needed to run the App — such as your email address, device information, and settings — your consent is implied when you create an account after reading this Policy. We do not use your personal information for a new purpose without telling you and, where the purpose is not obvious or the information is sensitive, asking for your consent again.

You may withdraw consent at any time by adjusting your device or App settings (Section 3.2) or by contacting our Privacy Officer. Withdrawing consent may mean some features stop working; we will tell you what the effect is. For Canadian residents, our processing rests on your consent or on a specific exception in PIPEDA or the applicable provincial law; the "legitimate interests" basis described in Section 3.1 is a European concept and does not apply to you.

10.5 Where Your Information Is Stored (Notice of Transfer Outside Canada)

Your personal information is stored and processed in the United States on Amazon Web Services (Oregon), and our AI features are processed by models hosted in Amazon Web Services regions in the United States (Section 2.2). Our service providers named in Section 5 also process personal information in the United States. While your information is in the United States, it is subject to United States law and may be accessible to U.S. courts, law enforcement, and national security authorities under that law. We use contracts and security measures (Section 6) to protect it, but no safeguard can exempt data from lawful access in the country where it is stored. We do not obtain your separate consent for this transfer; this notice is how we inform you of it before you provide personal information. If you are not comfortable with your information being stored in the United States, please do not create an account.

10.6 If Something Goes Wrong (Breach Notification)

If a breach of our security safeguards involving your personal information creates a real risk of significant harm to you, we will:

• Notify you as soon as feasible
• Report the breach to the Office of the Privacy Commissioner of Canada, as PIPEDA requires
• Report to the Office of the Information and Privacy Commissioner of Alberta where Alberta PIPA applies, and to the Commission d'accès à l'information du Québec where Quebec law applies
• Notify any other organization or government institution that may be able to reduce the risk of harm
• Keep a record of the breach for at least 24 months

British Columbia's PIPA does not currently impose a statutory breach-reporting duty. As a matter of practice, we will nevertheless notify affected BC residents and the Office of the Information and Privacy Commissioner for British Columbia in the same way.

10.7 Automated Processing

Photos you upload are screened automatically for content that breaks our Community Guidelines (Section 1.2). If a photo is removed automatically we will tell you, explain the main factors on request, and let you ask a person to review the decision. AI-generated fishing, hunting, foraging, and scouting reports are produced automatically and may contain errors; they are not decisions about you.

10.8 Retention and Disposal

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law, as set out in Section 6.3. When personal information is no longer needed, we securely destroy, erase, or anonymize it.

10.9 Submitting Requests and Filing a Complaint

To exercise your rights, email info@getdriftline.com with "Canadian Privacy Request" in the subject line and your province of residence, or write to the Privacy Officer at the mailing address in Section 10.1. We will respond within 30 days; if we need more time, we will tell you why and when. We may ask for information to verify your identity and will not charge a fee except as the law allows.

If you are not satisfied with our response, you may complain to:

• Office of the Privacy Commissioner of Canada:
  Website: priv.gc.ca
  Toll-free: 1-800-282-1376
• Office of the Information and Privacy Commissioner for British Columbia (BC residents):
  Website: oipc.bc.ca
  Phone: 250-387-5629
• Office of the Information and Privacy Commissioner of Alberta (Alberta residents):
  Website: oipc.ab.ca
• Commission d'accès à l'information du Québec (Quebec residents):
  Website: cai.gouv.qc.ca

For residents of other Canadian provinces and territories, PIPEDA applies as the governing privacy law and the Office of the Privacy Commissioner of Canada is the regulator.

10.10 Children (Canada)

The App is not for children under 13, or under 14 in Quebec. A parent or guardian must consent on behalf of a child under 14 in Quebec. We delete any such information we learn we hold (Section 11).

10A. Quebec Residents

If you live in Quebec, the Act respecting the protection of personal information in the private sector applies to you. In addition to Section 10:

1. Person in charge. The person in charge of the protection of personal information at DriftLine Co. LLC is our Privacy Officer (Managing Member), reachable at the mailing address and email in Section 10.1.
2. Express consent for sensitive information. We ask for your express consent, given separately for each purpose, before collecting sensitive information such as precise location, background location for trail recording or Fireteam, and photos.
3. Technologies that identify, locate, or profile you. The App uses your device's GPS to locate you; location is off until you enable it in your device settings. The App also uses crash reporting (Sentry) and product analytics (PostHog), which identify your device and, when you are signed in, your account. These are active by default while you use the App. We do not currently offer an in-App switch for them; if you would like analytics and crash reporting disabled for your account, or your analytics profile deleted, contact the Privacy Officer and we will do so. Our main website, baselinemaps.io, uses cookieless analytics and sets no tracking cookies; see Section 1.3 for our legacy website.
4. Communication outside Quebec. Your personal information is communicated outside Quebec, to the United States, as described in Section 10.5. We assess the privacy risks of that communication, including the sensitivity of the information, the purposes, the safeguards, and the legal regime of the United States, before doing so.
5. Portability and de-indexing. You have the right to obtain the computerized personal information you provided to us in a structured, commonly used technological format, and to ask us to stop disseminating, de-index, or re-index personal information where the law provides.
6. Automated decisions. Decisions we make exclusively by automated means (automated photo moderation, Section 10.7) will be explained on request, and you may submit observations to a person who can review the decision.
7. Children under 14. A parent or guardian must consent on behalf of a child under 14. We do not knowingly collect personal information from children under 14 in Quebec.
8. Confidentiality incidents. We keep a register of confidentiality incidents and report incidents presenting a risk of serious injury to the Commission d'accès à l'information and to the persons concerned.
9. Complaints. Contact our Privacy Officer first. You may also complain to the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.
10. Language. This Policy is currently published in English. A French version will be provided on request, and, where the Charter of the French Language requires it, before you are bound.

11. Children's Privacy

The App is not intended for and is not directed at children. We do not knowingly collect personal information from:

• Children under the age of 13 (United States - COPPA; Canada outside Quebec - PIPEDA)
• Children under the age of 14 (Quebec - Act respecting the protection of personal information in the private sector; a parent or guardian must consent for a child under 14)
• Children under the age of 16 (European Economic Area, United Kingdom - GDPR)
• Children under the minimum age specified by applicable law in your jurisdiction

If you are a parent or guardian and believe we have inadvertently collected personal information from your child, please contact us immediately at info@getdriftline.com. We will promptly:

• Verify the claim
• Delete all personal information associated with the child
• Confirm deletion to you

12. International Data Transfers

Baseline Maps is based in the United States, and your information is stored and processed on servers located in the United States (AWS us-west-2 region for storage; AI features in us-east-1 and us-west-2). Canadian residents: Section 10.5 is our notice that information stored in the United States may be accessible to U.S. courts and authorities.

By using the App, you acknowledge and consent to the transfer, storage, and processing of your personal information in the United States and potentially other countries where our service providers operate. These countries may have data protection laws that are different from—and potentially less protective than—the laws of your country of residence.

We implement appropriate safeguards for international data transfers, including:

• Standard Contractual Clauses for transfers to third-party service providers
• Technical and organizational security measures
• Contractual data protection obligations on all recipients

13. Do Not Track & Global Privacy Control

13.1 Do Not Track (DNT)

Some web browsers transmit "Do Not Track" (DNT) signals. There is currently no industry standard for interpreting DNT signals. The App does not currently respond to DNT signals. However, we do not engage in cross-site tracking or targeted advertising.

13.2 Global Privacy Control (GPC)

We honor Global Privacy Control (GPC) signals. If your browser or device sends a GPC signal, we will treat it as a valid request to opt out of the "sale" or "sharing" of personal information as defined by applicable state privacy laws (including California, Colorado, Connecticut, Montana, Oregon, and others).

Note: Since we do not sell or share personal information for targeted advertising, honoring GPC signals does not change how we process your data—but we respect and acknowledge these signals as required by law.

Learn more about GPC at globalprivacycontrol.org.

14. Data Breach Notification

In the event of a data breach involving your personal information, we will:

• Investigate and contain the breach promptly
• Assess the risk to affected individuals
• Notify affected individuals as required by applicable law, including:
  • Within 72 hours to supervisory authorities under GDPR (if applicable)
  • Within timeframes required by applicable U.S. state breach notification laws (typically 30-60 days)
  • As soon as feasible to the Office of the Privacy Commissioner of Canada under PIPEDA, and to the Alberta or Quebec regulator where their laws apply (see Section 10.6)
• Provide information about the breach and steps you can take to protect yourself
• Document the breach and our response

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Last Updated" date at the top of this Privacy Policy
• For material changes, we will provide prominent notice by:
  • Displaying a notice in the App
  • Sending a push notification (if you have enabled notifications)
  • Sending an email to registered users
• Where required by law, we will obtain your consent before implementing material changes

Your continued use of the App after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

You can access previous versions of this Privacy Policy by contacting us at info@getdriftline.com.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

DriftLine Co. LLC (Baseline Maps)
Privacy Officer: Managing Member, DriftLine Co. LLC
Mailing Address: 16749 Littlerock Rd SW, Rochester, WA 98579, United States
Privacy Inquiries: info@getdriftline.com
Legal Inquiries: info@getdriftline.com
General Inquiries: info@getdriftline.com

When contacting us about a privacy request, please include:

• Your state or country of residence
• The specific right you wish to exercise
• Enough information for us to verify your identity

We will respond to your inquiry within the timeframes required by applicable law:

• California (CCPA/CPRA): 45 days
• Most U.S. State Laws: 45 days
• Iowa: 90 days
• GDPR (EEA/UK): 30 days
• Canada (PIPEDA, BC PIPA, Alberta PIPA, Quebec): 30 days