Privacy Policy

Last updated: October 10, 2026

This policy explains what information Cairnstone Labs LLC ("we," "us," or "our"), which operates ormaio (the ormaio.com website and app), collects, how we use it and what rights you have. The short version: your photos are read on your own device first, location data inside them is removed when they are uploaded, we do not sell your data, we do not show ads and you can delete your account completely at any time.

1. Information we collect

• Account information: your email address, your password (stored only as a secure hash by our authentication provider), your name, your username and, if you choose to add them, your profile photo (kept in public storage; anyone who opens your profile can see it), bio, location text (for example "Seattle, WA"), website link and pronouns.
• Content you create: the days you log (your hike entries), photos, stop names and locations, summaries such as distance and duration, notes, reviews, trail condition reports (public), restroom marks (clean or dirty, public as counts), places you want to go, follows and likes, and the visibility setting of each day.
• Photos and location: When you log a day, the location and time data in your photos is read on your device and used to find your stops. When you save a day, your device makes a fresh copy of each photo before uploading it, which strips out the GPS location and camera details. The day itself stores where each photo was taken, the compass direction and lens focal length your phone recorded (we use these to name the peaks and lakes in a photo), any place names you add, your route, if you upload a GPX file, and the listed trail we match your GPX route or photos to. Who can see this follows the day's privacy setting, and if you turn on Hide home location, spots and route points within half a mile / 800 m of your home are removed from days you share.
• Preferences stored on your device: your photo recognition preference, the home location you set for "Hide home location," the trip plans you save and the content you hide are kept only in your browser's local storage and are not sent to us.
• Usage statistics: To improve the site, we count which parts of it are used (for example, opening the site, switching tabs, saving a day, making a trip plan). These records do not include your name, email address, IP address or user ID; we keep only a random identifier tied to your browser session and whether you are logged in. If "Do Not Track" is turned on in your browser, you are not counted at all.
• Error logs: If an error occurs on the site, we record the error message, the page where it occurred and your browser information (user agent).
• Monthly challenge: we use each day's distance, whether its location was confirmed by photo GPS or a GPX file, and the listed trail it matched, to count your challenge hikes. Others see only the total number of people taking part.
• Reports and blocks: If you report content, we store the reason for the report and any optional note you add. If you block someone, we store a record of the block.

2. How we use information

• To create your account and to show your days, profile and follows.
• To show your days to you, your friends or everyone, according to the visibility you choose.
• To generate "Where to today?" suggestions and trip plans.
• To prevent abuse, review reports and moderate shared content.
• To count monthly challenge hikes and, when a prize draw is running, to contact the winner. Moderators can see the email addresses of people who finished the challenge for that purpose only.
• To find errors and improve the service.

We do not sell or rent your information, and we do not use it for advertising.

3. Photo recognition (optional) and content moderation

• Photo recognition is off by default. If you turn it on, reduced-size copies of the first three photos of a day you are logging are sent through our server to an AI provider, Anthropic, to get activity and place suggestions. We do not store these copies.
• When you type a place name or a review note, that text may be sent to Anthropic to match it to a known place and to tag trail features. It is not stored by the provider.
• The cover photo of a day you share with your friends or with everyone may be automatically checked for inappropriate content by Anthropic's AI. If photo recognition is on, Voyage AI turns the cover photo of a shared day into a numerical "fingerprint" so we can group photos of similar places.
• These providers process data under their own commercial API terms. By default, Anthropic does not use data sent through its API to train its models.

4. Service providers we use

We work with the providers below to run the service. Some of them may see your IP address because your browser connects to them when you open a page.

• Supabase: database, file storage and authentication (accounts, days, photos).
• GitHub Pages: website hosting.
• Cloudflare: domain name (DNS) and email forwarding.
• Anthropic and Voyage AI: in the situations described in section 3 above.
• U.S. National Weather Service (NWS) and Open-Meteo: weather forecasts and air quality (AQI) forecasts. Trail and region coordinates are sent to get forecasts, and if you choose "Use my location," your location is sent as well; we do not store this location.
• OSRM: receives your starting point and the trailhead coordinates to calculate driving times in trip plans.
• National Park Service and WSDOT: park alerts and mountain pass conditions. Our server requests these; no information about you is sent.
• USGS The National Map: map tiles.
• Google Fonts, cdnjs and jsDelivr: fonts and page libraries.
• Wikimedia Commons: trail and place photos.
• Google Maps and Recreation.gov: opened only if you click a "Directions" or "Reserve" link.

5. Visibility, reporting and blocking

Every day is saved as "Only me" by default. If you choose "Friends," people you follow who also follow you back can see it; if you choose "Everyone," anyone can see it. Your name, username, profile photo, bio, location, website, pronouns and public days are visible on your profile. Follow lists are visible only to logged-in users. Your reviews and trail condition reports are public, along with your name. You can report any content or block any user; we review reports and remove content when necessary.

Hiking plan links: when you use "Tell someone your plan," your name, the trail, your times and your notes are written into the link itself. We don't store the plan on our servers and we don't track your location; anyone you give the link to can read it.

6. Retention and deletion

We keep your information for as long as your account is open. On your profile, go to Settings → Delete my account to permanently delete your account and all of your days, photos, reviews, trail condition reports, restroom marks, likes, follows and profile. Deleted data is removed from our service provider's backups in the normal backup cycle. Usage statistics and error logs do not contain personal information and are not linked to your account.

7. Your rights

To access, correct, get a copy of or request deletion of your information, you can edit your profile or write to info@ormaio.com. We respond to requests within a reasonable time.

8. Children

ormaio is not designed for children under 13, and we do not knowingly collect information from children under 13. If we learn of such an account, we will delete it.

9. Security

Connections are encrypted (HTTPS). Photos from your days are kept in private storage and are made available only to people allowed to see them, through links that expire (profile photos are public, as described above). Database access is restricted by row-level security rules. No system is completely free of risk; if a security breach occurs, we will provide notice as required by law.

10. Changes and contact

We may update this policy. We will announce significant changes on the site and update the date at the top of this page. Questions: Cairnstone Labs LLC, Seattle, Washington, USA · info@ormaio.com