Privacy Policy

What Legend Guide collects, why, who sees it, and what you can do about it. We don't sell your data, and your content isn't used to train foundation models.

Scope

This Privacy Policy explains what Rock Garden Inc. ("we", "us") collects when you use Legend Guide (the "Service"), why we collect it, who we share it with, and what you can do about it. If any of this conflicts with the Terms of Service, this policy wins for privacy questions.

What we collect

You give us

• Account info — email address, optional display name and avatar. Authentication is handled by Supabase.
• Content — routes, entities, guides, comments, photos, videos, tours, and anything else you post. If you include location in your content, you're making it public.
• Payment info — when you tip or buy a guide, payment details (card number, billing address) go directly to Stripe. We never see or store them. Stripe tells us the payment succeeded and gives us a session ID.
• Payout info — when you request a payout, whatever contact you provide (PayPal email, Venmo handle, mailing address for check).

We collect automatically

• Usage — pages viewed, features used, actions taken. We use this to improve the Service.
• Technical — IP address, user agent, device info, approximate location derived from IP. We use this for security, rate limiting, and abuse prevention.
• Logs — server logs, error reports, performance traces.
• Cookies / localStorage — for sessions, theme preference, and view state. No third-party advertising cookies.

Why we collect it

• Operate the Service — show you content, power Dispatch AI answers, process payments, pay creators.
• Moderate — keep harmful, illegal, or unsafe content off the platform.
• Security & abuse prevention — rate-limit abuse, detect fraud, protect accounts.
• Improve the Service — understand what's working, fix bugs, design new features.
• Comply with law — tax reporting for payouts, lawful requests.

Who we share it with

We don't sell your personal information. We share data with service providers who help us run the Service, bound by contracts that restrict their use of it:

• Supabase — database, authentication, storage.
• Stripe — payment processing. (Stripe privacy policy)
• Fly.io — hosting infrastructure.
• Anthropic — Claude powers Dispatch answers. Your messages go through Anthropic's API. (Anthropic commercial terms)
• Google — Gemini powers content moderation and some text synthesis. Also Google Photorealistic 3D Tiles for the globe view.
• OpenAI — text-embedding-3-small for search indexing.
• Mapbox, Cesium — map tiles and 3D terrain. They log tile requests.

We may also share information (a) to comply with a lawful request, subpoena, or court order, (b) to investigate fraud or abuse, (c) with your consent, or (d) in a merger or acquisition, subject to notice.

How long we keep it

• Account data: until you delete your account.
• Content: until you remove it (or we remove it under moderation).
• Payment and payout records: as long as we're legally required to keep them (generally 7 years for tax).
• Logs: typically 90 days.
• Backups: up to 30 days after deletion, after which backups expire.

Your choices

• Access / export — email privacy@legend.guide for a copy of your account data.
• Correction — edit your profile and content directly, or ask us.
• Deletion — delete your account, or ask us. We'll honor deletion requests within 30 days, minus records we're required to keep for legal or payout reasons.
• Opt-out of non-essential email — unsubscribe from any marketing email we send. Transactional email (receipts, payout notices, moderation decisions) is part of the Service.

If you're in California, the EU, UK, or another region with data rights laws, you have the rights those laws grant — including the right to know, delete, and object to processing. Exercise them at the email above.

Children

The Service isn't directed at children under 13, and we don't knowingly collect their personal info. If you believe a child has given us data, email privacy@legend.guide and we'll delete it.

Security

We use reasonable technical and organizational measures — encryption in transit, access controls, row-level security on user data. No online service is 100% secure. If we learn of a breach that affects you, we'll notify you as required by law.

International transfers

We're based in the United States and our service providers operate globally. Using the Service means your data may be transferred to and processed in the US and other countries.

Changes

If we make material changes, we'll give at least 30 days' notice before they take effect, via email or in-app notice. The "Effective" date at the top tells you when the current version was published.

Contact

Privacy questions, requests, or complaints: privacy@legend.guide

Rock Garden Inc.
DBA Legend Guide
Utah, USA