Privacy Policy

Who we are

Rocky Mountain Digerati LLC("rmdig", "we") is a Colorado company. We operate the AvAI™ mobile app (a beta safety companion for backcountry travel), this website and web portal at rmdig.ai, and the self-hosted server infrastructure ("AvServ") that powers AvAI's check-out/check-in safety feature. This policy covers all of them.

What we collect and why

Location (precise and coarse)

When you use AvAI's check-out/check-in feature, the app collects your device's precise and coarse location, linked to your account, and sends it to AvServ — servers we run ourselves. It is used for one purpose: app functionality. Concretely, that means keeping your last-known location current while a check-out is armed, sending that location to your emergency contact if you don't check in on time, and periodic device heartbeat reports. Photos you capture may also embed the capture location in their metadata; at this stage of the beta those stay on your device (see below).

We do not use your location for advertising, profiling, or tracking, and we do not sell it. Precise geolocation is sensitive data under the Colorado Privacy Act; AvAI collects it only after you grant the operating-system location permission, and the app explains the safety purpose at the point of the permission prompt.

Photos

AvAI lets you capture snowpack profile and core photos in the field. At this stage of the beta, these photos are collected on and stay on your device — they are not uploaded to our servers or shared with anyone. A future, separately announced version will offer an opt-in way to contribute captures to a public research dataset; if that launches, it will require your explicit per-session consent in the app and this policy will be updated first.

Emergency contact details

To run the check-out/check-in feature you give AvAI the name and contact details (email address and, where provided, phone number) of the emergency contact you choose. We store these on AvServ and use them for exactly one thing: delivering your overdue and all-clear alerts. If you name someone as your emergency contact, please tell them — we hold their contact details on your instruction.

Account data

A portal account includes your email address, a display name, and — for password sign-in — a salted hash of your password (never the password itself). If you sign in with Google, we receive your name, email, and profile image from Google. If you enable two-factor authentication, the TOTP secret is stored encrypted. Devices you link to your account are recorded so the safety features know which device is yours.

Safety and telemetry records

AvServ keeps your check-out/check-in history (times, statuses, and the alerts it dispatched) and device heartbeat telemetry (periodic "the device is reachable" reports). These exist so the watchdog can work and so we can audit that an alert really fired.

No tracking, no ads, no sale of data

AvAI does not track you across other companies' apps or websites and sends no data to advertising or data-broker networks. The iOS privacy manifest declares tracking: none, with an empty tracking-domain list, and every data type it declares (precise location, coarse location, photos) is marked "not used for tracking." We do not sell personal data.

Who your data is shared with

• Your emergency contact — if an overdue alert fires, they receive your name, the alert, and your last-known location. That is the product working as described.
• AvServ — our own self-hosted servers. First-party infrastructure, not a third party.
• Service providers — we use Vercel (web hosting), Neon (database), Resend (transactional email), Twilio (SMS alert delivery), Sentry (error reporting), and Cloudflare (DNS/network) to run the service. They process data on our behalf and are not permitted to use it for their own purposes.
• Legal requirements — we may disclose data if required by law.

No one else. There is no advertising or analytics sharing.

Text messages (SMS)

AvAI's safety alerts are delivered by SMS and email to the emergency contact an AvAI user designates. Messages are sent by our own servers through Twilio, our SMS delivery provider, and are strictly event-driven: an overdue alert, a Send Help alert, or the all-clear that follows. We send no marketing or promotional texts, and message frequency depends entirely on the user's safety activity. Message and data rates may apply.

If you receive these messages, it is because an AvAI user listed your phone number as their emergency contact; alerts identify the user who named you. We ask users to get their contact's permission first. Reply STOP to opt out of further messages or HELP (or email [email protected]) for assistance. Be aware of what opting out means here: if you text STOP, you will not receive that person's safety alerts, including a real overdue or Send Help alert — tell them so they can choose a different emergency contact.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Phone numbers and message-consent information are used only to deliver the safety messages described above.

How long we keep data

These windows are our operating practice while the service is in beta; final retention terms are part of the legal review noted at the top of this page.

Your rights (Colorado Privacy Act)

If you are a Colorado resident, you have the right to access, correct, and delete the personal data we hold about you, to obtain a portable copy, and to opt out of targeted advertising, sale, and certain profiling — none of which we do in the first place. Precise geolocation is sensitive data under the CPA, and we collect it only with the consent described above.

To delete your data, submit a deletion request — it works whether or not you have a portal account. For access or correction requests, email [email protected]. We respond within 45 days.

Apple privacy-manifest disclosures

For transparency, the iOS app's privacy manifest declares exactly the collection described above: precise location, coarse location, and photos — each linked to your account, used for app functionality only, and not used for tracking. The manifest also declares the app's use of four "required-reason" system APIs, in each case for ordinary app operation rather than fingerprinting: user preferences storage (CA92.1), file timestamps (C617.1), free disk space (E174.1), and system boot time (35F9.1).

Security

Data moves between the app, this site, and our servers over encrypted connections (TLS). Passwords are stored only as salted hashes, two-factor secrets are stored encrypted, and recovery and reset tokens are stored only as one-way hashes. No system is immune to compromise; if a breach affects your data, we will notify you as the law requires.

Children

AvAI and the rmdig portal are not directed to children under 13, and we do not knowingly collect their data.

Changes to this policy

We will post any changes on this page and update the date at the top. For material changes — like the future dataset-contribution feature — we will also notify you in the app before the change takes effect.

Contact

Rocky Mountain Digerati LLC
[email protected]