Family privacy
A small, parent-managed data footprint.
National Park Compass keeps family profiles private and collects only what is needed to save park visits, badge progress, and park trips across devices.
Effective August 16, 2026
What the family account stores
The account stores an adult-selected account name, an optional home state or territory, and the date the adult account setup was confirmed.
Firebase Authentication manages the adult sign-in email and provider. The email is shown in account settings but is not copied into the family account document.
When the account owner chooses Save trip, the private account stores the trip name, ordered park or site codes, a trusted park-name snapshot, planned time at each stop, and created and updated timestamps.
Tracked profiles and badges — plus visits
The adult account owner can create a profile for themself, a child they manage, or another person who has agreed to be tracked, using a first name, nickname, or other chosen display label. The selected profile type is stored with that profile.
A visited-park record stores the park or site and that the account holder marked it visited. It stays separate from Junior Ranger progress, which records the park or site, an optional date earned, and that the accomplishment was reported by the account holder.
Badge records are a private planning and memory tool. They are not issued, verified, or endorsed by the National Park Service.
What we deliberately avoid
Tracked profiles do not have separate sign-ins. The app does not ask for another person’s email, birthdate, school, photo, precise home address, or badge-proof upload.
Map location and city or ZIP searches are used to answer the current request. They are not stored in the family account as location history.
A shared trip link contains only park or site codes, their order, and planned durations. It does not contain an account ID, trip name, home region, profile, or live location. Anyone who receives that link can view its itinerary.
Optional usage analytics
Google Analytics for Firebase stays off until a visitor chooses Allow analytics. When allowed, it can use a first-party identifier such as the _ga cookie to measure page visits, sessions, approximate geography, and basic browser and device information.
National Park Compass sends route-level page paths only. It does not send query strings, search text, ZIP codes, map coordinates, precise location, Firebase user IDs, email addresses, account or profile names, trip details, visited-park details, or badge details to Analytics. Advertising signals and ad personalization are disabled.
The choice applies to this browser and can be changed at any time with Analytics choices in the footer. Choosing No thanks does not affect maps, accounts, badges, or trips.
Who can read the data
Family account data is private to the Firebase user who owns it. Another family account cannot browse it, and administrator browsers cannot directly query private family records from Firestore.
A limited group of authorized administrators can use a claim-protected server report to view an adult account’s sign-in email, display name, account setup status, creation date, last sign-in date, and aggregate product totals for support and operations. That report does not expose tracked-profile names, badge details, saved-trip names or stops, or location history.
Trusted Firebase services process authenticated account actions. Official NPS and USFWS links open third-party pages governed by their own practices.
Your controls
Account settings provide a machine-readable data download that includes visited parks, Junior Ranger progress, saved trips, removal controls for each tracked profile, and complete account deletion. Each saved trip can also be deleted from the Trip Planner.
Deleting the family account permanently removes its private account document and every profile, visited-park record, progress record, and saved trip below it.
Signing out is especially important on a shared phone or computer. No family data is intentionally added to the app’s service-worker cache.