Family privacy
A small, parent-managed data footprint.
National Park Compass keeps family profiles private and collects only what is needed to save badge progress and park trips across devices.
Effective July 28, 2026
What the family account stores
The account stores an adult-selected account name, an optional home state or territory, and the date the adult account setup was confirmed.
Firebase Authentication manages the adult sign-in email and provider. The email is shown in account settings but is not copied into the family account document.
When the account owner chooses Save trip, the private account stores the trip name, ordered park or site codes, a trusted park-name snapshot, planned time at each stop, and created and updated timestamps.
Tracked profiles and badges
The adult account owner can create a profile for themself, a child they manage, or another person who has agreed to be tracked, using a first name, nickname, or other chosen display label. The selected profile type is stored with that profile. Badge progress records the park or site, an optional date earned, and that the accomplishment was reported by the account holder.
Badge records are a private planning and memory tool. They are not issued, verified, or endorsed by the National Park Service.
What we deliberately avoid
Tracked profiles do not have separate sign-ins. The app does not ask for another person’s email, birthdate, school, photo, precise home address, or badge-proof upload.
Map location and city or ZIP searches are used to answer the current request. They are not stored in the family account as location history.
A shared trip link contains only park or site codes, their order, and planned durations. It does not contain an account ID, trip name, home region, profile, or live location. Anyone who receives that link can view its itinerary.
Who can read the data
Family account data is private to the Firebase user who owns it. Another family account—and the ordinary browser-facing admin dashboard—cannot browse it.
Trusted Firebase services process authenticated account actions. Official NPS links open third-party pages governed by their own practices.
Your controls
Account settings provide a machine-readable data download that includes saved trips, removal controls for each tracked profile, and complete account deletion. Each saved trip can also be deleted from the Trip Planner.
Deleting the family account permanently removes its private account document and every profile, progress record, and saved trip below it.
Signing out is especially important on a shared phone or computer. No family data is intentionally added to the app’s service-worker cache.