Privacy Policy
Who we are
Xplorfy is a service that helps churches, ministries and other organizations plan and run group hikes. It is operated by Crestpoint Enterprises, LLC, doing business as Xplorfy ("Xplorfy", "we", "us"). This Privacy Policy explains what personal information we collect through app.xplorfy.com, why we collect it, who can see it, how long we keep it and the choices you have.
Questions or requests: privacy@xplorfy.com. General support: support@xplorfy.com.
Who can use Xplorfy
Accounts are for adults aged 18 and over. We do not knowingly create accounts for anyone under 18. If you believe a person under 18 has an account, contact privacy@xplorfy.com and we will remove it.
Organizations and Xplorfy
Most of what you do on Xplorfy happens inside an organization (for example, your church). Organizations decide which hikes to run, who may join them and how to contact their members. Organization leaders can see some of your information, as described below, so that they can run hikes safely. Each organization is responsible for how its leaders use the information they can see; we provide the tools and apply the access rules described here.
Information you give us
Account. Your name, email address and password when you register. You must accept our Terms of Service and acknowledge this Privacy Policy to create an account; we record which version you accepted and when.
Profile. To take part in hikes you complete a profile:
- About you: name, preferred name, mobile number, date of birth, gender, language, home address and a profile photo. An optional short bio.
- Hiking experience, skills and certifications.
- Fitness: overall fitness, cardio and strength levels and related notes.
- Medical: conditions, allergies, medications, past surgeries and hospital stays, and notes for leaders. You decide what to enter. Leaders need a completed medical section before they can approve you for a hike.
- Emergency contacts: the name, relationship, phone numbers and email of people to contact in an emergency. You should tell them you have listed them.
Faith and ministry (optional). You may describe your faith journey, your interest in serving, and people you would like as spiritual support contacts. These sections are optional: you can skip them during setup and add or remove them at any time. We treat these answers as sensitive religious information; see "Faith and ministry information" below.
Hikes. Your registrations, the activity waiver you accept for a hike, participation approvals, attendance and any feedback, ratings, testimonies or photos you share. Photos are reviewed before they are shown and you choose whether a photo is public.
Records of what you agree to. When you accept our Terms of Service, this Privacy Policy or a hike's activity waiver, we keep a record of which version you accepted, the date and time, your IP address and your browser, so that we and the organization can show what was agreed.
Messages and requests. Messages you send to us, bug reports and feature requests (including any screenshots or videos you attach), and your conversations with the in-app help assistant.
Text messages. If you give a mobile number and tick the box to receive texts, we send hike and organization text messages to that number. You can reply STOP at any time to stop them.
Information collected automatically
- Security and sign-in records: sign-in attempts, the IP address and browser used, multi-factor authentication events and security alerts. We use them to protect accounts and stop abuse.
- Approximate location from your IP address (city, region, country), worked out on our own servers from a downloaded database. Your IP address is not sent to anyone else for this.
- Activity records: important actions you take in the app (for example, registering for a hike or changing a setting), with the time, IP address and browser.
- Usage records: which pages signed-in users view and on what type of device, so we can improve the service.
- Error reports: when something goes wrong, the page, time, your account and browser.
Faith and ministry information
Your profile lets you describe your faith journey (the Faith section) and your interest in serving (the Ministry section). We treat these answers as sensitive religious information.
1. Private by default
Your faith and ministry answers are private. We do not show them to other members, to your organization's leaders, or to anyone else unless you choose to share them as described below. Joining an organization, registering for a hike or accepting our Terms of Service is not consent to share them, and answers you gave before this choice existed were not shared.
2. Sharing with an organization's leaders -- your choice, per organization
On the Faith and Ministry sections of your profile you can choose, separately for each organization you are an active member of, to share your faith and ministry answers with that organization's leaders. If you share:
- Who can see them: the Founders, Admins and Organizers of that organization only, while they hold that role and while your membership of that organization is active. If your membership is suspended, sharing is paused; if it ends, your choice for that organization ends too, and re-joining does not turn sharing back on.
- Where: on that organization's Faith and Ministry pages, on the Faith, Ministry and Spiritual Support pages of hikes that organization sponsors, and in exports of those pages.
- What: Faith -- faith stage, comfort sharing faith, spiritual growth intent, preferred engagement style, current spiritual season, whether you are baptized, home church and attendance, whether you are open to prayer requests on hikes and to public prayer, and the spiritual support contacts you named (name and phone). Ministry -- willingness to serve, interest in mentoring or being mentored, willingness to lead prayer or share a testimony, availability, leadership interest and ministry lanes.
- Why: so the leaders you chose can plan hikes, devotionals and serving opportunities that fit the people on the trail.
Sharing with one organization shares nothing with any other organization. Hike facilitators and guides, other members, other organizations and our own staff do not receive your answers through this choice.
3. Withdrawing
You can stop sharing with any organization at any time from the same place. Access ends immediately: the leaders can no longer see your answers or export them. We cannot recall a copy a leader downloaded while you were sharing.
4. Prayer requests
This choice concerns organization leaders only. It never makes a prayer request public or shares it with a wider audience; any such sharing requires its own, separate permission.
5. Records we keep
We record each time you turn sharing on or off: you, the organization, the version of this explanation you agreed to, and the date and time. These records do not contain your answers. We keep them while your account exists so we can show what you agreed to and when.
6. Other uses
Our platform operators may see totals that do not name anyone (for example, how many members are at each faith stage or are willing to mentor). These totals count only members who have chosen to share their answers with at least one organization; if you have not shared with any organization, your answers are not counted in them.
How we use your information
- To provide the service: your account, profiles, hikes, organizations and messages.
- To keep hikes safe: so the leaders responsible for a hike can see the medical, emergency and readiness information they need.
- To send messages: account emails (confirmation, password reset, invitations) and, if you have not opted out, hike and organization messages by email and text.
- To protect Xplorfy and its users: preventing fraud, abuse and unauthorized access, and enforcing our Terms.
- To support you and improve the service: answering requests, fixing problems and understanding how features are used.
- To meet legal obligations.
We do not sell your personal information, and we do not use it for advertising.
Who can see your information
- You can see and edit your own profile.
- Other members see only general hike and organization information, never your medical, emergency, readiness or contact details.
- Organization leaders (Founders, Admins and Organizers of an organization you are an active member of, for hikes that organization sponsors) can see the medical, emergency, contact and readiness information of people on those hikes, and can export it, so they can run hikes safely.
- Hike leaders (Facilitators and Guides) can see that information only for hikes they are actively assigned to.
- Faith and ministry answers are visible only as described in "Faith and ministry information".
- Xplorfy staff with administrator access can see account information to run and support the service and investigate problems. An administrator can temporarily view the app as a user to diagnose a problem; these sessions are time-limited and logged, and an administrator cannot change your faith-sharing choices this way.
Service providers
We use these providers to run Xplorfy. They process information only for us:
| Provider | Purpose | Information |
|---|---|---|
| Microsoft Azure | Hosting, database, key storage, application monitoring | All service data |
| SendGrid (Twilio) or Microsoft 365 | Sending email | Your email address, name and the message |
| Twilio | Sending text messages | Your mobile number and the message |
| OpenAI or Microsoft Azure OpenAI | The in-app help assistant | The question you type (not your profile) |
| Cloudflare | Bot protection on sign-in and registration | Browser and network signals |
| Google, Microsoft | Optional sign-in with those accounts | The verified email address they share |
| Have I Been Pwned | Checking that a new password is not a known leaked password | A short, anonymous fragment of a password hash -- never your password |
Your browser also loads fonts, icons and editing tools from public content networks (Google Fonts, jsDelivr, Iconify, Quill), which receive your IP address as part of the request.
We may also disclose information when required by law, to protect someone's safety, or as part of a sale or reorganization of our business (in which case this Policy continues to apply).
Links to other websites
Some gear and meal guides link to products on other websites. Some of those links may be affiliate links, which means we may earn a commission if you buy through them, at no cost to you. Those sites have their own privacy practices.
Cookies and similar technology
We use a small number of cookies, all set by Xplorfy:
| Cookie | Purpose | How long |
|---|---|---|
| Sign-in | Keeps you signed in | 8 hours of inactivity |
| Remember this device | Skips the second sign-in step on a trusted device, if you choose | 30 days |
| Security (anti-forgery) | Protects forms against cross-site attacks | Your browser session |
| Usage session | Groups the pages you view in one visit | Your browser session |
| Recent searches | Remembers your last few searches | 30 days |
Your browser also stores a few display preferences (for example, light or dark theme). We do not use advertising or cross-site tracking cookies.
How long we keep information
- Your account and profile: while your account exists.
- Records of accepted terms, policies and waivers: while your account exists, and afterwards for as long as needed to establish or defend legal claims.
- Help assistant conversations: 90 days.
- Activity, usage, error and message-delivery records: 1 year.
- Security records (sign-in attempts, security events): 2 years.
- Email addresses in account-email records: removed after 30 days.
- Backups: our database provider keeps backups for a short period (7 days) for recovery.
When an account is deleted, its profile, medical, faith and ministry information, registrations, photos, feedback, memberships and messages are permanently deleted. Some security and audit records are kept for their normal period with the link to you removed.
Your choices and rights
- See and correct your information at any time on your Profile.
- Faith and ministry: leave these sections blank, change them, or stop sharing them with any organization at any time.
- Messages: unsubscribe from organization emails and texts using the link in each message, or reply STOP to a text. Account emails (such as password resets) are always sent because the service needs them.
- Delete your account or get a copy of your information: email privacy@xplorfy.com from the address on your account. We will confirm your identity and respond within 30 days.
Depending on where you live, you may have additional rights under local law; contact us and we will respond as the law requires.
Security
We protect information with multi-factor sign-in, encrypted connections, encryption of stored secrets, access rules that limit who can see sensitive information, and monitoring for unusual activity. No system is perfectly secure; if we learn of a breach that affects you, we will notify you as the law requires. Report security concerns to security@xplorfy.com.
Where information is stored
Xplorfy is operated from the United States and your information is stored in the United States.
Changes to this Policy
We will post any changes here with a new version number and effective date. If a change is significant, we will ask you to review and accept it before you continue using Xplorfy.
Contact
Crestpoint Enterprises, LLC, doing business as Xplorfy 1675 Route 228 #1056, Cranberry Township, PA 16066 privacy@xplorfy.com