Privacy Policy

Status: Draft — not effective

Last updated: 2026-08-09 Operator: Treaxures, operated by ESPR Creative Lab Private Limited, Aizawl, Mizoram, India

This draft describes the data used by the Treaxures product. It does not claim compliance with any law and must not be treated as the final notice until counsel approves it and the release manager reconciles it against the exact signed app and hosted services.

1. Who is responsible for your data

Treaxures is operated by ESPR Creative Lab Private Limited, a company incorporated in India with its place of business in Aizawl, Mizoram, India. For data-protection purposes it is the data fiduciary (the controller) for the personal data described in this notice. It is governed by Indian law, including the Digital Personal Data Protection Act, 2023.

Before publication the operator must add its registered-office address and corporate identity number here, and counsel must confirm the named grievance officer, the statutory response periods, the supervisory authority, the governing law and forum, and the basis for any transfer of data outside India.

Treaxures is not the controller for everything you do inside it. Where a booking, a purchase, or a journey is fulfilled by someone else — an expert, a seller, a business partner, an airline, a hotel, or an app store — that party is responsible for the data it holds under its own notice. §4 and §5 say which is which, and the final notice must state the relationship for each.

Treaxures is an open platform. A guide reaches the public catalogue once it has passed the same local-context, field, safety, accessibility, source, rights, and contributor review as any other, wherever it comes from — so the catalogue may be small or empty in a place that has not been reviewed yet. This notice is not limited to one city or region.

2. When Treaxures collects data

You can browse the public catalogue without creating an account or granting location access. Treaxures asks for data progressively when a feature needs it. Most of the capabilities below are optional and collect nothing until you open them.

Account and profile

If you create an account, we process your account identifier, email or phone where used, sign-in provider data, display name, optional profile fields, preferences, consent records, security events, and account-recovery data.

Foreground location and field activity

If you start a location-dependent field feature, we may process foreground GPS coordinates, accuracy, timestamps, route progress, stop confirmations, and device-generated activity needed for that feature. Browsing and preparation remain available when location is denied. The launch build does not collect continuous background location.

Location evidence is not automatically treated as a purchase, contribution, respectful action, or completed journey. Completion and Passport records use the documented server rules and keep uncertainty visible.

Safety features record additional location data only when you invoke them: an SOS alert, a live location share you start, and the emergency contacts you choose to store.

Camera, photos, audio, and 3D capture

Camera frames used only for an on-device view — including augmented-reality alignment — are not uploaded unless you choose to capture or submit media. Uploaded photos, video, narration, captions, transcripts, credits, consent, rights records, and technical metadata are stored for the submitted purpose.

The 3D model pipeline processes the model files you upload, their derived previews, and the rights and attribution record attached to them. The field capture tool, which is invitation-only, stores an offline capture session on your device and uploads its media, notes, coordinates, and rights record to the workspace that invited you.

Microphone access is requested at point of use, for voice search, an authorised audio-recording workflow, and voice chat inside a multiplayer session. Voice in a multiplayer session is carried by a real-time communications provider and is heard by the other participants in that session. Before publication the operator must confirm and name that provider in §4, state whether any audio is recorded or retained, and describe the mute, report, and block controls.

Messaging, consultations, and sessions

Direct messages, consultation threads, booking messages, and multiplayer session chat are stored so the other participants can read them. They are not end-to-end encrypted: staff can access them where a report, a legal process, or a safety investigation requires it. We also process the block, mute, and report records you create, and the moderation decisions taken on them.

Device, notifications, security, and diagnostics

We may process app and OS version, locale, time zone, installation and push tokens, network/error context, consent state, security signals, crash reports, and performance information.

Optional diagnostics are off unless you turn them on. On first launch the app asks you to choose, and every category — product analytics, crash reporting, personalisation, marketing, and optional partner features — starts switched off. Declining is a real switch, not a recorded preference: analytics, crash reporting, and performance collection are each disabled in the underlying SDK at the moment you decline, and the app's own event pipeline drops events before they are built. A Do Not Track setting additionally suppresses analytics and performance collection regardless of the individual choices.

Before publication the app must also offer a way to review and change that choice after the first prompt, and this section must be updated to name it.

Content and communications

Depending on the features you use, we process field-guide drafts, route data, source notes, contributor credits, media, corrections, reports, eligible completed-experience reviews, selected profile stories, support messages, and private Creator Studio submissions.

If you are invited to a private preview, we record the invitation, your acceptance, the access grant that scopes it, and the feedback you submit against that release. A preview grant is issued by the server and is revocable.

Payments, purchases, entitlements, and bookings

An operationally approved commercial capability collects order, booking, price, tax, fee, seller/provider, fulfilment, receipt, refund, dispute, payout, and reconciliation records. The payment provider processes payment credentials; Treaxures must not store a full card number, UPI PIN, or net-banking credential.

Which rail carries a payment depends on what is being sold, because the app stores require it:

Store purchases. Apple and Google are the merchant of record for digital goods. They tell us, through RevenueCat, that a purchase or renewal happened and what it entitles you to. Refunds for those purchases are handled by the store, under the store's policy, not by Treaxures. We hold the entitlement so the app knows what to unlock; you cannot write to it from the app.

Marketplace. A listing you buy or sell records the listing, licence terms, price, the counterparty, the rights record attached to the asset, and the resulting entitlement and payout.

Business partners. A partner listing, offer, redemption, or QR check-in records the partner, the location, the time, and the redemption evidence. An outbound product handoff records attribution only when you opt in after the disclosure. A redirect is not recorded as a sale. Conversion or commission information comes from reconciled provider evidence.

Flight and hotel booking

If you book travel, we process the traveller details the airline or hotel requires — which can include full name, date of birth, contact details, frequent-traveller number, and, where the carrier demands it, passport or government-identifier data — together with the itinerary, room or fare selection, booking reference, and payment record. Those details are sent to the travel provider and onward to the airline or hotel, which hold them under their own notices and their own retention rules. Treaxures cannot delete a reservation record held by a carrier.

Digital collectibles, wallets, and the public blockchain

If you mint a digital collectible, we process the wallet address you connect, the mint request, the resulting on-chain transaction identifier, and the metadata published for that collectible.

Two consequences you should read before minting. The metadata and image are published to IPFS, a public content-addressed network, and a copy can persist even after we unpin ours. The mint itself is written to a public blockchain (Polygon), which is permanent, worldwide, readable by anyone, and cannot be edited or deleted by Treaxures or by you — including in response to a deletion request. A wallet address is pseudonymous, not anonymous: anyone who can link it to you can read everything it has ever done. Deleting your Treaxures account removes our records and the link to your account; it does not and cannot remove the chain entry.

Impact Passport and environmental estimates

The Impact Passport is private by default. It keeps transaction-linked records, confirmed actions, observations, journey completion, and qualified estimates as separate evidence types. It does not create a public composite status metric.

A walking-emissions comparison uses the recorded activity data, named baseline, factor version, assumptions, and methodology shown at treaxures.com/methodology/walking-emissions. It is not a measured reduction, offset, credit, or proof of neutral travel.

Travel-emissions and carbon-offset figures use their own factors and are governed by a separate methodology, which must be published and reviewed on the same terms before those figures are shown to a user or used in any claim.

Identity and creator verification

If you apply for creator, expert, business-partner, or payout status, we process the documents and references you submit for that check, the reviewer's decision, its scope, and its date. Verification names exactly what was checked and when; it is not an endorsement. Submitted document files are deleted from storage when the account is deleted (see the Data Deletion page); the record that a check happened is retained under §6.

Staff and administrative access

Treaxures staff can reach production data through an internal admin console. It is capability-scoped, requires multi-factor authentication, and writes an audit entry for every privileged read and action. Those audit entries are retained under §6.

3. Why data is used

Subject to the lawful bases and consent language approved by counsel, data is used to:

• provide authentication, catalogue, field, offline, messaging, session, Passport, support, and user-requested creator or partner workflows;
• protect accounts, enforce permissions, prevent fraud/abuse, moderate reported content and conduct, and maintain an audit trail;
• operate an explicitly enabled payment, store-billing, entitlement, booking, travel, marketplace, offer, product-handoff, refund, or payout flow;
• review sources, cultural context, routes, safety/access, media rights, commercial disclosures, corrections, and reports;
• deliver transactional communications and consented optional communications;
• monitor reliability and improve the service using governed analytics;
• meet valid legal, tax, accounting, consumer, and regulatory obligations.

Treaxures does not sell personal data or use it for third-party behavioural advertising.

4. Service providers

The final notice must list only providers that receive production data from the exact release, with each one's data location, subprocessors, transfer basis, and retention confirmed. Current candidates are:

Airlines, hotels, experts, sellers, and business partners are not Treaxures processors. They receive the data needed to fulfil what you asked for and act as controllers of it under their own notices.

5. Who can see data

Public clients can read only explicitly released public projections. Workspace members, contributors, partners, reviewers, and staff receive scoped access based on their role and task. Private originals, participant details, payment evidence, reports, and Passport records are not made public by default.

Some things you do are visible to other people by design, and it is worth being specific: messages and session chat are readable by the other participants; multiplayer voice is heard live by the session; a public profile, post, or eligible review is readable by anyone; a marketplace listing and its seller identity are public while listed; a booking is visible to the expert, business, airline, or hotel fulfilling it; and a minted collectible is public and permanent (§2).

Treaxures may disclose data to a provider for the documented service, to an accountable seller/provider needed to fulfil a user request, or when required by a valid legal process. The final legal notice must define each disclosure and the applicable safeguards.

6. Retention, deletion, and export

A category-level retention schedule exists in the platform, but its production values, statutory periods, deletion/anonymisation rules, backup expiry, legal holds, and owners are a release gate pending counsel and accountant approval. The app must show the approved schedule rather than hardcoded generic periods.

You can export or delete your account yourself from Profile → Settings ("Download My Data" and "Delete Account"). Deletion runs on a 30-day grace period and you can cancel it during that window. For access, correction, consent withdrawal, or a grievance, write to privacy@treaxures.com. Some financial, fraud, dispute, rights, or legal-hold records may need to be retained or de-identified; the final notice must state the exact approved rule.

Three categories cannot be fully erased on request, and the final notice must say so plainly: a public blockchain entry for a minted collectible and its IPFS copy (§2); a reservation held by an airline or hotel; and a store purchase record held by Apple or Google. Deleting your Treaxures account removes our copies and the account link, and you can pursue the rest with the party that holds it.

The Data Deletion page describes exactly what is deleted, what is detached from your account, what is retained, and when.

7. Children and guardian controls

The launch age threshold, notice, guardian-consent mechanism, paid-feature restrictions, and deletion/escalation process are not legally approved in this draft. The release must remain blocked until counsel confirms the experience against the law and store requirements that apply on the release date.

The threshold applies to more than sign-up. Counsel must specifically approve the position for in-app purchases and subscriptions, marketplace selling and payouts, digital-collectible minting, direct messaging and multiplayer voice with people who are not known contacts, travel booking, and the identity documents a creator or seller submits.

8. Security

Treaxures uses encrypted transport, provider-managed encrypted storage, row-level and capability-scoped access policies, short-lived private links, multi-factor protection for staff operations, secret management, audit trails, rate limits, and incident workflows. These controls reduce risk but do not make any system perfectly secure or by themselves establish legal compliance.

Report a suspected privacy or security issue to privacy@treaxures.com or support@treaxures.com. The counsel-approved incident notice will define required notification procedures and timelines.

9. Contact, rights, and grievances

Privacy requests: privacy@treaxures.com

Data-protection contact: dpo@treaxures.com

General support: support@treaxures.com Legal notices: legal@treaxures.com

Operator: ESPR Creative Lab Private Limited, Aizawl, Mizoram, India. Governed by Indian law; see §1 for the outstanding controller disclosures.

The final policy must state the rights, grievance path, regulator, jurisdiction, response periods, international-transfer basis, and effective date approved for the actual launch.

10. Open items before this notice can take effect

Named so nobody has to reconstruct them from the draft:

• counsel approval of lawful bases, notices, rights workflow, and effective date;
• the registered-office address and corporate identity number (§1);
• the named grievance officer and statutory response periods (§1, §9);
• the real-time communications provider for multiplayer voice, and its recording/retention position (§2, §4);
• the approved retention schedule, backup expiry, and legal-hold rules (§6);
• the children/guardian position for each capability listed in §7;
• confirmation of every provider in §4 against the exact signed release, including data location, subprocessors, and transfer basis;
• the reviewed travel-emissions and carbon-offset methodology, before any such figure is shown (§2).