What Tarn knows about you.

Tarn (tarnpermits.app) is a wilderness-permit and campground cancellation alert service. It is built and run by one person — Nick, not a company — who is responsible for the data described here; more about that on About. Tarn is not affiliated with Recreation.gov or any land agency.

• ·Your account. Email address, a bcrypt hash of your password (never the password itself), whether the email is verified, and when the account was created.
• ·Your trackers. The permits and campgrounds you watch: zones or sites, dates, party size, and filters. This is the service.
• ·Your alert channels. Only what you connect yourself — a Telegram chat id if you link the bot, and which channels you want on.
• ·Alerts we sent you. A log of which openings were sent to which tracker and when, so the same opening is never alerted to you twice.
• ·What you do with a tracker. When one is created, edited, paused or deleted, and — if it starts alerting a lot — that we showed you the one-time notice about it and which option you chose. If you tell us why you deleted a tracker, we keep that answer too; it is one tap from four choices and skipping it costs you nothing. This is how the notice knows it has already been sent, and how we learn whether that many alerts is helpful or just noisy.
• ·Sign-in records. The IP address and browser user-agent of each sign-in, registration and password reset. This is a security log: it is what lets us email you “a new device signed in” and spot an account being attacked.
• ·What you write to us. Feedback messages, the note on an invite request, and the email address you requested an invite with.
• ·Ordinary server logs. The web server records requests with IP address and user-agent, as every web server does.

Tarn never asks for, receives or stores your Recreation.gov login, and there is nothing to pay, so no card or billing details exist anywhere in the system.

To run the watch and deliver its alerts, to keep your account secure, and to answer you when you write in. Two things are read per tracker rather than in aggregate: how many alerts one of your trackers sent in the last day, which is what triggers the one-time “this tracker is very active” notice, and what you did with that tracker afterwards, which is how we tell whether the volume was useful. Everything else — whether the service is catching openings at all — we look at in aggregate. There is no profiling, no advertising, and no automated decision-making about you.

Nothing is sold, rented or traded. Ever. These are the only companies involved, each doing one job:

• ·Brevo — sends our email (alerts, verification, invites). It handles your email address and the message.
• ·Telegram — only if you link it; then your alerts travel through Telegram, under their privacy policy.
• ·Sentry — receives crash reports from the monitoring daemon so a silent failure doesn’t cost you a permit. It is configured not to attach personal data, though a stack trace can incidentally carry a value the code was handling.
• ·The server — a rented virtual machine in the United States. Your account, your trackers and the backups of them live there and are not copied anywhere else; what leaves the machine is the alert itself, going out through the services above. (The country is the part that matters if you are outside the US.)

Tarn also reads Recreation.gov, but that traffic goes out, not in: their servers are asked what is available, never told anything about you.

Four, all strictly functional and all short-lived except the first two. tarn_session keeps you signed in. tarn_device remembers a device you told us to trust, so it doesn’t ask for an email code every time. tarn_2fa lasts ten minutes and only exists between your password and the code that follows it. tarn_signup lasts a day and does one thing: if you open the confirmation link in the same browser you signed up in, it lets us finish the job instead of sending you back to a login form. No advertising cookies, no analytics cookies, no third-party scripts — even the fonts are served from our own server rather than fetched from anyone else.

• ·Account and trackers — until you ask us to delete them.
• ·Sign-in records and alert logs — for as long as the account exists; they go with it.
• ·Web-server logs — rotated daily and kept for 14 days.
• ·What you wrote to us — feedback goes with the account. An invite request (the address and note) is kept as the record of how access was granted; ask and it goes too.
• ·What you did with a tracker — kept with the account, and deleted with it. It outlives the individual tracker (that is the point: it records that one was deleted), but not you.
• ·Openings we detect — kept indefinitely, but they are facts about permits, not about you: a date, a zone and how many spots opened. No user is attached.

Do it yourself, in seconds: Account → Delete account. It asks for your password, then erases the account, your trackers, the log of alerts sent to you, the history of what you did with those trackers, your sign-in records and any feedback you sent. Your trackers stop watching immediately. There is no waiting period, no dark pattern and nothing to cancel first — and it cannot be undone. The invite request you signed up with stays unless you ask for it as well.

If you would rather a human did it, the Feedback button or a reply to any email Tarn has sent you works too.

Passwords are hashed with bcrypt and never stored or logged in the clear. The site is HTTPS only. Your session lives in an httpOnly cookie a script cannot read, and resetting your password signs every other session out immediately. Registration is invite-only, which keeps the user base small and known.

It is still a one-person service on a single server. If your account data were ever exposed, you would get an email from me saying what happened, promptly.

Tarn isn’t intended for anyone under 13, and accounts aren’t knowingly created for them.

If this policy changes, the date at the top changes. If a change materially affects what we collect or who we share it with, we’ll notify account holders directly. No silent rewrites.

The Feedback button inside the app, or the note field on an invite request — both reach me directly.