Privacy Policy

Last Updated: October 14, 2026

This policy covers one app: Park Ledger, on Android, iPhone and iPad. It is a checklist and map of the National Park System units you have visited, with a place for photos of your passport cancellation stamps and of the trip itself, a trip journal, a wish list, goals to work towards, and stats. Our other apps are covered by the general Illumination Development privacy policy, which does not apply here. That policy describes reward balances and redemption records that this app does not have.

Park Ledger is an independent app. It is not made by, endorsed by or affiliated with the National Park Service or any passport program. The park list and the state outlines it shows are public-domain data from the National Park Service and the US Census Bureau, bundled inside the app, so looking up a park sends nothing anywhere.

The short version

There is no account and no sign-in. The parks you check off, your visit dates, notes, ratings and the names of who came along, your trip journal, your wish list, and your stamp and trip photos are stored on the phone and nowhere else. There is no sync, no cloud backup of ours and no server holding a copy. We never receive any of it. If you make a backup file, it goes only where you send it.

The camera and photo library are used only for the photos you add to a park — passport stamps and pictures from the trip — and only when you choose to add one. The photo is kept inside the app on the phone and is never uploaded. The app does not ask for your location, your contacts or the microphone, and there is nothing to buy.

What does leave the phone is advertising, usage analytics and crash reports, plus a support message if you choose to send one. Each is described in full below. Park Ledger is meant for adults and families planning trips and is not child-directed, so its advertising can be personalized where the law and your choices allow it.

What stays on the phone

• Your ledger — which parks you have checked off as visited, the dates of each visit if you added any, and the notes you wrote about a park.
• The details of each visit — the star rating you gave a park, the names you added of the people who came along, and whether you earned the Junior Ranger badge there.
• Your trip journal — each trip's title, its first and last days, the parks it took in, and your notes on it.
• Your wish list — the parks you have starred to see next.
• Your stamp photos and trip photos — described in the next section.

The ledger is kept as one record in the app's private storage, and the photos in a folder beside it. Your stats, your map, the counts on the home screen and your goals are worked out from that record on the phone each time; they are not stored or sent anywhere. The names of the people who came along are yours alone: they are used only to show who you have visited parks with and to suggest a name you have typed before, and they never leave the phone except inside a backup file you choose to send. If the phone backs itself up to iCloud or to Google, that copy is governed by Apple's or Google's terms and your own backup settings, and we have no access to it. Uninstalling the app, or using Delete my data, removes everything listed here.

Camera and photos

On a park's page you can photograph the cancellation stamp in your passport book, and add up to 12 photos from the trip itself. Either kind can be taken with the camera there and then, or picked from photos you already took. Those are the only things the camera and the photo library are used for.

• Taking a photo opens the camera only when you tap to take one. On iPhone and iPad, the system asks for camera permission the first time. On Android, the app hands the job to your phone's own camera app and does not hold a camera permission itself.
• Choosing a photo opens the system photo picker. Only the photo you pick is given to the app; it cannot browse the rest of your library.
• The photo is scaled down, saved as a copy in the app's own storage on the phone, and filed under that park with the date it was added. Stamp photos and trip photos are kept in the same folder and treated the same way. The original in your photo library, if it came from there, is left untouched.
• Photos are never uploaded, never sent to us, and never included in analytics or crash reports. The app does not read a photo's location or any other details stored with it.

Removing a stamp or a trip photo deletes its copy from the app. Un-checking a park you had visited deletes that park's stamp and trip photos too, which is why the app asks you to confirm it first.

Sharing your map and goals

Share your map makes a picture of your map with your counts on it (how many park sites, national parks, and states and territories you have visited) and hands it to your phone's own share sheet. The picture is made on the phone and shown to you before you send it. Where it goes from there is up to you and the app you pick; we do not receive a copy, and the app keeps no copy after the share sheet closes. Your notes, trips, companions and photos are never part of it.

When you finish a goal, you can share a card for it in the same way. The card shows the goal's name, the date you completed it if the app knows it, and the parks that goal took, and for a goal that counts parks, your overall count. It is made on the phone, shown to you before you send it, and handed to the share sheet; we do not receive it.

Goals and nearby parks

The milestones and challenges on the Goals tab, and the parks the app lists as nearby, are worked out on the phone from the park list bundled inside the app and from your own ledger. Nothing is looked up online to produce them. Nearby parks are measured from one park's map pin to another's, never from where you are: the app does not use your location for this or for anything else.

Backup and restore

Settings → Backup lets you move your ledger to a new phone, or keep a copy of it somewhere safe. Backing up puts your ledger and the photos it refers to into a single .zip file on the phone and hands that file to your phone's own share sheet, just like sharing your map. The app sends it nowhere itself: it goes only where you choose to send it, such as your own email, a cloud drive or a message to yourself. Once you have sent it, that copy is held under the terms of the service you sent it to, and we have no access to it. The app deletes its own working copy as soon as the share sheet closes.

Restoring opens the system file picker, so the app sees only the one file you choose. The app checks that it is a Park Ledger backup, shows you what it holds, and asks you to confirm. Restoring replaces the ledger and photos on the phone with the ones in the file; it does not merge them. Nothing is sent anywhere while this happens.

A backup file contains everything in your ledger, including your notes, the names of the people who came along, and your photos, so treat it as you would the photos themselves.

What the app sends

None of what follows includes your name, an email address, a note you wrote, a trip title, the name of anyone who came along, a photo, the contents of a backup, or which parks you have been to.

Usage analytics

The app reports a small set of events to Google Analytics, each with only the details listed here:

• which screen is open (the splash screen, the home screen or Settings), and which of the five home tabs you opened (Checklist, Stamps, Trips, Stats or Goals);
• how long the app took to start, in milliseconds;
• that a park was checked off, with only the kind of park it was (for example, a national park or a national monument, from a fixed list of 21 kinds) and whether a date was added. The park itself is deliberately left out, so no one's travels appear in a report;
• that a park was un-checked, that a visit date was added, that a note was saved (never the note itself), and that a park was added to or taken off the wish list;
• that a stamp photo was added, and whether it came from the camera or the photo library; and that a stamp photo was removed;
• that a trip photo was added, and whether it came from the camera or the photo library; and that a trip photo was removed;
• that a star rating was set, with the number of stars (0 to 5) but not the park; that a companion was added, never with the name; and that the Junior Ranger badge was ticked or un-ticked, again without the park;
• that a trip was saved, whether it was new, and how many parks it took in (0 to 9, or 10 and over); and that a trip was deleted;
• that a park was opened from another park's list of nearby parks, and that a nearby suggestion was added to a trip, in both cases without naming either park;
• that a goal's list was opened, that a goal was completed, and that a goal's card was shared, each with only the kind of goal it was (a challenge, a park count, a designation or a state), never which goal;
• that the map was shared through the share sheet;
• that a backup was made and shared, or that one was restored, with only rough counts of the parks and photos in it, grouped into ranges (none, 1 to 9, 10 to 49, 50 to 99, or 100 and over);
• that the privacy policy was opened;
• that a change could not be saved on the phone, so we can tell that something is going wrong.

The app also records which kind of build it is (for example, a release build) as a property. There is no user ID: the app has no accounts, and nothing ties one installation's events to anything else. Alongside those events, Google Analytics collects its own app-instance identifier, coarse device information such as the model, the operating system version and the app version, and an approximate location that Google derives from the IP address. The app itself never asks for location. We use analytics to see which parts of the app are used and where it goes wrong, and for nothing else.

Crash and diagnostic reports

If the app crashes or hits a handled error, Google Crashlytics sends a report: the stack trace, the app version, the device model and operating system, and Crashlytics' own installation identifier. This is how bugs get found. Analytics and crash reporting are both switched off in development builds.

Advertising

The app is free and carries advertising from Google AdMob and no one else. There is one placement: a banner at the foot of the home screen. There are no full-screen advertisements, no rewarded advertisements, and there is nothing to buy.

To serve advertisements, the Google Mobile Ads SDK contacts Google and may collect device and advertising information: an advertising identifier (Google's advertising ID on Android, and Apple's Identifier for Advertisers on iPhone and iPad if you allow it), device signals, an approximate location derived from the IP address, and the request, impression and click themselves. We never see this identifier, and it is not connected to anything in your ledger.

Advertisements in this app can be personalized, where the law and your choices allow it. Unlike our games for children, this app is not child-directed and does not ask Google to switch personalization off; the choices below are how you limit it. Google's use of the information it collects is governed by Google's own privacy policy.

On iPhone and iPad: the tracking prompt

The app shows Apple's App Tracking Transparency prompt when it starts, before any advertisement is requested. If you choose Ask App Not to Track, the app never receives Apple's Identifier for Advertisers and advertising continues without it. You can change your answer at any time under iOS Settings → Privacy & Security → Tracking.

On Android: the advertising ID

The app asks for no runtime permissions at all. Adding a photo uses Android's own camera app and photo picker, and choosing a backup to restore uses the system file picker; none of them needs a permission from the app. The advertising-ID permission is present, because the Google Mobile Ads SDK and Google Analytics declare it, and it is used for advertising and analytics. You can reset or delete your advertising ID, or opt out of personalized ads, in your device's settings — on most phones, Settings → Privacy → Ads, or Settings → Google → Ads.

In the EEA, the UK and Switzerland

Where a consent regime applies, Google's consent message is shown before any advertisement is requested, and it asks for your choices about personalized advertising and the storing of and access to information on the device.

You can change your answer at any time — Settings → Ad privacy options reopens the same choices. That entry appears only where Google reports that a consent regime applies, which is why people elsewhere will not see it. Your consent decision is stored on your device by Google's consent SDK.

Rating prompt

When you check off your 10th park, and again at your 40th, the app asks Apple or Google to show their standard rating prompt. The store decides whether it actually appears, and anything you write in it goes to the store under the store's own terms, not to us.

Contacting support

Settings → Contact support opens your own email app, addressed to support@illuminationdevelopment.com. The app attaches nothing to it: what we receive is exactly what you write and send, from the address you send it from. We use that address to reply to you and for nothing else.

Delete my data

Settings → Delete my data does these things, in this order, immediately and without asking us:

• It deletes every stamp photo and trip photo saved in Park Ledger on the phone, along with any backup file still waiting in the app for the share sheet.
• It permanently erases your ledger on the phone — every park you checked off, with its dates, notes, ratings, companions and Junior Ranger badges, your trip journal and your wish list — and the date of your last backup.
• It resets the Google Analytics identifiers held on the phone, so later analytics start from a new app-instance identifier.

Because everything Park Ledger keeps is on the phone, this works offline, and there is nothing on a server for us to delete. It cannot reach photos still in your phone's own photo library, map images or goal cards you have already shared, backup files you have already sent somewhere, or emails you have already sent us.

Analytics events and crash reports already sent to Google before you pressed it are kept by Google under its own retention periods, keyed to identifiers that no longer lead back to this installation. If you want those looked at as well, or want a support message you sent deleted from our inbox, write to privacy@illuminationdevelopment.com.

What the app does not do

• No account, no sign-in, and no upload or sync of your ledger, trips or notes.
• No upload of your photos, ever. A backup file leaves the phone only through the share sheet, when you send it.
• No location permission. The app never looks up where you are, not even to find nearby parks; the only location involved is the approximate one Google derives from the IP address, described above.
• No access to contacts, the microphone, your calendar or health data. The names of people who came along are typed in by you, not read from your contacts. The camera and photo library are used only when you choose to add a stamp or trip photo, and only for that photo.
• No in-app purchases, no rewards and nothing for sale.
• No chat, no friends list, and no way to reach another person through the app other than the share sheet you choose to open.
• No advertising network other than Google AdMob.
• We do not sell personal information. The advertising described above may count as sharing for cross-context behavioral advertising in the sense the CCPA and CPRA give that term; declining the tracking prompt, resetting or deleting your advertising ID, and opting out of personalized ads are how you limit it.

Children

Park Ledger is a travel log for a general audience and is not directed at children. Its advertising requests are not flagged as child-directed, and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us personal information, for example in a support email, write to privacy@illuminationdevelopment.com and we will delete it.

Your rights

Under the GDPR, the UK GDPR, the CCPA and CPRA, and comparable laws elsewhere, you have rights to access, correct, port and delete the personal information a company holds about you. Your ledger and photos are on your phone, where you can see and change them in the app, take a copy of them with Backup, and erase them with Delete my data. The only thing this app gives us that names you is a support message you chose to send. For that, or for data Google holds from analytics, crash reports or advertising, write to privacy@illuminationdevelopment.com. Information Google holds from running those services is subject to Google's privacy policy and the controls described above.

A note about this web page

The app does not display this page — tapping Privacy Policy in Settings opens it in the phone's browser, and this website uses Google Analytics to see which pages people find useful. That is described in the general policy, and it applies to your visit to this page, not to your use of the app. The app and this policy are in English.

Changes to this policy

If any of this stops being true, this page changes before the version that changes it reaches either store, and the App Store privacy label and Google Play Data safety form change with it. Revisions are posted here with an updated date.

Contact

Email: privacy@illuminationdevelopment.com

You can also reach us through our contact and support page.