Consumer Health Data Privacy Policy
Some of what you record in Trunk can be about your health: a doctor's advice, a photo of a prescription, a note about how you felt. The law calls this consumer health data. Trunk doesn't look for it, sort it out, or work anything out from it.
What we collect, and how we use it.
We receive only what you keep in Trunk's cloud library, share by link, put in a private collection or publish, and what you write to us: recordings, transcripts, words read from photos, photos, frames from video, titles, summaries and notes. Any of it can include health information, such as a condition, a symptom, a diagnosis, a test, a treatment, a medicine, or the care you sought. With the cloud library off, what you record stays on your devices, and we receive only what you share, publish or write to us. We use what we receive only to give you what you asked for: to store it, keep it on all your devices, search it for you, keep it safe, and show it to the people you choose. Nobody at Trunk looks at a private library unless you ask for help or the law compels it, and every such look is recorded; ask, and we send you the record, unless the law forbids telling you, and then as soon as it allows. If a link or collection you shared is reported to us as illegal or abusive, we look at what was shared, and nothing else. We never use it for advertising, never sell it, never train AI on it, and never make voiceprints or face templates from it. We don't read data from Apple Health, and nothing comes in from another app unless you share it to Trunk yourself. We don't track where you go. When you ask for places near you, the app sends a rounded area, never your exact spot, and we keep nothing of it.
Where it comes from.
From you, when you keep, share or publish a memory, or write to us. From another person, when they share a memory with you.
What we share, and with whom.
Only what you choose to share, with the people you choose: anyone with a link you made, the members of a private collection you invited, or everyone, if you publish a story after a person at Trunk reviews it. When the law requires it, such as a court order, or a report of child sexual abuse material to the National Center for Missing & Exploited Children. Our service providers keep and carry it for us: Fly.io (our servers), Tigris (file storage), Google Workspace (email you send us) and Resend (notes from our contact form). We have no affiliates. No other company can collect information about you through our site or apps as you move across other sites.
Your rights.
- See it and take it: everything you keep is in the app, and Export gives you all of it from your devices, free. A suspended account, or one we hold after a report about a child's safety, can't download its cloud library, as our Privacy Policy says. You can also ask us to confirm whether we hold health data about you, to see it, and for a list of everyone we've shared it with and how to reach them.
- Correct it: ask us, and we correct health data we hold about you that is wrong, as our Privacy Policy says.
- Delete it: delete a memory, a link, a collection or your account in the app, or ask us. We delete it from our service, unless the law requires us to keep it, tell our providers to delete it, and it leaves our backups within 35 days. (A deleted memory waits 30 days in Recently Deleted unless you choose Erase Now, and a deleted account 30 days unless you choose Delete Now.) Any copy of a video in iCloud Drive › Trunk stays there until you delete it. Once we've confirmed it's you, we carry out a request to delete health data within 30 days, and tell everyone who holds it for us within that time. A deleted account's final deletion also waits while a report about one of its shared links or private collections is open, as our Privacy Policy explains. Our Privacy Policy also explains the waiting periods for copies kept after a report, and the time syncing and cleanup take. A link you shared from a memory keeps opening until it expires or you take it back. While you're signed in to the account that made the link, deleting a memory this iPhone made a link from also offers "Delete and Take Back Link", and Erase Now takes back the links this iPhone made from it and says so. Signed out, deleting or erasing the memory leaves its link open until it expires, or until you sign in and take it back. On the Mac, deleting or erasing a memory leaves its links open until they expire or you take them back in Profile, Links. Copies added to private collections stay until removed.
- Withdraw consent: turn on Pause Syncing in Settings, Cloud Library, on each of your devices. It stops new uploads to your cloud library, though one already under way can finish; what you choose to share yourself, by link or by publishing, still goes. To have your cloud copy removed, delete your account or ask us, and we remove it. The same retention and cleanup rules apply, as our Privacy Policy explains.
- How: email help@trunkhere.com from an address on your account, or write to Chase Color, Inc., 350 E 400 S #54472, Salt Lake City, UT 84111. We may ask you to sign in to confirm it's you. If you have no account, email us all the same: we'll confirm it's you another way, and you never need to make one. We answer within 45 days, or tell you within that time why we need up to 45 more. It's free, at least twice a year.
- Appeal: if we say no, reply to our answer to appeal. We'll look again and answer in writing within 45 days, with our reasons. If we still say no, you can complain to the Washington State Attorney General (atg.wa.gov/file-complaint) or the attorney general where you live.
Changes.
We post any change here before it takes effect, and we ask you first before collecting, using or sharing health data in a new way.