Trail Synk is in private beta. It runs on hardware operated
by the person who invited you, not on rented cloud infrastructure. Please
don't put anything here you couldn't stand to lose, and keep your own copy
of photos that matter to you.
What Trail Synk stores
Your account — email address, your name if you give one,
and a password hash. Passwords are hashed with PBKDF2-HMAC-SHA256; the
plaintext is never written down.
Trail-camera photos pulled from the camera accounts you
connect, along with what the software worked out about each one: species,
count, time, temperature, and moon phase.
Camera account credentials, so photos can be pulled on a
schedule. These are encrypted at rest with a key held outside the
database. They are used only to fetch your own photos.
A basic audit log of security-relevant actions — sign-ins,
password resets, sharing changes.
Who can see your photos
Only you, anyone you explicitly share a property with, and the operator who
runs this server. Accounts are separated at the database level, and photo
and camera URLs are checked against your account on every request rather
than merely being hard to guess.
What Trail Synk does not do
Your photos and data are never sold, and never shared with advertisers.
There are no third-party analytics or advertising trackers in the app.
Nothing is used to train an outside company's models.
Automatic species labelling
Most photos are labelled by models running locally on the server. When a
frame is genuinely ambiguous, that single image may be sent to Anthropic's
API for a second opinion. Anthropic does not train on data submitted
through the API. If you would rather no photo ever left the machine, tell
the operator and local-only labelling can be switched on for your account.
Deleting your data
Ask the operator and your account, photos, and stored camera credentials
will be deleted. Disconnecting a camera account removes its stored
credentials immediately. Because this is a beta on personally operated
hardware, deletion is handled by hand rather than through a button, and
backups may retain copies for a short period afterwards.
Security
Traffic is encrypted in transit. Sessions use signed, HTTP-only cookies,
form submissions carry CSRF tokens, and repeated failed sign-ins are
rate-limited. No system is perfect: use a password you don't reuse
anywhere else.