Privacy Policy

Last updated: 5 October 2026

This policy explains what personal data TrailSpark collects when you use the TrailSpark app for iOS and Android and the trailspark.com website (together, the "Service"), why we use it, who receives it, how long we keep it, and what your rights are.

1. Who is responsible for your data

Floris Bogaert (TrailSpark), who runs TrailSpark as an independent project from Belgium, is the controller of your personal data under the EU General Data Protection Regulation (GDPR). For anything about your data or this policy, email privacy [at] trailspark [dot] com.

2. What we collect, why, and on what legal basis

For each purpose below we name the GDPR legal basis we rely on: contract (Article 6(1)(b)), when we need the data to provide what you ask for; consent (Article 6(1)(a), and Article 9(2)(a) for health data), which you can withdraw at any time; legitimate interests (Article 6(1)(f)), when we need the data to run a secure and reliable service and this does not override your rights; and legal obligation (Article 6(1)(c)), when the law requires us to keep or disclose data.

Your account

To create an account we ask for your email address, a display name and a password. We store your password only as an Argon2id hash, never in readable form. If you sign in with Google or Apple instead, we receive your verified email address and your name from them (from Google also your profile picture; Apple may give us a private relay address instead of your email address). We never see your Google or Apple password. You can also add a short bio. To protect your account, we store a shortened IP address (only its network part: an IPv4 address without its last number, or the first 48 bits of an IPv6 address) and the browser or device details of your most recent sign-in, and the device name and browser details of each signed-in session.

Legal basis: contract for the account itself; legitimate interests (keeping accounts secure) for the sign-in details.

Location and activities

When you generate a route, search for a place or look for routes nearby, the app or website sends the start point you chose, or your current location, to our server to answer the request. If you are signed in, a route request is kept for up to 30 days. When you record an activity, the app uses your device's location, also in the background while the recording runs (your device shows that location is in use), and saves the GPS track with timestamps, distance, duration, elevation, pace, splits and laps, plus any name, notes or rating you add. Outside a recording, the app does not use your location in the background. Routes you save stay private unless you publish them. While you record, the app also sends your current location to our server to fetch trail condition reports within 2 km: at most every 90 seconds, and only after you have moved about 400 metres since the last lookup (see “Trail condition reports”).

Legal basis: contract: generating routes and recording activities is the service you ask for. Your device asks for your permission before the app can use your location.

Data stored on your phone

The app keeps your data on your phone so that it also works offline: your profile details (name, email address, bio and settings), your routes and activities with their GPS tracks, recordings in progress, changes waiting to be uploaded, your privacy choices and your last known location. Your sign-in tokens are kept in your phone's secure storage. If you use the app without an account, this data stays on your phone and is never sent to our server; when you later sign in, the app asks whether to add your routes and activities to your account and only moves them if you agree. When you sign out, the app removes your sign-in tokens and profile details from the phone but keeps your routes, activities and recordings, so that they are there when you sign in again. When you delete an activity in the app, the app also removes from the phone the raw recording data it kept for it, such as the full GPS track and heart-rate readings. Recordings you discarded, and activities you deleted with an earlier version of the app, keep their raw data on the phone until you remove the app's data or, if they belong to your account, until you delete your account in the app. With an account, the copy of an activity that the app sent to our server, including its simplified GPS track, stays on the phone even after you delete the activity, until you delete your account in the app or remove the app's data. With an account, if you delete an activity that has not been uploaded yet, the app still uploads it first and then deletes it from our server; if it cannot be uploaded, the copy waiting to be uploaded stays on the phone until you delete your account in the app or remove the app's data. Backups of your phone made before you deleted an activity may still contain it. A recording whose timing could not be confirmed can be saved on this phone only. It is not uploaded to our server and is not moved to your account when you sign in, so this phone and its backups hold the only copy. Deleting it in the app, deleting your account in the app, or removing the app's data removes it from the phone. When you delete your account in the app and our server confirms the deletion, the app erases everything it stored on the phone for that account: your profile details, routes, activities and recordings with their GPS tracks, heart-rate readings, changes waiting to be uploaded, privacy choices and last known location, and the copies of exported or shared activities in the app's temporary folder. If the app is closed before it has finished, it finishes the next time you open it. Data you recorded without an account, or under another account on the same phone, is not affected. This happens only when you delete the account in the app and our confirmation reaches the app. If you delete your account on the website, or the confirmation is lost (for example because the connection drops), the data stays on the phone: to remove it, uninstall the app or clear its storage in your phone's settings. The erasure does not remove workouts the app exported to Apple Health (delete those in the Health app), downloaded offline maps and app settings that are not tied to your account, data left by older app versions that cannot be tied to an account, or temporary files and caches kept by the system or by software the app uses, such as image and map caches, crash-report data and the notification token (our servers delete their copy of that token when you delete your account). Your phone's own backups (Google backup on Android, iCloud or a computer backup on iPhone) include the app's data, except downloaded offline maps; those backups are kept under your Google or Apple account and we cannot delete them. A backup made before you deleted your account therefore still holds the data it contained, and restoring it puts that data back on the phone.

Legal basis: contract: keeping your data on your phone is part of how the app works, also offline.

Heart rate (health data)

If you connect a Bluetooth heart-rate sensor or an Apple Watch, the app can record your heart rate during a workout. Heart rate is health data, a special category of personal data under Article 9 GDPR, so we process it only if you switch on "Use my heart-rate data" under "Privacy & learning" in the app. It is off by default, and in the current test version of the app it cannot be switched on yet. That switch is under "Advanced" and appears only while an Apple Watch is paired with the app (or while it is already on, so you can always switch it off). Without it, the app does not connect to heart-rate sensors, the Apple Watch app does not send your heart rate to your phone, no heart rate is stored with your activities, and our server discards any heart-rate values it receives. With your consent, we store the individual heart-rate readings of a workout encrypted on our servers, and its average heart rate, maximum heart rate and heart-rate drift together with the activity. We never show your heart rate to other users and never use it for advertising. Community statistics derived from workouts are only ever published as anonymized aggregates of at least 10 people. You can withdraw your consent at any time in the same place; heart rate is then no longer recorded, and the heart-rate readings stored on your phone are deleted. Heart-rate data already stored on our servers is deleted when you delete its activity or your account, and individual readings are deleted after 6 months at the latest (see "How long we keep your data" for backups).

On iPhone, if you switch on syncing with Apple Health in the app's settings, the app writes each completed workout there: its type, start and end time and distance. Apart from the live heart rate that the Apple Watch app reads during a workout once you allow it on the watch (see above), the app never reads data from Apple Health. This setting is off by default. The Android app does not connect to Health Connect.

Legal basis: your explicit consent (Article 9(2)(a) and Article 6(1)(a) GDPR).

Route suggestions and learning

We generate route suggestions automatically from the start point and settings you choose, such as distance, activity, surface and elevation, and from the preferences in your profile. If you give a suggested route a thumbs up or down in the app, we store that rating with your account, together with the route's start point, its distance and the scores we calculated for the route, such as terrain, challenge, scenery and shade. Two optional features would also learn from what you do: "Learn from my runs" would send how you actually used a route, for example where you left it or paused, to personalise your suggestions, and "Share anonymized data" would let your data count towards other people's suggestions and community statistics. Both are off by default and cannot be switched on in the current test version, so the app does not send this information and your ratings are not used to change your own or anyone else's suggestions. If they become available and you switch on "Share anonymized data", your data will only be used in aggregates of at least 10 people. One such aggregate averages the scores of the routes rated positively in the last 90 days that start within about 15 km of a start point; each person counts once, only ratings given after you switched the option on count, your own ratings never shape your own suggestions this way, and the average does not show who gave a rating. Under "Privacy & learning" you can choose "Non-personalized recommendations" or "Object to automated profiling"; in the current version the app cannot undo these two choices, so email us if you want them reversed.

Legal basis: contract for suggestions based on your own settings and preferences; consent for route learning, personalised suggestions, the area average of ratings and community statistics.

"Can't pass" reports

If you use "Can't pass" to report that a path is blocked, we store the report (the path, its location, the reason and any note you add) with your account. The feature that avoids reported paths in routes is not switched on yet, so for now a report does not change any route. Reports of a temporary obstacle expire after 30 days; others stay until you delete them or your account. Public notes on OpenStreetMap are not switched on either; once they are, when at least 10 different users report the same path as permanently impassable, we may post a public note there that says how many TrailSpark users reported it and why, without any details about them.

Legal basis: contract for avoiding the path in your routes once that feature is switched on; legitimate interests for keeping your report and for the anonymous OpenStreetMap note.

Public routes, reviews and privacy zones

A route you publish, and any review or photo you post on a public route, can be seen by anyone, including visitors who are not signed in, together with your display name. To protect places such as your home, other people by default do not see the part of a published route near its start and end: it is hidden inside a zone of 300 to 500 metres, placed at random, that always covers at least 200 metres around each end. You always see your whole route. Social features such as following, kudos, comments and public profiles are currently switched off, and while they are off, new activities are private. A preference profile that you share with the community can also be seen by anyone; it shows your name only if you have chosen to be credited.

Legal basis: contract: publishing a route or review is something you choose to do.

Trail condition reports

In the app you can report the state of a trail, for example that it is muddy, flooded or closed. We store the condition, a severity from 1 to 3, an optional note of up to 500 characters, the place and radius you choose or the route it applies to, and the time. A report is public: anyone, including visitors who are not signed in, can see its condition, severity, note, location and time, but not your name or account. A report is shown for 30 days, after which it is no longer shown to anyone; the record itself stays with your account until you delete the report or your account.

Legal basis: contract: posting a report is something you choose to do; legitimate interests for looking up nearby reports while you record.

Group runs

In a group run, the members see each other's display name, live position and battery level while the session runs; a session ends after at most 8 hours. The host can create a public link that shows the members' names and latest positions to anyone who has the link, until the session ends. We store only each member's most recent position and battery level, not a track, and only while that member takes part: both are cleared when the member leaves or the session ends. The record of the session and of who took part stays until you delete your account.

Legal basis: contract: you choose to host or join a group run.

SOS and emergency contacts

You can save emergency contacts: a name and an email address, and optionally a phone number and your relationship. Please add only people who agree to be contacted. If you trigger an SOS alert, we email your contacts your display name, the time, your location with a map link, and a tracking link; contacts who use TrailSpark with the same email address also get a push notification. While the alert is active (at most 4 hours), the app sends your position and battery level. Anyone who has the tracking link can see your display name and your latest positions for 7 days after the alert. Contacts stay until you remove them; alerts and their positions are kept until you delete your account.

Legal basis: contract for you (a safety feature you set up); legitimate interests for your contacts' details, so that we can reach them in an emergency.

Push notifications

If you allow notifications, we store a device token from Firebase Cloud Messaging (Google), which delivers our notifications on Android and, through Apple's push service, on iOS. We send notifications about SOS alerts, new followers and kudos, and occasional reminders to get outside that mention the weather at the start of your last activity. Stored device tokens are deleted automatically after 90 days, when they stop working, and when you delete your account. You can switch notifications off in your device settings at any time.

Legal basis: consent, which you give through your device's notification permission.

Emails

We send the emails the Service needs: to verify your email address, to reset your password, to warn you when your account is signed in on a new device (with the shortened IP address and device type of the new sign-in, and the shortened IP address of the previous one), and about data export requests. We may also send a few emails to help you get started; each one has an unsubscribe link. If you subscribe to updates on our status page, we use your email address only for those updates.

Legal basis: contract for the emails your account needs; legitimate interests for security alerts and getting-started emails; consent for status-page updates.

Strava (accounts connected earlier)

Strava connection and import are not available in this version of TrailSpark, and the app does not sync with Strava. If you connected your Strava account in an earlier version, we still store an OAuth access token and refresh token, encrypted, together with your Strava athlete ID and the permissions you granted, which that version used to import your Strava activities into TrailSpark and to upload the activities you chose to send to Strava. We request read and activity read/write scopes (read, activity:read, activity:write); we do not request access to your private activities (activity:read_all). An import fetches your whole Strava activity history. For each imported activity we store its Strava ID, name, type, distance, moving time (or elapsed time if moving time is missing), elevation gain, start time, average temperature and a simplified route line, but not your heart rate, power or photos. Imported activities are private and shown only to you. They count towards your own statistics, heat map, achievements and streaks and your personal pace estimates, and they help choose the area for your own route suggestions and reminder notifications. They are not used for other people's suggestions, for community statistics or for route learning. You can disconnect Strava at any time in the app's settings, which immediately deletes your stored tokens and asks Strava to revoke our access; if Strava cannot be reached, we keep the encrypted access token only to retry that request. If you remove our access on Strava's website instead, we are not notified, so please also disconnect in the app. Activities already imported stay in your TrailSpark account until you delete them or your account.

Legal basis: contract: you connected Strava in an earlier version; we process what is stored only so you can disconnect it (Settings → Strava).

Offline maps

When you download an offline map region, we record which regions your account has downloaded and when you last used them, so that we can deliver updates. The app also sends anonymous reliability reports about offline maps, such as the region, download and search timings, result counts and errors. These reports are not linked to your account and contain no location or search text. When you are offline, searching and generating routes in a downloaded region happen on your device.

Legal basis: contract for delivering map updates; legitimate interests for the anonymous reliability reports.

Crash reports and diagnostics

The app, the website and our server send error reports to Sentry, and the app and server also send a sample of performance measurements. A report contains technical details such as the error, the app version, the device model and the operating system; reports from the app, and from the website while you are signed in, also carry your account ID, a random identifier that is not your name or email address. Before a report leaves your phone, the app removes email addresses, access tokens and coordinates, and it never attaches screenshots. The app contains no advertising or analytics SDKs.

Legal basis: legitimate interests in finding and fixing errors.

Weather and approximate location

To show a weather forecast, our server asks Open-Meteo, a weather service, for the forecast at the location concerned, rounded to about 11 km and without anything that identifies you; the reminder notifications described above use the start point of your last activity, rounded to about 1 km. The website chooses metric or imperial units from your device's time zone and language settings, without looking up your IP address. To centre the map on the website's route planner and explore pages before you share your location, our server may estimate your approximate area (to about 11 km) from your IP address, using the IP geolocation database of DB-IP (db-ip.com) that runs on our own server; the address is not stored and is not sent to anyone.

Legal basis: contract for the weather you ask to see; legitimate interests for the reminders and for centring the map.

Website analytics

We use self-hosted Umami analytics on trailspark.com to understand how the site is used. Umami sets no cookies, does not track you across other sites, and we never use it for advertising. What we collect: the page you visited (without its search parameters or link fragment); the address of the page you came from — another website's page if you arrived from outside trailspark.com, or the previous page if you moved between pages on trailspark.com — always without its own search parameters or fragment; your screen size, browser language, and the page's title; and your browser, operating system, device type and approximate location (country, and depending on server configuration, region or city). We also record a small number of product events for every visitor, in general terms only — for example, that a route was generated, saved or exported, that you signed in or registered (and with which method), or how many results a search returned — never route coordinates or search text. We process this data on the basis of our legitimate interest (GDPR Article 6(1)(f)) in understanding and improving the Service, and keep it for 13 months, after which it is deleted. Analytics does not load at all if your browser sends a Do Not Track or Global Privacy Control signal.

Cookies and browser storage

We use cookies to remember your language and keep you signed in, plus temporary cookies to secure sign-in. We don't use cookies for analytics — see "Website analytics" above. The website also keeps a few settings, such as your theme and units, and your sign-in state in your browser's local storage. These are needed for the website to work and are not used to track you.

Server logs

Our web server logs each request with a shortened IP address (the last part is removed), the time, the address requested, which can include a search term or map coordinates, the page you came from and your browser type. Its error log can contain your full IP address. Our application logs are limited in size, so older entries are overwritten after a few weeks. We use these logs to keep the Service secure and working.

Legal basis: legitimate interests in security and reliability.

3. Who receives your data

We never sell, rent, or trade your personal data to third parties for marketing or advertising purposes.

We use these services:

Hetzner Online (Germany) — hosts our servers and database in its data centre in Helsinki, Finland, and our encrypted backups and map data in the EU.
Firebase Cloud Messaging (Google) — delivers push notifications. It receives your device token, a Firebase installation identifier with basic technical information about the app and your device, and the notification content. We do not use Firebase Analytics or any other Firebase service.
Resend — delivers our emails. It receives the recipient's email address and the message.
ImprovMX (email forwarding) and our mailbox provider — when you email our privacy or support address, ImprovMX forwards your message to our mailbox. They receive the sender's email address and the message.
Sentry — processes error reports and performance measurements (see "Crash reports and diagnostics"). Reports from the website and our server are stored in Sentry's EU data region, in Germany.
MapTiler (Switzerland) — provides satellite imagery and some map styles. Our standard maps come from our own servers. When you show satellite imagery, or browse regions on the app's offline-maps screen, your device loads these maps directly from MapTiler, which receives your IP address and the map area you view.
Open-Meteo — provides weather forecasts. Our server sends it the location concerned, rounded to about 11 km and without your account or device details (see "Weather and approximate location").
MapLibre demonstration map (demotiles.maplibre.org) — only if our own map server cannot be reached, the website shows this basic map instead; your browser then loads it directly, which shares your IP address and the map area you view.
Cloudflare — redirects links on our former domain trailspark.app. If you follow an old trailspark.app link, Cloudflare receives your IP address, your browser details and the address you requested. If you reply to an email we sent from that domain, Cloudflare Email Routing also receives your email address and your message.

Others receive data only where you choose it or the law requires it:

Google and Apple, if you sign in with them — they confirm your identity to us, and our server checks your sign-in token with them, under their own privacy policies. If you sign in with Google, your profile picture is loaded on the website directly from Google’s servers, which receive the IP address of whoever views it.
Strava, only for an account connected in an earlier version: when you disconnect it, we ask Strava to revoke our access (see "Strava (accounts connected earlier)").
Apps you choose — when you export or share a route or activity, for example as a GPX or FIT file or with "Send to Garmin Connect", your phone hands the file to the app you pick, such as Garmin Connect, under that app's own terms. An exported activity contains its GPS track with times and any heart rate stored with it.
Wikimedia Commons — some place pages on the website and in the app show photos that your browser or the app loads directly from Wikimedia, which receives your IP address.
People you choose: your emergency contacts, the members of your group run, anyone you give a group-run or SOS tracking link, and anyone who views a route or review you published.
Authorities, only where the law requires us to disclose data (legal obligation).

4. Transfers outside the EU

Our servers and backups are in the EU. MapTiler is in Switzerland, which the European Commission recognises as offering an adequate level of data protection. Google, Apple, Resend, Sentry, Strava, ImprovMX, our mailbox provider, Cloudflare and Wikimedia are based in, or may process data in, the United States or other countries outside the European Economic Area, and the MapLibre demonstration map may do so too. Where personal data goes to a country without such an adequacy decision, the transfer relies on the safeguards in the provider's data-protection terms: the EU–US Data Privacy Framework for certified US companies, or the European Commission's Standard Contractual Clauses.

5. How long we keep your data

Your account, routes, activities, ratings, emergency contacts, SOS alerts, group-run data and Strava imports: until you delete them or your account. Heart-rate data: averages stay with their activity until you delete it or your account; individual heart-rate readings are deleted after 6 months.
When you delete your account, we erase it from our live database straight away: your routes, activities, heart-rate data, preferences, device tokens, emergency contacts, alerts and group-run data are deleted, and your name, username, email address, password, bio, profile picture, sign-in IP address and two-factor settings are wiped from your account record. That record itself stays, empty: it keeps only an internal account number, when the account was created, last signed in and deleted, how you signed in (for example with Google), whether your email address was verified, any invitation, lock or suspension details, and app settings such as your language and units. It stays so that our internal records that refer to that number, including the record of the deletion itself, remain consistent. Comments and segments you created stay, without your name. A status-page subscription stays until you unsubscribe. We keep a record of the deletion, containing only internal identifiers, for as long as our backups exist plus 90 days, so that the deletion can be applied again if a backup is ever restored. Data stored on your phone is covered in "Data stored on your phone".
Our database backups are encrypted and used only for disaster recovery. We keep daily copies for 30 days and monthly copies for 12 months, so data you delete is gone from all backups within 12 months at most.
Route requests of signed-in users: 30 days. In-app notifications: 90 days. Push device tokens: at most 90 days. SOS tracking links: 7 days. Group-run sessions: at most 8 hours; members' positions are cleared when a session ends.
The shortened IP address (network part only) and the browser or device details of your most recent sign-in: replaced at each sign-in and kept while your account exists.
Trail condition reports: shown for 30 days; the record stays with your account until you delete it or your account.
Server logs: access logs with shortened IP addresses, 90 days; error logs, which can contain your full IP address, 14 days; application logs, overwritten after a few weeks.
Website analytics: 13 months, as described in "Website analytics".
Error reports at Sentry and emails at Resend: kept for the provider's retention period, after which the provider deletes them.

6. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw your consent at any time (this does not affect processing that took place before). You can do most of this yourself:

Delete your account — in the app under Settings → Account settings → Delete account, or on the website under Settings. See "How long we keep your data" for what happens next.
Correct your details — change your display name, bio and password in your account settings.
Take your data with you — download any of your routes as GPX (in the app also in other formats, such as FIT) and any of your activities as GPX.
Withdraw consent or object — choose non-personalized recommendations or object to automated profiling under "Privacy & learning" in the app (in the current version the app cannot undo these two choices, so email us to reverse them), and switch heart-rate use and route learning off there if you switched them on in an earlier version; switch notifications off in your device settings; disconnect Strava in the app's settings.

For anything else — for example a copy of all the data we hold about you, a change of email address, or restricting processing — email privacy [at] trailspark [dot] com. We may ask you to confirm that the request comes from you, and we reply within one month.

You also have the right to lodge a complaint with a data protection authority. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), www.dataprotectionauthority.be. You can also contact the authority in the EU country where you live or work.

7. Do you have to give us your data?

No. You can use the app as a guest, without an account, to plan routes and to record and save activities on your phone. To save routes and activities to an account, you need to give us an email address (directly or through Google or Apple) and a display name; without them we cannot create your account. Location access is needed to record activities and to start routes where you are, but you can also search for a start point instead. Everything else is optional: heart rate, route learning, notifications, emergency contacts, group runs and publishing routes.

8. Automated decision-making

Route suggestions are generated automatically, as described in "Route suggestions and learning". They only decide which routes we propose to you; they have no legal effect on you and do not affect you in a similarly significant way, so we make no automated decisions within the meaning of Article 22 GDPR. You can always change your settings, choose non-personalized recommendations or object to automated profiling.

9. Security

All communication between your device and our servers is encrypted with TLS (HTTPS). Passwords are hashed with Argon2id, a modern memory-hard algorithm. Sign-in uses access tokens that expire after 15 minutes and refresh tokens that we store only as hashes. Heart-rate readings and Strava tokens are stored encrypted, and our backups are encrypted. Access to production systems is restricted to authorized personnel only.

10. Children's privacy

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or an in-app notice. The "Last updated" date at the top reflects the most recent revision.

12. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, email us at privacy [at] trailspark [dot] com.