Privacy Policy

My Trail Log (“we”, “us”, “our”) is a trail tracking service that helps you track your progress along Britain's long-distance trails using your Strava activity data. This policy explains what data we collect, how we use it, and your rights regarding it.

We take your privacy seriously. We collect only what we need to provide the service, we never sell your data, and you can request deletion at any time.

When you connect your Strava account we request read access to your activities. We store the following:

• Strava profile information - your name, Strava username, and profile picture URL, so we can display your account in the dashboard.
• Activity metadata - the name, type (run, walk, hike, etc.), date, and distance of each activity.
• GPS route data - the encoded polyline of each activity, which we decode into a geometry stored in our database. This is the GPS trace of where you went.

We do not collect your heart rate, power data, photos, comments, kudos, or any other Strava data beyond what is listed above.

If you grant activity:write permission (optional, for automatic description updates), we also store a record of which activities have had their descriptions updated, but we do not store the description text itself.

The GPS geometry of your activities is the core of the service. We compare it spatially against the official routes of Britain's long-distance trails to calculate how much of each trail you have covered, which sections you've completed, and your overall progress.

Profile information and activity metadata are used solely to display your dashboard, identify your account, and present your activity history in a meaningful way.

We do not use your data for advertising, profiling, or any purpose beyond providing the trail-tracking service.

We do not use your Strava data to train, develop, evaluate, or operate any artificial intelligence or machine learning models.

Our legal basis for processing your personal data is consent, as defined under UK GDPR Article 6(1)(a). You provide this consent explicitly when you click “Connect with Strava” and authorise the OAuth permission screen that Strava presents.

You can withdraw consent at any time by disconnecting My Trail Log from your Strava account in Strava's connected apps settings, which deletes your data immediately and automatically (see below) - no separate request needed.

We retain your data for as long as your account is active - that is, as long as you continue to use the service. If you have not logged in or synced your activities for 12 months, we may delete your account and associated data.

If you revoke My Trail Log's access in Strava's connected apps settings - or use the Disconnect & Delete My Data button in the app - your data is deleted immediately and automatically. There is no waiting period and no separate request needed for this path.

If you instead request deletion by emailing us (see below), we will complete that within 30 days.

Anonymised, aggregate statistics (e.g. total number of users who have walked the Pennine Way) that cannot be linked to any individual may be retained indefinitely.

We do not sell, rent, or share your personal data with any third parties for their own purposes.

Your data is processed by the following sub-processors solely to operate the service:

• Supabase - our database host (PostgreSQL, hosted in the EU). Your GPS and activity data is stored here.
• Strava - the source of your data. We interact with the Strava API to read your activities. Strava's own privacy policy governs your relationship with Strava.

We do not use Google Analytics, Meta Pixel, or any other third-party tracking or advertising services.

We use two session cookies, both of which are essential to the operation of the service:

• strava_user_id - stores your internal user ID to keep you logged in across page loads.
• strava_athlete - caches your Strava profile name and avatar so the dashboard loads quickly without an API call.

Both cookies are session-scoped and contain no tracking information. We do not use any analytics, advertising, or third-party cookies.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate data (though most data comes directly from Strava).
• Erasure - request that we delete your account and all associated data.
• Portability - receive a copy of your data in a machine-readable format.
• Withdraw consent at any time, which will not affect the lawfulness of processing before withdrawal.

The fastest way to delete your data is to disconnect My Trail Log via Strava's connected apps settings or the Disconnect & Delete My Data button in the app - this deletes your data immediately and automatically, with nothing further to do.

If you'd rather request deletion directly (for example, if you no longer have access to your Strava account), email us at mytrailloguk@gmail.com with the subject line Delete my account and include your Strava username or email address so we can identify your account. We will confirm receipt within 5 working days and complete deletion within 30 days.

If you have any questions about this privacy policy or how we handle your data, please email mytrailloguk@gmail.com.

If you are unhappy with how we handle your data and we have not resolved your concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).