Privacy policy

Who runs this service

AdvTracker is operated by Indigo Labs d.o.o., a company registered in Slovenia, which is the data controller for everything described here. You can reach us at info@advtracker.app with any question about your data.

This policy covers both the AdvTracker website and the AdvTracker Android app. AdvTracker can also be self-hosted: if you point the app at someone else's server, that operator — not us — decides what happens to your data, and this policy does not apply to them.

What we collect

• Location points you record. Each carries a latitude, longitude, time and — where your phone reports them — altitude, accuracy and speed. The app records only while a trip you started is running. It never asks for "all the time" location access and does not track you between trips.
• Your trips. The name you give a trip, when it started and finished, and the recording settings it used.
• Your identity. The account identifier your sign-in provider gives us and, where the provider shares them, your e-mail address and display name.
• Technical logs. One line per request, holding the IP address it came from, the browser or app user agent, your account identifier, the path, the response status, the time taken and the sizes of the request and response. Request bodies — which for a trip upload would be your coordinates — are not logged in production.
• Share page views. When someone opens a trip's share link, we count the visit. To tell a returning visitor from a new one, the page keeps a random identifier in the browser's local storage; our server stores only a one-way hash of it, per trip, never the identifier itself, and never with an IP address. The trip's owner and anyone with the link see only the two totals: views and visitors. Visits by the owner while signed in are not counted.
• Website analytics, if you allow them. Only after you accept the banner on this website, Google Analytics records which pages you visit, how you arrived, and your browser, device and approximate location, under a random identifier kept in Google's cookies. It never receives a share link, a trip id or a trip name: we report each page by its kind (for example "a share page"), not by its address. Advertising features and Google signals are switched off. If you decline, Google Analytics is not loaded at all.

What we do not collect

No photographs and no camera access: the picture shown on a trip is one our server draws from your route. No advertising identifiers, no trackers beyond the opt-in analytics above, and no contacts, calendar or files from your device. We do not sell your data or share it for advertising, and we never will — there is nothing in AdvTracker that would use it.

Where your data is held

Trips are recorded to your phone first and uploaded afterwards, so a copy lives on your device until it syncs — that is what lets the app keep recording with no signal. Uploaded data is stored in our database, which runs on servers hosted by Hetzner in Germany. Deleting your account removes both: the server copy is deleted as described below, and the app clears its local copy.

Why we collect it

To record your trips and show them back to you, and to anyone you choose to share them with.

Legal basis

Processing your trip data is necessary to perform the service you asked for (contract). Technical logs and the share page's view counter are kept on the basis of our legitimate interest in keeping the service working and secure, and in showing riders how many people follow their trips. Website analytics, and anything else beyond that — such as an optional public profile — rely on your consent, which you can withdraw at any time.

Who can see it

Only you, and anyone you give a share link to. A share link is a secret URL: anyone holding it can see that trip without signing in, so treat it like a password and delete it when you are done with it. We do not sell or publish your data.

Map tiles

Maps are drawn with tiles your browser or phone fetches directly from OpenFreeMap. Those requests do not pass through our servers, which means OpenFreeMap receives your IP address and the area of the map you are looking at. We send them nothing else, and no trip of yours is ever uploaded to them. When you press Relive on a finished trip, your browser also fetches elevation tiles directly from Amazon Web Services' public terrain dataset, and satellite imagery directly from EOX IT Services in Austria. Both likewise receive your IP address and the area being shown — and nothing else.

Retention

• Free accounts: trip data is kept for 90 days after a trip finishes, then deleted.
• Pro accounts: trip data is kept for as long as the account exists.
• Deleted accounts: sessions are revoked and share links removed immediately, and everything is purged 30 days later. Signing in again with the same account within that window restores it.
• Technical logs are kept for 30 days, then deleted automatically. They may be discarded sooner if the log volume is unusually large.

Processors and other recipients

• Hetzner Online GmbH, whose servers in Germany host the database and the application.
• OpenFreeMap, which serves map tiles to your device directly, as described above.
• Amazon Web Services, whose public terrain dataset serves elevation tiles to your device directly when you use Relive.
• EOX IT Services GmbH, in Austria, which serves satellite imagery to your device directly when you use Relive.
• Your sign-in provider — Google, or Apple where it is offered — which confirms who you are.
• Google Ireland Limited, which provides Google Analytics on this website if you allow it.

International transfers

Your account and your trips stay in the European Economic Area: they are stored on Hetzner servers in Germany and we transfer them nowhere else. Your sign-in provider and the map tile provider — and, when you use Relive, the elevation tile provider (Amazon Web Services), and if you allow it, Google Analytics — are international services, and the limited data they receive — described above — may be processed outside the EEA under the safeguards set out in their own privacy policies.

Your rights

• Access: ask us what we hold about you.
• Export: Pro accounts can export every trip as GPX; any account holder can request a copy of their data at info@advtracker.app.
• Correction: change your display name from your account page.
• Deletion: delete your account whenever you like — in the Android app under Settings, or on this site from your account page. No need to ask us.
• Complaint: you may lodge a complaint with your local data protection supervisory authority. In Slovenia that is the Information Commissioner (Informacijski pooblaščenec).

Children

AdvTracker is not intended for children, and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us and we will delete it.

Cookies

On this website we set one HttpOnly cookie, scoped to the sign-in routes, so you stay signed in. If you accept the banner, Google Analytics sets its own cookies (named _ga and _ga_…, kept up to two years); if you decline, none are set. Your answer is remembered in local storage, not a cookie, and you can change it here or from "Cookie settings" at the foot of any page. A shared trip's page keeps a random visitor identifier in local storage, not a cookie, for its view counter (see above), next to two viewing preferences. The Android app uses no cookies; it stores its session in the phone's encrypted storage.

Changes to this policy

If we change this policy we will update the date at the top of this page. If a change materially affects how we handle your data, we will tell account holders by e-mail before it takes effect.