Privacy policy
EnduroTrack is an iPhone, Apple Watch and Android app that records enduro, motocross, snowmobile and ATV rides, shows statistics and lets you follow other riders. This policy explains which personal data we process, why, for how long, and your rights.
1. Controller
Kim Sahlström (private individual), Sweden Email: support@endurotrack.se
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Account | email address, password (stored hashed by our provider), user ID | you |
| Profile | display name, username, bio, profile picture, private/public account | you |
| Consents | which terms and privacy policy you accepted and when, your health data and marketing choices | you |
| Rides | start/end time, duration, distance, speed, altitude, ascent | your phone/watch |
| GPS routes | location points during the ride | your phone/watch |
| Health data | average/max heart rate, calories – only with your explicit consent | Apple Health, your Wear OS watch or your Garmin watch |
| Privacy zones | location and radius of zones you create (e.g. around home) | you |
| Community | who you follow, follow requests, likes, comments, blocks, reports | you |
| Messages | chat messages between you and riders you follow each other with (text, who and when). Only the two of you can read them | you |
| Notifications | when someone follows you, gives a Ride On or comments, we store a notification for you (who, what and when) | automatic |
| Technical | sign-in times and security logs at our hosting provider | automatic |
We do not collect data for advertising, we do not track you across apps or websites, and we never sell personal data.
Apple Health: EnduroTrack reads workouts, heart rate, calories and routes from Apple Health and saves rides there, only with your permission in iOS. Apple Health data is never used for advertising or marketing.
Health Connect (Android): If you switch it on under More → Health Connect, EnduroTrack saves your rides (time, route, distance, ascent and calories) to Health Connect on your phone. EnduroTrack does not read any data from Health Connect. You can switch it off at any time and delete the data in Health Connect. Health Connect data is never used for advertising or marketing.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, save rides, show statistics, sync between devices | Contract (Art. 6(1)(b)) |
| Community: following, feed, likes, comments, leaderboards | Contract (Art. 6(1)(b)) |
| Store heart rate and calories in your account and – if you choose – show them to others | Explicit consent (Art. 9(2)(a) and 6(1)(a)) |
| News and offers by email | Consent (Art. 6(1)(a)) |
| Security, preventing abuse, handling reports and blocks | Legitimate interest (Art. 6(1)(f)) |
| Legal obligations | Legal obligation (Art. 6(1)(c)) |
You can withdraw any consent at any time under More → Privacy & Consent. Withdrawing health data consent deletes your heart rate and calories from your account.
4. Who can see your data
- Other signed-in users see your profile (name, username, bio, profile picture).
- Rides and statistics follow your settings: only you, followers, or all signed-in users. With a private account you approve new followers.
- GPS routes are shown to others only if you share the route of that ride. Points inside your privacy zones are always hidden from others.
- Heart rate and calories are shown to others only if you turn sharing on.
- Blocked users cannot see your rides, and you cannot see theirs.
5. Processors and transfers
- Supabase (Supabase Inc.) – database, sign-in, profile picture storage. Data is stored in the EU (Ireland). Supabase is a US company; any access from outside the EU/EEA is protected by the European Commission's Standard Contractual Clauses under Supabase's data processing agreement.
- Resend (Resend Inc.) – delivers account emails such as email confirmation and password reset. Resend processes your email address and the message itself. Resend is a US company; the transfer is protected by the European Commission's Standard Contractual Clauses under Resend's data processing agreement.
- Garmin – if you use the EnduroTrack app for Garmin watches, the ride is sent from the watch to the EnduroTrack app on your phone over Bluetooth, and is also saved as an activity in your own Garmin Connect account under Garmin's privacy policy. EnduroTrack does not read any data from your Garmin account.
- Apple – Apple Health/HealthKit on your device and Apple Maps for map display in the iPhone app, under Apple's own privacy policy.
- Google (Google Ireland Ltd.) – Google Maps for map display in the Android app. When a map is shown, Google receives the area being displayed and your IP address, under Google's own privacy policy. No account details are sent to Google.
6. Retention
- As long as you have an account.
- When you delete your account (More → Delete account), your profile, profile picture, rides, routes, health data, zones, consents, follows, likes, comments, blocks and reports are deleted immediately and permanently.
- Notifications are deleted after 90 days or when you remove them.
- Chat messages are kept until one of you removes the message or deletes their account. Reported messages are kept for review.
- Security logs at our hosting provider are kept for a limited time according to the provider's routines.
- Apple Health and Health Connect data is not affected by deleting your EnduroTrack account; manage it in the Health app or in Health Connect.
7. Your rights
You have the right to:
- access your data – export it yourself under More → Privacy & Consent → Export my data,
- rectify inaccurate data (e.g. in Edit Profile),
- erasure (delete your account in the app),
- restrict or object to certain processing,
- data portability (the export is a machine-readable file),
- withdraw consent at any time.
Contact support@endurotrack.se. We reply within one month. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.
8. Security
Measures include encrypted transmission, database access rules limiting who can read what, private GPS routes by default, privacy zones, and health data stored only with consent. No service can guarantee absolute security; please protect your password and devices.
9. Children
EnduroTrack is not intended for children under 13.
10. Changes
We will inform you in the app about significant changes. The current version is always available at https://endurotrack.se/en/privacy/ and in the app.