TrailDB Privacy Statement

Privacy Policy

Last updated: September 2026 • Effective during Closed Beta Testing & General Availability

🛡️ Summary of How TrailDB Protects Your Privacy

TrailDB is committed to protecting your personal data and giving you total control over what you share. As an outdoor trail reconnaissance and surface intelligence platform, location data is essential for plotting surfaces, scouting gravel conditions, and routing rides. We never sell your personal information or GPS tracks to data brokers or third-party advertisers.

1. Controller & Contact Information

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

TrailDB Technologies

Attn: Data Protection Officer

Email: [email protected] / [email protected]

2. Types of Data Processed by TrailDB

When you access or use TrailDB (via web browser, mobile device, or progressive web app), we process the following categories of data:

Account & Profile Data: Email address, rider handle / username, encrypted authentication credentials, role (e.g., Scout, Pathfinder, Trail Master, Admin), and optional profile preferences.
Location & Geodata (GPS): Geographic coordinates (latitude, longitude, elevation), GPS waypoints, recorded tracks, and precision trail scouting pins created when submitting surface reports.
Reconnaissance & Surface Intel: Surface roughness grades (G1–G5), trail condition classifications (fast/smooth, mixed/caution, severe/rough, hike-a-bike), mud/flooding reports, hazard markers, and seasonal notes.
Uploaded Photos & Media: Photos taken to document trail surface conditions, obstacles, or scenery. EXIF GPS metadata embedded in images is processed strictly for positioning reconnaissance markers with your consent.
Connected Services (Strava): If you connect your Strava account, we receive OAuth tokens, athlete identifiers, and starred routes which you choose to sync into TrailDB for surface analysis.
Technical & Log Data: IP address, device model, operating system, browser specifications, and error telemetry necessary to maintain secure service operation.

3. Purposes and Legal Basis of Processing

We process your data strictly under recognized legal bases defined in Art. 6 GDPR:

Contract Performance (Art. 6(1)(b) GDPR)

To provide the core TrailDB service: route planning, surface scouting, GPS route downloads, and synchronizing your account across devices.

Consent (Art. 6(1)(a) GDPR)

For processing precision GPS location, accessing your device camera/gallery, and linking third-party accounts such as Strava.

Legitimate Interests (Art. 6(1)(f) GDPR)

To safeguard the platform against bot attacks, spam, abusive behavior, and ensure accurate, community-verified trail intelligence.

Legal Obligations (Art. 6(1)(c) GDPR)

To comply with statutory retention periods and lawful requests by public authorities.

4. Location Privacy & Privacy Zones

TrailDB recognizes that outdoor location data requires delicate privacy protection:

Privacy Zones: Riders can specify private radii around personal locations (such as your home, workplace, or private trailheads). When enabled, any route or reconnaissance marker originating or terminating within that radius will have its precise geometry hidden from public discovery.

Route Visibility Controls: You can set any route or reconnaissance submission to Private (visible only to you), Unlisted (accessible only via direct link), or Public (contributing to global surface intelligence).

5. Third-Party Service Providers

TrailDB works with trusted technical partners under strict data processing agreements:

Map Tile Providers: OpenStreetMap contributors, Thunderforest (Outdoors & Cycle layers), and CartoDB for rendering base cartography. Only your viewport tile requests are transmitted.
Strava API: If you connect Strava, requests are made directly via official Strava API endpoints following Strava API Agreement guidelines.
Email Infrastructure: Transactional emails (such as 2FA login verification codes) are securely dispatched via modern email infrastructure and never shared with marketers.

6. Storage Duration & Data Deletion

We retain your personal data only as long as necessary to fulfill the purposes set out in this Privacy Policy or until you request its deletion. You have the right at any time to delete your account, remove specific surface pins, or export your routes in standard GPX and GeoJSON formats.

7. Your Rights as a Data Subject

Under applicable data protection legislation (including GDPR Chapter III), you hold comprehensive rights:

Right to access: Request a copy of all personal data held about you.
Right to rectification: Correct incomplete or inaccurate profile records.
Right to erasure ("Right to be Forgotten"): Request complete deletion of your account.
Right to restriction of processing: Temporarily limit data processing.
Right to data portability: Receive your routes and pins in a structured, machine-readable format.
Right to lodge a complaint: Contact your national Data Protection Authority.

To exercise any of these rights, contact us at [email protected].

8. Changes to this Policy

We may update this Privacy Policy from time to time to reflect evolving features, community guidelines, or statutory requirements. When changes are made, we will update the "Last updated" date at the top of this document and notify active users via in-app notification.