Privacy policy

Controller

• GPXTools
• Contact: hello@gpxtools.app

Without an account: your files stay on your device

You can use the editor without signing in. The GPX files you open or create are processed in your browser or on your phone and kept only on your device: they are not uploaded to any GPXTools server.

User account (optional)

If you create an account, we process your email address and, if you sign in with Google, the profile name and picture Google gives us. We also keep the language you choose. If you use shared projects, we keep what you add: routes (GPX files), stages, stops, budget, checklists, documents, journal, the project members and the email of the people you invite.

Purpose: identifying you and providing shared projects. Legal basis: performing the service you request (art. 6.1.b GDPR).

Anonymous usage statistics

To know which tools are used and improve them, we record anonymous usage events: pages visited, tools opened and main actions (for example “export a file”), with the language, device type, platform, time zone and, where applicable, the domain of the website you came from. They do not include your IP address, name, email or the content of your routes; only a random identifier stored in the browser (see the cookies policy).

If your browser sends the Do Not Track or Global Privacy Control signal, nothing is recorded. Legal basis: legitimate interest in improving the service (art. 6.1.f GDPR). This data is kept for 13 months at most.

Location (Android app)

When you use route following, recording or the SOS button, the app uses the phone’s GPS. Location is processed only on the device: it is not sent to GPXTools or third parties. The track you record is saved as a file on the phone.

Third-party services that receive data when you use a feature

• Supabase: hosting of the database, sign-in and the files of accounts and projects (processor).
• Google: sign-in with Google, and Google Gemini, which receives the text you write to the AI assistant and the map area.
• Open-Meteo: route coordinates for the weather forecast.
• AEMET (through our server): route area for weather warnings.
• BRouter and GraphHopper: waypoints to compute routes.
• Photon (komoot) and Nominatim (OpenStreetMap): place search texts.
• Overpass (OpenStreetMap): map area for points of interest.
• Map and data providers (OpenFreeMap, ICGC, IGN, Esri, Mapterhorn, avalanche.report, regions.avalanches.org…): requests for the tiles and data of the area you look at.
• Ko-fi, social networks, Garmin, Wikiloc or Komoot: only if you go there from a link or button.

Some features need to query external services. When they do, these services receive your IP address and the data the query needs:

International transfers

Some providers (such as Google or Supabase) may process data outside the European Economic Area. In that case they do so with the safeguards set out in the GDPR, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.

For how long

• Account and projects: while the account exists, or until you delete them or ask for their erasure.
• Anonymous usage statistics: 13 months at most.
• Data stored on your device: until you delete it from the browser or the app.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to hello@gpxtools.app. You can also ask us at any time to delete your account and all its data.

If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local authority.

Children

User accounts are not intended for children under 14.

Changes

If we change this policy, we will say so on this page with the update date.