Privacy notice

Last changed 2026-10-24

BreakTrail is in public beta. This notice says what it keeps about you, why, for how long, who else sees it, and what you can do about it. It's written to be read; if anything here is unclear, ask: (contact not configured: BREAKTRAIL_CONTACT).

Who is responsible

BreakTrail is run by (operator not configured: BREAKTRAIL_OPERATOR) (the "controller" under the GDPR), reachable at (contact not configured: BREAKTRAIL_CONTACT).

What we keep, and why

• Your account: your user name, your email, a hash of your password (never the password itself), when you joined, who invited you and with which link, and which version of these terms you accepted. Needed to give you an account (GDPR art. 6(1)(b), a contract with you). Your email is used to send you a link to confirm it, a link when you forget your password, the alerts you turn on (once it's confirmed) and, rarely, news about the beta (such as it ending, or what it will cost after); it's never shown to other users.
• Your home, if you set one: a point on the map, used for distances in the lists and to keep your public routes away from it. You can clear it any time. (Art. 6(1)(b).)
• What you save: places, routes, recorded tracks (positions with times), imported GPX files and activity exports, your field log of visits with their photos, your summit log, layer presets and share links. Kept because you asked us to keep them. (Art. 6(1)(b).)
• Strava, only if you connect it (Library → Log): Strava gives us a token that lets us read your activities, and we keep it, your Strava name and the ids of the activities we have looked at. Each activity with a GPS track (name, sport, positions, times and heights) is saved to your log like an imported file: it's yours alone, never public and never shared. Disconnect deletes the token and tells Strava, and can remove the activities that came from it too; deleting your account removes all of it. Strava handles what you tell it under its own notice. (Art. 6(1)(a), your consent when you connect.)
• Pro topos you buy or sell: what you bought, from whom, when, for how much and how (card, App Store, Google Play); for a seller, what they sold and what they're owed. Kept as bookkeeping for seven years, as Swedish law requires: deleting your account takes your name off a purchase, not the purchase. Ratings you give carry your user name. (Art. 6(1)(b) and (c).)
• What you publish: condition reports (text, rating, tags, photos, place and date, with your user name) and routes you make public (the line, trimmed at its ends and 500 m around your home, without times; its name, notes, sport and your user name). (Art. 6(1)(b).)
• Feedback you send: what you write, screenshots you add, and what the app was showing (where the map was, which layers were on, your browser and screen size, recent errors on the page), with your user name. Used to fix and improve the app. (Art. 6(1)(f), our legitimate interest in a working app; you choose to send it.)
• Alerts, if you turn them on: which of your lists or which avalanche regions to watch, the depth or danger level, and the language to write in; for each browser or phone they go to, the address its push service gave it (with the browser's keys for encrypting the message), a name such as "Chrome on Android", and when an alert last got through; and which alerts were already sent, so none is sent twice. Your places stay where they are: the server reads the forecast at them itself. (Art. 6(1)(b).)
• Login cookie: one cookie, which keeps you logged in for a year on that browser. Strictly necessary for the service; no consent needed and none asked.
• Security and running the service: the server's application log records errors and timings, not your IP address or what you searched; failed logins are counted per IP address in memory for ten minutes to stop password guessing. When something goes wrong (an error on the server or in the app, a slow page, a request the security rules turned away) the app writes an error report: what failed and where in our code, the app's version, the tab, your browser and screen size, and for a security event the first three parts of the IP address. Never your user name, where the map was, what you searched or wrote. (Art. 6(1)(f), our legitimate interest in a working, secure service.)

Your position is only used when you ask for it: to show you on the map, to follow a route or to record a track you started. The web app never tracks you in the background. The phone app records your position in the background only while you record a track you started (so it keeps recording with the screen off), and stops when you stop; the positions stay on the phone until you save the track. There are no ads, no analytics, no tracking pixels and no profiling, and nothing is sold.

What stays on your device

The app keeps your layer choices, the last map view, search filters and areas you saved for offline use in your browser's storage. They don't leave your device. Logging out clears them, and the offline copy of your data.

Who else sees it

• Other users of BreakTrail see what you publish: your condition reports for 14 days, your public routes until you make them private, both with your user name.
• Anyone with a share link you made sees that one place, route or spot (its name, notes and line, without times, and not your user name) until you revoke the link.
• Hosting: Fly.io, Inc. runs the server and stores the database and photos in its Amsterdam region (the Netherlands), as our processor under its data processing agreement. Fly.io is a US company; its agreement covers transfers outside the EU.
• Map tiles your browser fetches itself: Tigris Data, Inc. (the storage the Outdoor map's tiles and place names are served from, Fly.io's object storage), OpenFreeMap (the Map base map), EOX or Esri (the satellite imagery), NASA GIBS and EUMETSAT (the weather satellite pictures) and, if the operator has turned it on, RainViewer (rain radar) receive your IP address and which part of the map you're looking at, as any website you visit would. They don't learn who you are. Everything else on the map comes through our server. See Sources.
• GitHub: feedback you send is filed as an issue in the private GitHub repository BreakTrail is built in, which only the people building and running BreakTrail can see, with your user name; error reports are filed there too, without it. Its screenshots are served from our server under a long random address so the issue can show them. GitHub, Inc. is a US company and processes it under its data protection agreement.
• Translation, if the operator has turned it on: what you write that others can see (condition reports, a route you make public, a place, route or list you share by link) is sent from our server to Anthropic (Claude) when it becomes visible, to be put into the languages other users read the app in, without your name or anyone else's. Your private names and notes are not sent. The translations are kept on our server with the rest. Anthropic, PBC is a US company and processes it as our processor under its commercial terms, which don't let it train on it.
• Payments: a card payment for a pro topo is made on Stripe's own page; Stripe (Stripe Payments Europe, Ltd.) sees your card and email, we never do. A seller gives Stripe who they are and where to pay them, through Stripe's onboarding. In the apps the store takes the payment, and RevenueCat (RevenueCat, Inc., a US company, under its data processing agreement) tells us it went through, knowing you by your user name.
• Push notifications, if you turn them on for a browser or a phone. In a browser, the alert goes through that browser's own push service (Google for Chrome and Edge on Android, Mozilla for Firefox, Apple for Safari, Microsoft for Edge on Windows), encrypted so only your browser can read it: the service sees that a message came, not what it says or who you are. In the phone app, it goes through Google's Firebase Cloud Messaging (Google Ireland Ltd., and Apple's push service on an iPhone), which sees the alert's text and the phone's token, not your user name, as our processor under Google's data processing terms. Turn them off in Profile › Settings › Alerts, or in the browser's or phone's settings.
• Email: confirmation links, password-reset emails and email alerts go out through the operator's email provider, which sees your email address and the message, as our processor.
• Services the server asks for you: place search (names from our own index of OpenStreetMap data; addresses from Geoapify, or Nominatim, OpenStreetMap), weather (MET Norway, Open-Meteo), avalanche bulletins (Varsom, lavinprognoser.se), routing data and others get the place or the search words, from our server, never your IP address or your name.

How long

• Your account and what you saved: until you delete them or your account.
• Something you deleted: it can be restored for 30 days, then it's erased with its photos.
• Condition reports: shown for 14 days, erased 90 days after their date.
• Share links you revoked, used invites: erased after 30 days.
• Error reports: timings kept here for eight days, a report until 90 days after it last happened. The GitHub issue it became stays until it's deleted there.
• Feedback and its screenshots: erased here a year after you sent it, or with your account. The GitHub issue it became stays until it's deleted there: ask ((contact not configured: BREAKTRAIL_CONTACT)) and it will be.
• Purchases and sales of pro topos: seven years (bookkeeping), without your name once your account is deleted.
• Password-reset links: an hour. Email confirmation links: seven days.
• Alerts and the devices they go to: until you turn them off or delete your account; a device whose push service says it's gone is forgotten at once. Which alerts were sent: 14 days.
• Backups: the server's disk is snapshotted daily and snapshots are kept for 30 days, so something erased can live on in a backup for up to 30 more days. Backups are only ever used to restore the service.

Your rights

You can, at any time:

• get a copy of everything we keep about you: More › Account › Download my data (a zip with your records as JSON, your places and routes as GeoJSON and GPX, and your photos);
• correct it: edit or delete anything you saved;
• erase it: More › Account › Delete my account removes your account and everything in it at once (backups age out within 30 days);
• object to or restrict processing, or ask about any of this: write to (contact not configured: BREAKTRAIL_CONTACT);
• complain to a data protection authority: in Sweden, IMY (imy.se), or the one where you live.

Children

BreakTrail is not meant for anyone under 16.

Changes

If this notice changes in a way that matters, the app asks you to read it again before you go on.