Privacy policy
Who is responsible for your data
The controller of your data is the publisher of the OutPath app. Until the business is registered and these details are completed, you can reach us at support@outpathapp.com. This paragraph must be completed before the app is published in the store: the GDPR requires the controller's identity and contact details.
What data we collect
Your email address and password when you create an account - the password is stored by Supabase Auth as a hash and never reaches the app or our database in readable form.
Your @username, which is permanent and public, and your display name, bio and profile picture, if you add them.
The photos you publish, with the coordinates where they were taken and their caption. The coordinates are needed to place a pin on the map - that is what the app is for. We publish them at full precision, so do not add photos from places whose location you do not want to reveal - your own home, for example.
Saved activities: the route track, time, distance and elevation gain, and the weight you enter yourself if you want an estimate of calories burned.
Your age and gear weight, if you enter them. Both are optional and stay only on your phone; the gear weight only affects the calorie estimate.
Your history of visited places, likes, comments and the users you follow.
Which photos you have already been shown in the feed - on your phone only, so that next time you open the app you see something new.
Whether you have an active subscription. Payments are handled by Google Play through RevenueCat; we do not see or store your card details.
Legal basis
We process your account, published photos, comments, ratings and saved activities because without them we could not perform the contract for the service you enter into when you create an account (Art. 6(1)(b) GDPR).
Keeping the service secure, preventing abuse and handling content reports rely on our legitimate interest (Art. 6(1)(f) GDPR).
Settling subscriptions and keeping proof of payment follow from legal obligations, including tax law (Art. 6(1)(c) GDPR).
Everything we mark as optional is based solely on your consent, which you can withdraw at any time in Settings (Art. 6(1)(a) GDPR).
What we do not collect
We do not track your location in the background. We read your position when you add a photo, and while an activity you started yourself is being recorded - also with the screen off, always with a notification showing that recording is on. Recording stops when you end the activity.
The app currently contains no analytics tool and collects no crash reports - the consent switch in Settings is consent for the future, and nothing of the kind will be turned on until you switch it on.
We do not sell data or pass it to advertisers.
We do not use cookies: this is a mobile app, not a website. Instead of a cookie banner you get a consent screen for optional data.
What is public
Your photos, captions, place names, place ratings, comments, @username and display name can be seen by anyone who uses the app, including in guest mode. A photo you mark as private is the exception: only you see it, together with its comments and likes.
Your email address is visible to no one but you. Your history of visited places and your saved activities are visible only to you, and this is enforced by the database itself, not just the interface.
Who processes data for us
Supabase - database, accounts and photo storage, servers in the European Union (region eu-central-1).
Google Play and RevenueCat - subscriptions.
Cloudflare - delivers the map. Every map tile passes through Cloudflare's servers, which see your device's IP address and the part of the map being loaded, not your account.
Map data comes from OpenStreetMap contributors, prepared as map tiles by Protomaps. That is only where the data comes from - nothing is sent to them.
Nominatim (OpenStreetMap Foundation) - place search and checking that a photo was taken outdoors. BRouter and the FOSSGIS routing server - route planning. They receive the place name or coordinates you ask about, with nothing about who you are.
hCaptcha (Intuition Machines) - protects sign-in and sign-up from bots and may process technical data about your device for that purpose.
Google - if you choose to sign in with a Google account.
Transfers outside the European Economic Area
The database, accounts and photos stay in the European Union. Google, RevenueCat, Cloudflare and hCaptcha are US companies, so subscription data, the IP address used to load the map and the bot check may be processed in the United States on the basis of the European Commission's adequacy decision (Data Privacy Framework) or its standard contractual clauses. The OpenStreetMap Foundation is based in the United Kingdom, which is covered by an adequacy decision.
How long we keep data
Until you delete it. Deleting a post also deletes its photo from storage. Deleting your account erases your profile, posts and photo files, comments, likes, ratings, visit history and saved activities.
Database backups are overwritten on a rolling basis, so deleted data may survive in them for up to 30 days. Billing records for subscriptions are kept by Google for the period tax law requires, regardless of deleting your account with us.
How to delete your account
Settings, at the very bottom: "Delete account". It works immediately, without asking us.
Note: deleting your account does not end a subscription. The subscription lives in your Google account, not ours, so cancel it in Google Play first - otherwise Google will keep charging you.
Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable form and object to processing, and, where we rely on consent, to withdraw it without affecting what was lawful before. Write to support@outpathapp.com; we reply within a month. You can also lodge a complaint with the supervisory authority in the country where you live - in Poland the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
Children
The app is not intended for anyone under 16. In Poland, 16 is the age from which a person can consent to the processing of their data by online services themselves; below it a parent's consent is needed, which we have no way to ask for. We do not knowingly collect data from such people.
Changes
We will tell you about significant changes in the app before they take effect. The date at the top shows when this document was last changed.