DRAFT — not yet approved. This text is a draft for the maintainer to review; it has no legal effect yet and will change before it does.
Privacy statement
1. Who is responsible
The controller for the personal data in Waymark is [name of the operator], [address]. Contact for anything about your data: [contact email address].
2. What we store
- Account: username, email address, password (only as a one-way hash), display name and bio if you fill them in, who invited you, which version of the terms you accepted and when, when you last signed in, and your account status.
- Your content: activities and their tracks (locations with time, height and speed), routes, places, photos with their location and time (from the photo's EXIF data or from the app), comments, favourites, privacy zones and share links.
- Strava: if you connect Strava, the connection (its tokens encrypted) and the activities you import.
- Technical: sign-in sessions, API tokens (stored as hashes), and IP addresses: briefly in memory to limit abuse, and in the audit log next to admin actions and security events.
Location data says a lot about you — where you live, when you are out. That is why everything you add is visible only to you unless you choose otherwise, and privacy zones cut the area around places like your home out of everything you share.
3. Why, and on what basis
- To provide Waymark to you: storing, showing and sharing what you ask us to (performance of the agreement, art. 6(1)(b) GDPR).
- To keep Waymark secure and free of abuse: rate limits, the audit log, moderation (legitimate interest, art. 6(1)(f)).
- To import from Strava: only when you connect it yourself, and you can disconnect at any time.
We do not sell data, show advertising, or build profiles of you for anyone else.
4. Who sees your data
- You. Others only see what you share with them, for example through a share link.
- The admin manages Waymark and can see all data where that is needed to run it, to help you or to handle abuse. Every time the admin opens another person's data this is recorded, with the reason, in an internal audit log.
- Data imported from Strava is never shown to other users (Strava's API agreement).
- Service providers: the hosting provider [name] stores the data on our behalf. Place-name searches go to OpenStreetMap's Nominatim service; your browser or app loads map images from OpenStreetMap's tile servers, which therefore see your IP address. There is no mail provider at the moment.
5. How long
- As long as your account exists. When you delete your account, it is removed after a grace period of 30 days (signing in during that period cancels the deletion): every row and every file, including photos and uploads. Comments you left on someone else's item stay, without your name.
- Audit log entries: [retention period, e.g. 12 months].
- Backups: [how long backups are kept]; deleted data disappears from them when they expire.
- Strava data: subject to Strava's rules on how long it may be kept [under review].
6. Your rights
You can see, correct and delete your data, object to processing, ask us to restrict it, and take it with you. Download everything in one file from your account settings (data export), delete your account there too, or write to the contact address above. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
7. Security
Connections are encrypted (HTTPS). Passwords and tokens are stored only as hashes, Strava tokens encrypted. Changing or resetting your password signs you out on every device and app.
8. Minimum age
Waymark is for people of 16 years and older.
9. Changes
When this statement changes in substance, the version number goes up and we ask you to accept the new version.