Privacy Policy
Trail Race — last updated: 25 September 2026
Trail Race helps you prepare your trail races: track, race plan, nutrition, weather and tracking of your outings. The app contains no ads and no tracking, and your data is never sold or shared for commercial purposes.
Who is responsible for your data?
Trail Race is published by Anthony Tournier, data controller within the meaning of the GDPR. For any question about your data: contact@trail-race.app.
Who the service is for
Trail Race is reserved for people aged at least 15 (the age of digital consent in France; 16 in some EU countries). If we learn that an account was created by someone younger, it will be deleted.
The data we process, and why
| Data | Why | Legal basis |
|---|---|---|
| E-mail address, name, account identifier | Create your account and sign you in (e-mail, Apple or Google). | Performance of a contract (Terms) |
| Races, GPX tracks, waypoints, race and nutrition plans, notes, pantry | The core of the app: what you enter to prepare your races. | Performance of a contract |
| Sports activities imported from Strava (date, distance, duration, elevation, cadence, GPS track…) | Display your outings and calculate your pace for race plans. Only if you link your Strava account. | Consent (Strava link, revocable at any time) |
| Heart rate from Strava activities | Display the effort of your outings. This is health data: we process it only with your explicit consent, given when you link Strava, which you can withdraw by disconnecting Strava. | Explicit consent (GDPR Art. 9) |
| Precise location | Only during a race's live sharing, which you activate yourself: your last position (about once a minute) is shown on the race's public page. Only the last position is kept. | Consent (activating sharing) |
| Device notification token | Notify you that a new activity has synced, if you authorised it. | Consent (iOS authorisation) |
| E-mail address (newsletter), and whether you want to test the beta | Send you project news and, if requested, a beta invitation. Only if you sign up on the website and confirm your subscription. | Consent (double opt-in) |
| Technical logs (IP address, timestamp, errors) | Operate the service, prevent abuse and diagnose failures. Kept briefly by our hosting providers. | Legitimate interest (security) |
Trail Race does not access your contacts, photos or Health app data, and does not make any automated decision producing legal effects on you. Pace plans and nutrition advice are estimates calculated from your data, shown to you alone.
Public pages
A race is only publicly visible if you enable its sharing link. The public page shows your profile name (if provided), as well as the track, plan, nutrition, weather and notes for that race, and your position if you share your live location. It shows neither your e-mail nor your other data. It is excluded from search engine indexing. You can disable the page at any time: the previous link stops working within minutes (cache delay).
On the public page, a visitor can display their own position and heading on the map using the button provided for that purpose, if they allow it in their browser. That position stays in their browser: it is never sent to Trail Race or stored.
Where your data is stored, and with whom
We only use the providers necessary to operate the service, who process your data on our behalf or as separate controllers under their own policies:
- Supabase (Supabase Pte. Ltd., Singapore) — hosting of the database, files and accounts, within the European Union (Paris region).
- Netlify (Netlify, Inc., United States) — hosting of the website and its public pages; global delivery network.
- Strava (Strava, Inc., United States) — source of your activities, if you link your account. Trail Race publishes nothing on Strava.
- Apple (Apple Inc.) — notifications (Apple Push Notification service), Sign in with Apple and maps (Apple Maps).
- Google (Google Ireland Ltd.) — Sign in with Google, if you choose it.
- Brevo (Brevo SAS, France) — sending the newsletter and managing subscriptions, within the European Union, if you sign up for it.
- Open-Meteo — weather forecasts: only the race location's coordinates are sent to it, with no data about you.
- OpenFreeMap — website map backgrounds: your browser loads the tiles directly, with no identifier.
Transfers outside the European Union
Your account and race data are stored within the European Union. Some providers nonetheless access it from outside the EU to administer their service: Netlify, Strava, Apple and Google from the United States; Supabase, a company incorporated in Singapore, from Singapore — the European servers hosting your data remain independent from the country where that company is established. These transfers rely on the safeguards provided by the GDPR depending on the country: an adequacy decision (EU-US Data Privacy Framework) for US providers that adhere to it, and the European Commission's standard contractual clauses in other cases.
How long
- Account and content: as long as your account exists. You can delete it at any time (see "Delete your account" below).
- Live location: only the last position is kept; it is erased when sharing stops, and at the latest within an hour after the sharing window ends.
- Strava activities: deleted if you disconnect Strava or revoke access from Strava.
- Newsletter: until you unsubscribe.
- Technical logs: a few days to a few weeks depending on the hosting provider.
Cookies and local storage
The website sets no tracking, advertising or audience-measurement cookies. The browser may keep a few technical settings locally (theme, page state) that never leave your device. The app keeps your login session and preferences on your phone.
Security
Exchanges are encrypted (HTTPS). Each piece of data is tied to your account and isolated from other users at the database level. Strava access tokens and notification tokens are never accessible from the app or the website. In the event of a data breach likely to affect you, you will be informed in accordance with the law.
Newsletter
Signing up happens on the website, with your consent: a confirmation e-mail is sent to you, and nothing is sent to you until you click its link. Each newsletter contains an unsubscribe link; your address is then removed from the list. It is never shared or used for other purposes, and it is independent from your account in the app.
Delete your account
In the app: Profile → Delete my account. Deletion is immediate and permanent: account, races, GPX files, activities, pantry and registered devices are erased, and Trail Race's access to your Strava account is revoked. The newsletter subscription, which is independent, is managed via the unsubscribe link in each e-mail.
Your rights
Under the GDPR, you can access your data, correct it, erase it, restrict its processing, request its portability, object to its processing, and withdraw consent at any time (without affecting past processing), by writing to contact@trail-race.app. We respond within one month. You may also lodge a complaint with the CNIL (cnil.fr) or the data protection authority of your country of residence.
Changes
This policy may evolve with the app. The last update date appears at the top of the page; in case of a material change, you will be informed within the app.
See also: Terms · Legal notice