Privacy Notice

Who we are

TrailTrack.co.uk is operated by Richah UK Ltd (company number 16356927), whose registered office is Burnbank, Lamplugh, Workington, Cumbria, England, CA14 4TY. Richah UK Ltd is the data controller responsible for the personal data collected through TrailTrack.

If you have any questions about this notice or how we handle your information, please contact us at:
Email: team@trailtrack.co.uk

What personal data we collect

We collect the following types of personal data:

• Identity and contact information: your name, email address, profile image and account identifiers. If you use Google sign-in, Google provides the verified email, name and profile image you approve.
• Activity, route and fitness information: routes you record or upload, precise GPS points, timestamps, activity type, distance, duration, elevation, pace, cadence, steps and fell summits. An uploaded GPX file or connected fitness service may also contain heart-rate data.
• Profile and physical information: profile details and preferences you choose to provide, including an optional location, biography, height and weight. Height and weight are used for personalised activity calculations and are not shown publicly.
• Content and communications: photos, videos, journal entries, comments, forum posts, likes, saved items, direct messages, voice notes and files you choose to add or send. Content can contain information about other people, so only upload or share it where you have the right to do so.
• Connected-service data: data returned by services you choose to connect, including Garmin, Polar and Strava activity information. See the integration sections below for details.
• Device, usage and diagnostic information: IP address, browser or app version, device and operating-system information, pages or features used, notification tokens, security records, server logs and limited technical diagnostics. Detailed recording diagnostics are collected only for accounts given that diagnostic capability.
• Support and beta feedback: your report, the page or app area involved, technical context and any screenshot you deliberately attach when you contact us or report a bug.

We do not currently take payments. Heart-rate information is health data: TrailTrack processes it only when it is present in activity data that you choose to upload or import, and you can hide it from other members or delete the activity. Please avoid placing unrelated sensitive information in free-text fields. We do not knowingly offer accounts to children under 13.

How we collect your data

• Directly from you when you register, record or upload an activity, add profile or community content, send a message, change a setting, or contact us.
• From the TrailTrack app when you use a feature and have granted the relevant device permission, and automatically through essential website and app technology such as security and server logs.
• From Google when you choose Google sign-in.
• From Strava, if you choose to connect your Strava account and authorise TrailTrack to access your activity data.
• From Garmin Connect, if you choose to connect your Garmin account and allow TrailTrack to receive your activities.
• From Polar Flow, if you choose to connect your Polar account and authorise TrailTrack to access exercise data.

Mobile app permissions

• Location: when you deliberately start recording, the app uses precise location to draw and measure your route. If you grant background location, recording can continue while the screen is locked or another app is open. TrailTrack does not use background location to follow you when no activity is being recorded.
• Photos and media: used only when you choose media to attach to an activity, message, profile or bug report.
• Microphone: used only when you choose to record a voice note.
• Notifications: if allowed, a device notification token is stored so we can deliver account, activity and message notifications.

You can withdraw a device permission in your phone settings. Removing background location while recording may prevent TrailTrack from capturing the complete route.

Watch activity export to Health Connect and Samsung Health

On supported Android phones, you can choose to copy new, completed TrailTrack watch activities into Health Connect so that Samsung Health or another app you authorise can receive them. Automatic export is off until you enable it in TrailTrack's Connected Apps settings and grant the requested Health Connect permissions. Your watch still uploads one activity to TrailTrack; the phone copies that saved activity out and does not create a second TrailTrack activity.

With your permission, we write the exercise session and its recorded times, precise GPS route, distance, elevation gained and recorded heart-rate measurements when available. We request write access only: this feature does not read your Health Connect records or import your Samsung Health history. The exported GPS route is your original recorded route; TrailTrack privacy zones and start/end trimming used to hide locations from other members do not remove those locations from this personal export.

Enabling export starts with activities saved after you enable it; it does not automatically copy your earlier history. Your signed-in phone downloads eligible activities over an encrypted connection and may continue checking in the background. A sign-in credential is encrypted on the phone using Android Keystore so it can perform these checks. Android may delay background work when saving battery or when the app is force-stopped.

Turn off automatic export in TrailTrack to stop future copies, or revoke its write permissions in Health Connect. Signing out removes this feature's sign-in session from the phone. Copies already written to Health Connect or received by Samsung Health or another authorised app remain there until you remove them using that service's controls; deleting an activity or account in TrailTrack does not delete those separate copies. If you turn export on again, it starts from a new baseline rather than sharing activities saved while it was off.

You control which apps can read your Health Connect data. Samsung Health and any other service you connect handle received copies under their own privacy notices, permissions and retention settings. Any onward sharing, including to Strava, depends on that service's support and your settings; TrailTrack does not promise that imported workouts will be forwarded. This optional export is not used for advertising, selling your health data or training artificial intelligence models.

Garmin Connect Integration

If you connect Garmin Connect, TrailTrack receives new activities that you allow Garmin to share. We use outdoor activity dates, types, names, GPS tracks and available measurements to show your routes, calculate statistics and track the fells and summits you have reached. Garmin Starter Access does not provide your earlier activity history. We store your Garmin account identifier and connection tokens so we can identify your activities and maintain the connection.

Imported routes may contain precise location, heart rate and other fitness measurements. We store a temporary copy of the original Garmin activity file in our private SQL Server queue while importing it, then remove that copy after a successful import. The resulting route is stored on Richah UK Ltd's TrailTrack application server and private SQL Server database. If a route does not match a fell, OpenStreetMap Nominatim or Komoot Photon may receive selected GPS coordinates to name the place. If your device is registered for Android push notifications, Firebase Cloud Messaging may receive the activity title and summit count to deliver an alert. CyclOSM, OpenStreetMap or Mapbox may receive map tile requests when you view a route. We do not send Garmin activity files to analytics or AI services, sell Garmin data, or use Garmin data or anything derived from it to train, evaluate or improve AI models.

Your TrailTrack activity privacy setting determines whether a new import is visible to other members. You can change its visibility, correct its details, export or delete it from your account. You can disconnect Garmin in Connected Apps or withdraw permission in Garmin Connect. Disconnecting stops future imports and removes TrailTrack's stored Garmin connection credentials. Activities already imported remain in TrailTrack with their existing visibility until you change or delete them. You can also request access, correction, export or deletion by emailing team@trailtrack.co.uk.

Polar Flow Integration

If you connect Polar Flow, TrailTrack uses the account identifier and access token provided by Polar to import new exercise sessions with GPS routes. We use the route, timestamps and activity type to create an activity, calculate route statistics and track your UK fell summits. We do not import sessions without a GPS route. This connection does not import your full exercise history.

A Polar GPX route contains precise location and may contain other exercise measurements. Imported activities follow your TrailTrack activity privacy setting: they may be visible to other members if your setting allows public activities. You can change an activity's visibility or delete it in TrailTrack.

You can disconnect Polar at any time in Connected Apps. We then delete the stored connection credentials and stop future imports. Activities already imported remain in your TrailTrack account with their existing visibility until you change or delete them.

Strava Integration

TrailTrack offers an optional Strava integration. If you choose to connect your Strava account, we will import your outdoor activity data to automatically detect and record fell summits against UK hill classifications (such as the Wainwrights, Munros, and Corbetts).

The data we import from Strava includes:

• Activity name, type, date, distance, duration and elevation
• GPS track data used to map activities and match routes against fell databases
• Heart rate, cadence and related activity-stream data where Strava makes it available for the activity

Attribution: Every activity imported from Strava is clearly labelled as “Imported from Strava” wherever it appears in TrailTrack.

Visibility: You control who can see your Strava-imported activities. Activities you set to private in TrailTrack are visible only to you. Activities you set to public may be visible to other TrailTrack members. You can change the visibility of any activity at any time from your account.

Disconnecting Strava: You can disconnect your Strava account at any time. Disconnecting deletes TrailTrack's stored Strava connection credentials and stops future access and imports. Activities already imported into your TrailTrack account remain there as private TrailTrack activities until you delete those activities or your account.

We use your Strava data only to import, display and analyse your TrailTrack activities, calculate activity statistics and match fell summits. We do not sell it, share it with third parties beyond the service infrastructure needed to provide those features, or use it to train artificial intelligence or machine learning models. Our use of the Strava API is governed by Strava's API Agreement.

How we use your personal data

We process your personal data only for the following purposes:

• To provide and manage your account, record and display activities, calculate statistics, plan routes, track summits and support offline maps
• To provide the profile, feed, forum, messaging, sharing and privacy controls you choose to use
• To send service, security and message notifications according to your settings
• To respond to support or bug reports and maintain a private internal work record of reported faults
• To keep TrailTrack secure, prevent abuse, diagnose faults and improve reliability and usability
• To comply with legal obligations (e.g., responding to lawful requests)

Our lawful bases

• Contract: to create and operate your account and provide the route, journal, community and support features you request.
• Legitimate interests: to secure TrailTrack, prevent abuse, diagnose faults and improve reliability. We balance these interests against your rights and do not use private route content for advertising or unrelated profiling.
• Consent: for optional analytics cookies and optional third-party account connections. You can withdraw consent by changing cookie choices or disconnecting the service.
• Legal obligation: where we must retain, use or disclose information to comply with applicable law.

Who we share your data with

We do not sell or rent your personal data. We may share limited data only when necessary:

• With providers that host TrailTrack, store uploaded media, deliver email and notifications, provide maps or routing, protect the service, or supply essential technical infrastructure
• With Google, Garmin, Polar or Strava when you deliberately use their sign-in or connected-service features, and with Google Analytics only if you accept analytics cookies on the website
• With Health Connect and the health apps you authorise when you enable watch activity export, as explained above
• With the recipients or wider TrailTrack community when you send a message, share a route, or make content visible to them
• Within our private support and work-management systems when needed to investigate feedback or a fault you report
• If required by law (e.g., to authorities)

Private activities and messages are not made public. Our contracted infrastructure providers may process them only as needed to operate TrailTrack, and people receive them only when you choose to share or send them.

International transfers

Some of our service providers may be based outside the UK (e.g., in the EEA or US). Where this happens, we ensure appropriate safeguards are in place (e.g., UK-approved standard contractual clauses or adequacy decisions).

How long we keep your data

We keep your data only for as long as necessary:

• Account content: while your account is active and until you delete the item or your account, subject to the recovery period below
• Scheduled account deletion: account data is held for a 30-day recovery period, after which it is eligible for permanent removal from active systems
• Connected-service credentials: until you disconnect the service or delete your account
• Notification tokens: until you sign out that device, the token is replaced, or your account is deleted
• Support, security and technical records: only for as long as reasonably needed to resolve the issue, protect the service, meet legal obligations or establish legal claims

You can delete individual activities and other content, download a copy of your account data, or schedule account deletion from your account settings. If you cannot sign in, use the public account deletion request page.

Your rights

You have rights under UK data protection law, including:

• To access your personal data
• To correct inaccurate data
• To delete your data (including activities, routes, media and messages, subject to applicable limits)
• To restrict processing
• To object to certain processing
• To data portability (in some cases)

To exercise these rights, just email us at team@trailtrack.co.uk. We’ll respond as quickly as possible (usually within a few days). You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

Security

We take reasonable steps to protect your data, including secure storage, access controls, and encryption where appropriate (especially for uploaded GPX files).

Cookies and Similar Technologies

Our website uses two types of cookies:

• Strictly necessary cookies: These keep you logged in securely, remember your session preferences, and ensure basic functionality and security. They do not require your consent under UK law.
• Analytics cookies (Google Analytics): We use Google Analytics to understand how visitors use our site — for example, which pages are most popular and how people navigate between them. Google Analytics sets cookies to collect this information anonymously. These cookies are only set if you choose to accept analytics cookies via our cookie consent banner when you first visit the site.

When you first visit TrailTrack.co.uk, you will be shown a cookie consent banner. You can choose to accept or decline analytics cookies at that point. If you decline, no analytics cookies will be set and your visit will not be tracked by Google Analytics.

You can also control or delete cookies at any time through your browser settings. For more general information about cookies, visit aboutcookies.org. For details on how Google uses data collected via Analytics, visit Google's Privacy Policy.

Changes to this notice

We may update this notice from time to time. Changes will be posted here with a new “last updated” date. Please check back periodically.

By using TrailTrack.co.uk and creating an account, you acknowledge this Privacy Notice. Thank you for trusting us with your data — we’re committed to keeping your tracks private!