Your Data Rights (GDPR)

The UK GDPR and the EU General Data Protection Regulation give you rights over the personal data TrailWise holds about you. This page explains what we hold, why, who helps us process it, and how to use each right — most of them directly from the app or this website, without having to ask us. It sits alongside our Privacy Policy.

Who is responsible for your data

TrailWise is the data controller for the personal data described here. For anything on this page, contact us at contact@trailwise.io.

Download your data

You can download a copy of everything we hold about you at any time. This covers your right of access (Article 15) and your right to data portability (Article 20).

• On the web: go to Profile → Privacy → Download your data.
• In the app: go to Settings → Privacy → Download your data.

The download is a ZIP file containing:

• data.json — everything, in one machine-readable file with a versioned format, so it can be read by other software.
• csv/ — the same data as one spreadsheet per category, for Excel, Numbers or Google Sheets.
• gpx/ — every recorded hike and planned route as a GPX file, which you can import into Strava, Komoot, OS Maps, Garmin Connect and most other mapping apps.
• README.md — what each file and field is.

Photos are linked by address rather than copied into the file. Sign-in tokens and similar credentials are left out on purpose: they are keys to your account, not information about you, and a copy in a downloaded file would let anyone holding it sign in as you. You can request up to five exports an hour. If you cannot sign in, email us and we will send your export within one month, after confirming the request is yours.

What we hold

• Account: Name, email address, username, bio, profile picture, home region, privacy and notification settings, linked sign-in providers (Google, Apple, Strava), subscription status, and invitations.
• Activities: Recorded and imported hikes: GPS tracks with per-point timings, distance, elevation, duration, notes, photos you attach and where they were taken, summits logged, and weather on the day.
• Planning and gear: Routes, trips, saved trails, your personal pace model, gear and packing lists.
• Community: Ratings, reviews, comments, trail condition reports, upvotes, reports you have made, who you follow and who follows you, people you have blocked, and Nearby sightings.
• Safety and live tracking: Live location shares, hike parties, safety check-ins, the emergency contacts you add (their name and phone number), your verified phone number, and the text messages sent on your behalf.
• Awards: Awards, challenge progress, completion cards and community points.

We do not hold a password for you: you sign in with an email link or through Google, Apple or Strava. Photographs you take to report a trail condition are read on your phone and never uploaded, and the on-device AI sends nothing to us (see section 3a of the Privacy Policy).

Why we use it

• To provide the service you signed up for (contract, Article 6(1)(b)) — your account, recording and planning hikes, gear, awards, sharing, and subscriptions.
• With your consent (Article 6(1)(a)) — location access, push notifications, analytics cookies on the web, analytics in the app, linking Strava, and safety check-in texts to your emergency contacts. You can withdraw consent at any time in your device or account settings; it does not affect what we did before.
• Our legitimate interests (Article 6(1)(f)) — keeping accounts secure, preventing abuse, moderating community content, diagnosing errors, and cookieless, anonymous measurement of how the website is used.

We do not sell your data, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects.

Who processes it for us

These providers process data on our behalf, under contract, only for the purpose listed. Where data leaves the UK or EEA, it is protected by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or by an adequacy decision.

If you link Strava, Google or Apple, those companies are separate controllers of the data you share with them, under their own privacy policies.

How long we keep it

We keep your account data until you delete your account. Live location shares stop working 24 hours after the hike finishes and are deleted after that. When you delete your account, your data is removed from our database immediately, your web subscription is cancelled, and linked Apple and Strava access is revoked. Database backups are overwritten on their normal rotation. Sign-in links and sessions are deleted once they expire, Nearby ids when their window ends, and the record of who looked you up on Nearby after 7 days, and safety texts sent to your emergency contacts after 90 days.

Your rights, and how to use them

• Access and portability — download your data, above.
• Rectification — edit your name, email, username, bio, picture and home region from your profile, and edit or delete any hike, route, review or comment yourself.
• Erasure — delete your account from the app or the web. See Account Deletion.
• Restriction and objection — make your hikes private, hide the start and finish of shared tracks, mute push notifications, decline analytics cookies, or email us to object to any processing based on legitimate interests.
• Withdraw consent — at any time, in your device settings (location, notifications), the cookie banner (analytics), or by disconnecting Strava in your profile.

For anything you cannot do yourself, email contact@trailwise.io. We reply within one month, as the law requires, and do not charge for it.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk), or in the EU, the data protection authority where you live or work.