Privacy Policy

Who we are

Pathbagger is a personal project run by Bob Dickinson. It shows how much of a long-distance path you have covered, using activity data from your Strava account. For the purposes of UK data protection law, Bob Dickinson is the data controller. You can get in touch at admin@pathbagger.com or through our Help & support page.

What we collect

When you connect your Strava account, we store:

• Your Strava athlete ID, first name, last name, and profile picture URL.
• Access and refresh tokens from Strava, which let the app read your activities. These are stored encrypted.
• For activities that pass along a trail you are tracking: the activity name, type, date, distance, and its GPS outline, so we can show which sections you have covered.
• The trail you have chosen, and a login session so you stay signed in.
• If you contact us through the Help & support page or the Request a path form: your name, email address and message, so we can reply. We also keep a one-way hash of your IP address for an hour-by-hour limit that stops the form being flooded with spam; it can't be turned back into your address.

We request only read access to your Strava data. We never post to Strava or change anything in your Strava account.

Why we use it, and our legal basis

We use this data solely to calculate and display your progress along the trails you choose. Our legal basis is your consent, which you give by connecting your Strava account. You can withdraw it at any time (see below).

Who we share it with

We do not sell your data or share it for advertising. Data is processed by the services that run the app: Strava (the source of your activity data), Supabase (our database host) and Vercel (our web host). Messages you send us are delivered by Resend and ImprovMX (email delivery) to a Google Gmail inbox. Your data is stored in their infrastructure on our behalf.

How long we keep it

We keep your data for as long as your account is connected. If you disconnect, or revoke access from within Strava, we delete your profile details, tokens, stored activities and coverage. Messages you send us are kept only as long as we need them to deal with your request.

Your rights

You have the right to access, correct or delete your data, and to withdraw consent. The quickest way to delete everything is to revoke Pathbagger's access in your Strava settings: Strava tells us straight away and we delete your profile details, tokens, stored activities and coverage. For any other request, email admin@pathbagger.com or use the Help & support page. If you are unhappy with how your data is handled, you can complain to the UK Information Commissioner's Office (ico.org.uk).

Changes

If this policy changes, we will update the date at the top of this page.