legal

Privacy Policy

Last updated: June 2026

      The short version: we collect only what we need to show you your map. We never sell your data. You can delete everything at any time.
    

Who we are

un/charted is a personal activity mapping application available at map-the-world-app.pages.dev. The service is operated by an independent developer and is not affiliated with Strava, Garmin, or any other fitness platform.

What data we collect

We collect only the minimum data required to provide the service:

Account data — your email address, used for authentication only
GPS tracks — coordinate arrays from your activities, imported from Strava or uploaded manually
Activity metadata — activity name, date, distance, duration, and sport type
Strava connection tokens — OAuth access and refresh tokens, stored encrypted, used only to fetch your own Strava data
Profile data — your display username (auto-generated, can be changed)

We do not collect payment information, precise real-time location, health metrics beyond what Strava provides, or any data beyond what is necessary to render your personal map.

How we use your data

To display your activity routes on your personal map
To sync new activities from your connected Strava account
To authenticate you when you log in
If you opt in: to contribute your routes anonymously to a global community heatmap (no personal identifiers are shared)

We do not use your data for advertising, profiling, or any purpose beyond the core service described above.

Data storage and security

Your data is stored in a Supabase (PostgreSQL) database hosted in the EU. Access is protected by Row Level Security — meaning database-level policies ensure each user can only access their own data. Strava tokens are stored server-side and are never exposed to the browser or third parties.

We use HTTPS for all data transmission. No raw passwords are stored — authentication is handled via Supabase Auth.

Strava data

When you connect your Strava account, we request the activity:read_all scope. This allows us to read your activities and GPS routes. We do not request write access and cannot modify your Strava data. Your Strava credentials are never stored — only the OAuth tokens Strava issues to us.

Use of Strava data is subject to the Strava API Agreement.

Data sharing

We do not sell, rent, or share your personal data with any third parties. The only external services we use are:

Supabase — database and authentication hosting
Cloudflare Pages — frontend hosting and CDN
Stadia Maps — map tile rendering (your coordinates are not sent to Stadia)
Strava — only when you explicitly connect your account

Community heatmap (opt-in)

un/charted includes an optional global community heatmap. This feature is strictly opt-in. If you choose to participate, your GPS routes are contributed to an aggregated layer visible to other users. No personal identifiers, usernames, or account information are associated with contributed routes. You can withdraw your contribution at any time from your settings.

Your rights (GDPR)

If you are located in the European Economic Area or United Kingdom, you have the following rights:

Right to access — you can view all your data within the app
Right to deletion — you can delete all your GPS tracks or your entire account from the settings page at any time
Right to portability — your original files remain yours; Strava exports are available directly from Strava
Right to object — you can disconnect Strava and delete all imported data at any time

To exercise any of these rights, use the account settings within the app or contact us at the address below.

Data retention

We retain your data for as long as your account is active. If you delete your account, all associated data — including GPS tracks, activity records, and authentication tokens — is permanently deleted within 24 hours. Backups are purged within 30 days.

Children

un/charted is not directed at children under the age of 13. We do not knowingly collect data from children.

Changes to this policy

If we make material changes to this policy we will update the date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

Contact

For privacy-related questions or data requests, please contact us via the un/charted GitHub repository at github.com/LightningAndy/Map-The-World-App.