Privacy Notice

Version: draft, 2026-11-09.

What data arises when you use TrailBuffer, what stays on your device, what reaches the provider and others, for how long, and what your rights are.

1. The controller

The controller is the provider of TrailBuffer (details in the Imprint). For privacy matters, write to [DATA – support address, T92].

[LAWYER – KT1] How the controller is named, depending on the legal form.

2. In short

• No account, no sign-in, no sync, and no route storage on the server.
• No telemetry: the app sends no location or movement data, and uses no analytics or advertising code.
• Your routes, GPS track, settings and walks are only on your device.
• Only the data needed for license activation reaches the provider (section 4), and the servers keep technical logs (section 4).
• The purchase is handled by Lemon Squeezy as an independent controller (section 5).
• Your browser requests the tiles of the online map directly from third parties (section 6).

3. Data that stays on your device

This is held in the browser's storage (localStorage, sessionStorage, IndexedDB, cache); the provider has no access to it and does not receive it.

• Your own routes (GPX), time limits, checkpoints, settings, the interface language and theme.
• The state of the walk and the GPS track during live tracking, to restore an interrupted walk.
• The learned pace data (Pro).
• The version and time of your acceptance of the safety notice.
• The license key, a random device identifier generated on the device, and the entitlement token (Pro).
• The downloaded map regions and the app's offline files.

Deletion: the "Delete all my data" button in the app deletes all of this from this device in one step (it does not run during tracking or without internet, and the app says so). You can also delete the site data in your browser settings. Details: Local Storage, Third Parties and Map Attribution.

4. License activation, renewal and technical logs

License activation and renewal (Pro). When you enter the license key, and later when the app renews the entitlement while online, the following reaches the provider's server (Microsoft Azure):

• the license key;
• the random device identifier generated on the device (not the device's hardware identifier);
• the device name in the form TrailBuffer PWA (<platform>), where the platform is the operating system reported by the browser (e.g. Android);
• on renewal, the Lemon Squeezy activation identifier.

The server forwards the key and the device name to Lemon Squeezy for checking and activation, then returns a signed entitlement token that also contains the device identifier. The server does not store this data in a database.

• Purpose: providing the Pro pass, enforcing the device limit and preventing abuse.
• [OPEN – T88] A hash of the device identifier goes to Lemon Squeezy instead; listing and releasing devices in the app.

Technical logs. The servers (Microsoft Azure, Cloudflare) log every request: IP address, time, the requested address, browser details. This covers loading the app, license activation and downloading map regions.

• Purpose: operational security, troubleshooting, investigating abuse.
• Retention: [DATA – retention of the Azure and Cloudflare logs].

Downloading map regions (Pro). Only happens when you explicitly download a region. The file comes from Microsoft Azure storage (depending on the configuration, through Cloudflare); the request goes into the technical logs above.

[LAWYER – Ü3] The legal bases per data category (draft assumption: performance of the contract for the license data, legitimate interest for the logs), and whether a legitimate interest assessment is needed.

5. Purchase

You buy on the Lemon Squeezy checkout page. Your name, email address, billing address and payment details are processed by Lemon Squeezy and its payment partners, under their own privacy notices. The provider does not receive your card details.

[LAWYER – KT2] The role of Lemon Squeezy (independent controller for the purchase), and what purchase data the provider sees in the Lemon Squeezy dashboard (order, license key, email address).

6. Online map: third parties

If you open the normal (raster) map while online, your browser requests the tiles directly from this provider. It receives your IP address, your browser details and the identifier of the area viewed:

• OpenTopoMap (opentopomap.org): the only online map layer.

The provider has no contract with it and receives no data from it. The vector map shows only the downloaded region, from the device, and the font of its labels comes from TrailBuffer's own server: no request goes to a third party for it. Without internet the OpenTopoMap requests are not made either.

[LAWYER – Ü3] How to handle the IP address reaching a third party (notice, consent or removal).

Fonts (outside the map) and code libraries are served from TrailBuffer's own server; there is no Google Fonts and no external code CDN.

7. Processors and transfers outside the EU

• Processors: Microsoft Azure (app, API, map regions, logs; the app runs in the EU, in the Sweden Central region), Cloudflare (domain, DNS, content delivery, logs).
• Independent controller: Lemon Squeezy and its payment partners (purchase, invoice, VAT, license key).
• Third parties without a contract: section 6.

Cloudflare and Lemon Squeezy are US companies, and Microsoft belongs to a US group, so the data may also be accessed from outside the EU.

[LAWYER – Ü3] The legal basis of the transfer (EU–US Data Privacy Framework or standard contractual clauses), and whether a data processing agreement with Azure and Cloudflare is needed ([DATA]: the DPAs in place).

8. Retention

• Data on your device stays until you delete it (section 3).
• No license data is kept on the provider's server; technical logs: section 4.
• Lemon Squeezy keeps the purchase data under its own rules and the accounting regulations.

9. Your rights

You can ask for access, rectification, erasure, restriction and data portability, and object to processing based on legitimate interest. As the provider stores no account and no route data, only you can access the data on your device; you can delete it with the "Delete all my data" button in the app. For any other request, write to [DATA – support address, T92].

You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), and you can also go to court.

[LAWYER – Ü3] The response deadline, handling requests concerning log data, and whether a section on children is needed without accounts.

10. Field validation

The app does not collect tracks. To check the model, the developer collects a few real, time-stamped tracks by hand before release; other people's tracks only with written consent, a deletion commitment and pseudonymised.

[LAWYER – Ü4] Whether this needs to be in the public notice or a separate consent form is enough; how the data is classified and whether an impact assessment is needed.

11. Changes to this notice

Changes are shown in the app and on the website. [LAWYER – Ü3] How changes are communicated without an account.