Privacy Policy

1. Data controller

The controller of your personal data is: Serpent Development, ul. Tulipanów 7, 43-440 Goleszów, lkubok@gmail.com.

Contact for privacy matters: lkubok@gmail.com.

2. Data we process

Depending on how you use the app, we process:

• Account data: e-mail address, password (stored only as a hash by our authentication provider), Google account identifier if you sign in with Google, preferred language, optional avatar.
• Profile data you enter: body weight (used to compute pack and load figures).
• Content you create: gear items (names, weights, categories, optional photos or images), gear packs, trips, routes and waypoints, checklists and stress-test results.
• Usage records: AI request counters and limits, map-service call records, and security and error logs (including your internal user id).
• Technical data: IP address and browser information transmitted when you load pages, map tiles or API requests.

3. Purposes and legal bases

• Providing the service you requested — account, trips, gear vault, route planning, checklists (Art. 6(1)(b) GDPR, performance of a contract).
• AI features — gear descriptions, photos and trip details you submit are sent to AI providers to produce suggestions (Art. 6(1)(b) GDPR). Submitting a photo or text to an AI feature is your own action.
• Security, abuse prevention, rate limits, error monitoring and service stability (Art. 6(1)(f) GDPR, legitimate interest).
• Compliance with legal obligations, where applicable (Art. 6(1)(c) GDPR).

4. Recipients and processors

We use the following service providers, who process data on our behalf or receive it as described:

• Supabase — authentication and database hosting.
• Cloudflare — application hosting, network delivery and a scheduled account-deletion job; request logs may include your user id.
• OpenRouter and the AI model providers it routes to — receive the text, trip details and gear photos you submit to AI features.
• Mapy.com (Seznam.cz, a.s., Czech Republic) — route calculation, elevation and place search receive coordinates and search text; your browser also loads map tiles directly from Mapy.com, so your IP address is visible to it.
• Wikimedia Commons — gear names may be sent to look up illustrative images.
• Sentry — error and performance monitoring; we send an internal user id and technical error data, with e-mail, IP address and request contents removed.
• Google — only if you choose to sign in with Google.

5. International transfers

Some providers (for example AI, monitoring and hosting providers) may process data outside the European Economic Area, including in the United States. Where this happens we rely on an adequacy decision or on Standard Contractual Clauses provided by the relevant provider.

6. Retention

• Account and content data are kept while your account exists.
• When you delete your account it is deactivated immediately and permanently deleted after a 30-day grace period, during which you can restore it. Your content, usage records and account are then erased.
• Stress-test results are kept in anonymised form (no link to you) after deletion for service statistics.
• Technical and security logs are kept by our providers for a limited period under their standard settings.

7. Public share links

If you create a share link for a trip, anyone who has the link can see the trip name and the route (line, waypoints and elevation profile). Your identity, gear, weights and dates are not shown. You can revoke the link at any time and it stops working immediately. Do not put personal data in trip names or at your home address as a start point if you do not want it visible.

8. Your rights

Under the GDPR you have the right to:

• access your data and obtain a copy;
• rectify inaccurate data (you can edit most data directly in the app);
• erase your data (use Delete account on the Account page);
• restrict or object to processing based on legitimate interest;
• data portability;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a supervisory authority (in the EU, the data protection authority of your country of residence, work or the place of the alleged infringement).

9. How to exercise your rights

Write to lkubok@gmail.com. Some data can be exported directly (route GPX files); for other access or portability requests we will respond within one month.

10. Automated decisions and AI

AI features produce suggestions only. We do not take decisions that have legal or similarly significant effects on you based solely on automated processing. AI output can be wrong; always verify it.

11. Children

The service is not directed at persons under 16 and we do not knowingly collect their data.

12. Changes

We may update this policy. The date of the latest update is shown at the top of this page.