Privacy Policy

Last Updated: 13 Oct 2026

This Privacy Policy describes how GPXLAB (the "Application") handles information when you use the web application (gpxlab.app) or the mobile app (iOS and Android). GPXLAB is designed to work without an account — an account is optional.

1. Information We Process

Track Data on Your Device. By default, your tracks, points and projects are stored only on your device (browser storage or the app's local storage). We do not access them and they are not uploaded to our server unless you explicitly use a feature described below.

Shared Tracks. When you create a share link, the track name and the track data (GPS points in GeoJSON format) are uploaded to our server and stored under a random, unguessable identifier. We also render the track into a map image so the share page can display a preview. Shared tracks are kept for up to 7 days and then deleted.

Search Queries. When you use the search box, the place name or coordinates you type are sent to our server to find matching locations. We forward the query to the OpenStreetMap Nominatim geocoding service and may cache the results temporarily so popular places load faster.

Routing Requests. When you route a track, the start, end and intermediate points are sent to our routing engine. We process the request to compute the route; we do not store your routes.

Account. If you create an account, we store your email address, a hash of your password and — if you upload one — your avatar image. We use our own mail server to send you verification codes and account-related notifications.

Third-Party Sign-In. Signing in with Google, Facebook or Apple is optional. If you choose to sign in with one of these providers, the provider authenticates you and shares with us your name, your email address, a unique account identifier and — with Google and Facebook — your profile picture. When you sign in with Apple, you can choose to hide your real email address, in which case Apple gives us a private relay address that forwards to your real address without revealing it to us. We use this information only to create and authenticate your GPXLAB account. We never receive your password for your provider account.

Location. If you press the "Show my location" button, your device may share its current position with the Application. Your position is used only to display your location on the map and is not stored on our server.

IP Address. Your IP address is used to determine your approximate country or region so that the map opens centered on your part of the world, and to generate standard server access logs.

Analytics. The Application and the gpxlab.net website use Google Analytics to understand how the product is used (for example which pages are visited and how often). Google Analytics uses cookies and similar technologies. You can disable cookies in your browser settings, which will prevent analytics data collection without affecting the functionality of the map or the Application.

2. Use of Information

We use the information described above to provide the services of the Application: finding places, computing routes, storing tracks temporarily for sharing, centering the map, operating accounts and answering support requests. We do not sell your personal information to third parties. Information we receive from sign-in providers (Google, Facebook, Apple) is used only to create and operate your account: it is not used for advertising and is not shared with any third party.

3. Third-Party Services

The Application uses the following third-party services:

Map Data and Tiles. The Application displays map data provided by third parties: OpenStreetMap contributors, OpenTopoMap and Esri (satellite imagery). When your browser requests map tiles, those providers may receive standard technical information such as your IP address. We do not have access to data collected by those providers.

Geocoding. Place-name search is performed by the OpenStreetMap Foundation's Nominatim service, operated independently of us.

Sign-In with Google. You may sign in with a Google account (Google LLC). Google authenticates you and, with your permission, shares your name, email address and profile picture with us. The sign-in exchange is governed by Google's own Terms of Service and Privacy Policy.

Sign-In with Facebook. You may sign in with a Facebook account (Meta Platforms, Inc.). Facebook authenticates you and, with your permission, shares your name, email address and profile picture with us. The sign-in exchange is governed by Meta's own Terms of Service and Privacy Policy.

Sign-In with Apple. You may sign in with an Apple ID (Apple Inc.). Apple authenticates you and shares a unique identifier, your name and your email address (or a private relay address, if you choose to hide your real address). The sign-in exchange is governed by Apple's own Terms and Conditions and Privacy Policy.

Google Analytics. As described in section 1, we use Google Analytics (Google LLC) to measure how the Application and the website are used.

4. Data Retention

Shared tracks are kept for up to 7 days and then deleted. Account data (email address, password hash, avatar, and the identifiers that link your account to a sign-in provider) is kept until you close your account or ask us to delete it — see "Data Deletion" below. Server access logs are kept for a limited period for security and operational purposes.

5. Data Deletion

You can delete your data at any time:

• From within the Application. Signed-in users can close their account from the account profile at any time, which deletes your account data. Track and project data stored on your device can be removed with the "Delete all data" option in the Application's settings, or by clearing your browser or app storage.
• By request. Email us at hello@gpxlab.app to request deletion of your account and any personal data we hold about you. We respond to and act on deletion requests within 30 days.

When your account is deleted we remove your email address, password hash, avatar and the identifiers linking your account to a sign-in provider. Deleting your GPXLAB account does not delete data held by a sign-in provider about you; that is governed by the provider's own tools and policies. Share links expire automatically, and data processed by the third-party services in section 3 is governed by their own retention policies.

6. Data Security

We take reasonable measures to protect the data we store against unauthorized access. Please be aware that no method of transmission over the internet is completely secure. Because share links are based on a random identifier and do not require an account, we strongly recommend that you do not share a track link that contains sensitive location data you do not want others to see.

7. Your Rights

Depending on your country of residence (for example under the EU General Data Protection Regulation), you may have the right to access, correct or delete the personal data we hold about you, to restrict or object to its processing, and to port your data. To exercise any of these rights — including a request to delete your data — contact us at hello@gpxlab.app. We may ask you to verify your identity before acting. You also have the right to lodge a complaint with the competent data protection authority in your country.

8. Children's Privacy

The Application is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children.

9. Changes to Privacy Policy

We may update this Privacy Policy from time to time. The updated policy will be posted on this page with a revised "Last Updated" date.

10. Contact Us

If you have any questions or concerns about this Privacy Policy, including requests to access or delete your data, please contact us at hello@gpxlab.app.