Privacy Policy
summit.day (“we”, “us”) is a web app for planning and reviewing mountain routes. You can load a route from a GPX file or from a service you connect, see it on a 2D and 3D map, and view an elevation profile. This policy explains what data we handle, why, and what control you have over it.
1. Who is responsible
summit.day is operated jointly by its two founders, Jost Kobusch and Michal Frankowski, who are together responsible for the personal data described here. For anything in this policy, including access and deletion requests, write to [email protected]; either founder can act on your request.
2. What we collect
Account
If you sign in (with Google, Strava, WHOOP or Zepp) we store the name and email address the provider returns, a session identifier in a cookie, and your own settings (such as username, display name and units). Signing in is optional for viewing a shared route.
Routes and activities you provide
GPX files you upload, routes you plan, and activities imported from connected services. These contain GPS positions, elevation and timestamps, and may reveal where you live or train. They are used to draw your route and compute distance, elevation gain and speed.
Data from connected services
If you connect an account (Garmin, Strava, Zepp or WHOOP), we receive the data you authorise that service to share with us, such as activities with their GPS track, elevation and timestamps, and for some services heart rate or recovery data. We request only what the features need, and only after you approve the permissions shown by that service.
Technical data
Our web server keeps standard access logs (IP address, time, requested URL, browser type). The app can send us anonymous error reports from your browser to help fix bugs. We use a cookie to keep you signed in and your browser’s local storage for preferences such as map layer and units. We do not use advertising or cross-site tracking cookies.
3. How we use data
- To show you your routes, profiles and statistics.
- To keep your connections to Garmin, Strava, Zepp and WHOOP working (for example by refreshing access tokens).
- To operate, secure and fix the service.
We do not: sell or rent personal data; use it for advertising or profiling; combine it with data from other sources to build profiles; or use it to train, fine-tune or evaluate AI or machine-learning models.
4. Garmin data
- We access Garmin data only after you connect your Garmin account and give your consent. You can withdraw it at any time in your Garmin account settings or from summit.day.
- We use Garmin data only to provide the summit.day features you use. We do not sell it, do not use it for advertising, and do not use it to train or operate AI or machine-learning systems.
- If you send a route from summit.day to Garmin, we first tell you what will be sent and ask for your consent.
- If you disconnect Garmin in summit.day (Profile → Connected accounts), we tell Garmin and delete the activities we imported from it. You can also ask us to access, correct, export or delete the Garmin data we hold about you (see section 8).
- Garmin data is not sold and not shared with any third party. No AI or data-processing service receives it. The only parties that handle it are those needed to run the service, listed in section 5.
- Our use of Garmin data is also subject to Garmin’s terms.
5. Who we share data with
We do not sell your personal data or share it with third parties for their own purposes. These providers handle data only to run the service:
- Our server hosting provider — hosts the server on which your data is stored.
- Cloudflare — delivers and protects the website and routes email for our domain, so web requests pass through its network.
- Map and imagery providers (for example IGN, OpenTopoMap, Esri) — your browser requests map tiles from them, so they see the map area you are looking at and your IP address. We do not send them your routes or account data.
- The services you connect — we exchange data with them only as you authorised.
We may disclose data if the law requires it.
6. How long we keep data
We keep data only as long as needed to provide the service, or until you disconnect a service or ask us to delete it. Some data is held in temporary storage and removed periodically. Server logs and error reports are kept for a limited period.
7. Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) and restricted access. If a breach affecting your data occurs, we will notify those affected as required by law.
8. Your rights and choices
- See, correct, export or delete the data we hold about you — email the address above.
- Disconnect a service at any time from your account panel in the app, or from that service’s own settings.
- Withdraw consent, object to processing, or complain to your data protection authority.
We will reply within 30 days. Where GDPR applies, our legal bases are your consent (for connecting a service), performance of the service you asked for, and our legitimate interest in keeping the service secure and working.
9. Children
summit.day is not directed at children under 16, and we do not knowingly collect their data.
10. International transfers
Our server and providers may be located outside your country. Where required we rely on appropriate safeguards for such transfers.
11. Changes
If we change this policy in a way that matters, we will update the date at the top, and if we begin using your data for something new we will ask for your agreement first.
12. Contact
Questions or requests: [email protected]