← Back to home

Privacy Policy

Who we are

Trail Tales is operated by Ben Marshall, who acts as the data controller for the personal data collected through this service.

If you have any questions about this policy or how we handle your data, contact us at: datacontroller@trailtales.life

What data we collect

Account information. When you register for an account using email and password, we collect your name, email address, and a password (stored as a salted hash; your plaintext password is never accessible to us).

Google sign-in. If you choose to sign up or log in using Google, we receive your name, email address, and Google profile information from Google. Google's use of your data is governed by their privacy policy at policies.google.com/privacy. We use this information solely to create and manage your account.

User content. You may upload or create trip journals including written stories, photographs, GPX/FIT files, and associated metadata. This content may contain personal data, such as photos of identifiable individuals or location data embedded in GPS tracks.

Site preferences. Your theme and colour palette preferences are stored in your browser's local storage. This data is not transmitted to our servers.

We do not collect analytics data, tracking cookies, or browsing behaviour data. IP addresses are processed only to the extent necessary for the operation of the service.

How we use your data

We use your data only for the purpose of providing and maintaining the Trail Tales service:

• Your account details are used to authenticate you and manage your access to the service.
• Your published trip content is displayed as web pages to visitors of the service.
• Your email address is used for account-related communications, such as password reset and verification emails, and, with your consent, occasional service updates.

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

Lawful basis

Under UK data protection law, we process your personal data on the following bases:

• Contract (Article 6(1)(b) UK GDPR): Processing your account information is necessary to perform our obligations under our Terms of Service.
• Legitimate interests (Article 6(1)(f) UK GDPR): Processing your published content is necessary to operate the service and display your content as you have instructed.
• Consent (Article 6(1)(a) UK GDPR): We will obtain your consent before sending marketing communications or processing your data for any purpose not described above.

Who we share data with

We engage the following third-party service providers to operate Trail Tales:

• Cloudflare, Inc. — stores and serves your content (including photos and GPX files) through its content delivery network. Cloudflare acts as a data processor under our instruction. We have entered into a data processing agreement with Cloudflare in accordance with Article 28 UK GDPR. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.
• Infrastructure provider — hosts the server infrastructure that runs the application and stores data. This provider is currently located in the UK.
• Komoot (Photon API) — when you upload a GPX or FIT file, we send the start coordinates to Komoot's Photon geocoding API (photon.komoot.io) to automatically determine the location name of your trip. Only GPS coordinates are transmitted; no personal identifiers or API credentials are included. Komoot's privacy policy is available at komoot.com/privacy.
• OpenStreetMap — provides map tiles for interactive trip maps. When you view a trip page, your browser requests map tiles directly from OpenStreetMap's tile servers. OpenStreetMap's privacy policy is available at wiki.osmfoundation.org/wiki/Privacy_Policy.

Where your data is stored

Your data is stored on servers located in the UK and Europe. Cloudflare's global edge network may cache content in data centres worldwide. Cloudflare participates in the EU-US Data Privacy Framework and UK Extension for international data transfers.

Data retention

We retain your personal data only for as long as you maintain an active account. Specifically:

• Account data: Retained until you delete your account or request deletion.
• Published trip content: Retained until you delete the trip or your account. Published pages may remain cached in Cloudflare's CDN for a short period after deletion.
• Logs and system data: Server logs and cached build artefacts are retained for a limited period for operational and security purposes.

When you delete your account, we permanently delete your personal data. If you require assistance, contact us at datacontroller@trailtales.life.

Your rights

Under UK data protection law, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data, subject to certain exceptions.
• Right to restriction: Request restriction of processing in certain circumstances.
• Right to data portability: Request a copy of your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.

To exercise any of these rights, contact us at datacontroller@trailtales.life. We will respond within one month of receiving your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint.

Cookies and local storage

We do not use tracking cookies. We use your browser's local storage to remember your theme and colour palette preferences. This data remains on your device and is not transmitted to our servers. No other cookies or tracking technologies are used.

Security

We implement appropriate technical and organisational measures to protect your data:

• Passwords are hashed before storage.
• All traffic is served over HTTPS.
• EXIF data, including GPS location, is removed from uploaded photos before they are displayed.
• Access to server infrastructure is restricted and authenticated.

Changes to this policy

If we make material changes to this policy, we will notify users by email and update the "Last updated" date at the top of this page.

Contact

Data controller: Ben Marshall (Scotland, UK)

Email: datacontroller@trailtales.life