Privacy Policy

What this is

Summit Tracker connects to your Strava account, finds the summits in your activities, and adds a short line to the activity description. This page explains what we collect, why, who handles it, and how you control it.

What we ask Strava for

When you connect, you approve two permissions: reading your activities (including private ones, so we can check them) and writing to them (so we can add the summit line). We never post, change or delete anything else. You don’t have to connect, and you can disconnect at any time.

What we store

• Your Strava account details: your Strava ID, name, profile picture link and username.
• Access to your account: the tokens Strava gives us so we can keep working, stored securely and never shown to anyone.
• Your summits: which peaks you’ve reached, how many times, and the dates.
• A record of each activity we checked: its Strava ID, date, what we found, and the nearest peaks the route came close to with a rounded distance (for example “about 300 m”). We also keep a few measures we calculate, such as the Hurt Index, and the kind of device used (a watch brand or a phone), never the model.
• A backup of your activity descriptions: the text before and after we add our line, so we can never lose what you wrote.
• Your feedback: anything you submit on the Activities page, such as a note about a missed summit.
• Your settings, such as units.

What we don’t store: your GPS routes. Routes are read when an activity is checked and aren’t kept. We keep no exact coordinates, no heart-rate or other sensor data, and no photos.

Why we use it, and our legal basis

To count your summits, write the summit line, show your pages and stats, and fix mistakes, which we do with your consent (the Strava permission you give). We also use it to keep the service secure and working, which is our legitimate interest. We don’t sell your data, use it for advertising, or use it to train AI. We make no automated decisions that have legal or similarly significant effects on you.

Who sees it

• You: only you can see your activities and your Activities page.
• Everyone else: public pages show totals only, with no names.
• The site owner can see athlete data when needed to run and fix the service.

Who processes it for us

• Google Cloud: hosts the site and the database (United States).
• Telegram: the owner receives alerts about the service. These include your first name.
• OpenStreetMap: to look up peaks near a route we usually use our own copy of the data. When that can’t answer, points from the route are sent to public OpenStreetMap servers (Overpass), without your name or ID.
• Amazon Web Services (public elevation data): to draw a terrain share card we fetch public map tiles of the land around a place from Amazon’s open data service (Mapzen Terrain Tiles, based on USGS, SRTM and other public elevation data). Our servers ask for the tiles, so the request contains only the tile’s position, with no name, ID or route, and we keep a copy so we rarely need to ask again.
• Strava: supplies the data and receives the description line we write. When you are signed in, your browser also loads your own profile picture directly from Strava image servers.

Our own page counts: we count page views ourselves, on our own servers: which page, which site sent you, and whether you used a phone or a computer. There are no cookies for this, no IP addresses and nothing that identifies you. If a page breaks in your browser it can send us the error message, with no personal details. Google Cloud also keeps its standard server logs (which include IP addresses) for 30 days, for security and fixing problems. We use no advertising services and no third-party analytics.

Moving data between countries

Some of these services process data outside your country, including in the United States. We rely on the safeguards these providers offer for international transfers.

Cookies

One cookie keeps you signed in and remembers short-lived choices, such as a hidden prompt and where you first arrived from. It stays for 30 days after your last visit, so you don’t have to sign in again each time; signing out removes it. It’s ours only, and it isn’t used for advertising or to follow you across other sites. We use no analytics or advertising cookies.

How long we keep it

For as long as you’re connected. When you disconnect, we delete your data (see below).

Your rights and choices

• Leave and delete: remove Summit Tracker in your Strava app settings. We then delete all your data automatically. You can withdraw your consent this way at any time.
• Access and portability: when signed in, use “Download my data” in Settings. Otherwise use the form below or email us.
• Correction: use the review form on your Activities page.
• Other rights: you may ask us to restrict how we use your data or to stop using it where we rely on legitimate interests. Use the form below.
• Complaints: you can complain to your data protection authority, for example the ICO in the UK.
• Questions or requests: use the form below. We reply within 30 days. If you can’t use the form, email us (needs JavaScript).

Deleted activities

If you delete an activity on Strava, we stop showing it.

Security

Data is stored in Google Cloud with access limited to the owner. If we discover a breach affecting you, we’ll tell you and Strava promptly.

Age

You must be old enough to use Strava: at least 13, or older where your local law requires. If you’re under the age of a binding contract where you live, use Summit Tracker only with a parent’s or guardian’s permission, as Strava’s terms require. We collect nothing beyond what Strava shares with us.

Strava

Summit Tracker uses the Strava API and is not endorsed or sponsored by Strava. “Powered by Strava” and related marks belong to Strava. Your use of Strava is governed by Strava’s own terms and privacy policy.

Changes

If we change this policy in a way that matters to you, we’ll say so on this page and note the date.

Ask for a copy of your data, a correction, or anything else about your privacy. Your message goes to the site owner and nothing else is stored.