Privacy policy

Trajekt is a running dashboard. You upload your runs, and Trajekt shows them back to you: every route on a map, your times, your progress. Your runs are health data, so we treat them with the care the law asks for, and then some. This policy says what we keep, why, where, for how long, and what you can do about it.

Who we are

Trajekt is run by [operator name and address]. We decide what happens to your data, so under the GDPR we are its controller. You reach us at [contact email address] for anything in this policy.

What we keep

• Your account: your name, your email address, your password (only as a hash we cannot turn back into the password), your language, your units, your timezone and the day your week starts.
• Your runs: the files you upload and what we read from them: GPS routes, heart rate, pace, speed, cadence, elevation, power and the other values your device recorded, with the date and time of each. This is health data.
• Your consent: each time you gave or withdrew your consent to process health data, with the date and the version of this policy.
• Your sessions: a record per signed in device, with the device's IP address and browser name, so you can see and sign out your devices. A session ends after 30 days without use.
• Exports you ask for: the file we build when you request a copy of your data.

We never ask for or keep payment details, your location outside the runs you upload, or your contacts.

Why we keep it, and on what basis

• To run your account (the contract between us, GDPR article 6(1)(b)): your account details and sessions.
• To show you your training (your explicit consent, GDPR article 9(2)(a)): your runs. We use them only to show them to you. We never sell them, never use them for advertising, and never share them with anyone who is not listed below. You can withdraw this consent at any time on the consent page; we then keep your runs but stop showing or using them until you consent again or delete them.
• To keep Trajekt safe and working (our legitimate interest, GDPR article 6(1)(f)): short lived server logs, error reports with personal data removed, and counts of visits to our public pages without cookies.

Where it is kept, and who helps us

Everything is stored and processed in the European Union. These companies process data for us, each under a data processing agreement:

• Scaleway (France): hosting, database, file storage, backups and server logs, in Paris (fr-par).
• Lettermint (the Netherlands): sending our emails, such as the link to confirm your address.
• Bugsink (the Netherlands): error monitoring. Personal and health data is removed from every report before it leaves our servers.
• Plausible (Estonia): counting visits to our public pages, without cookies and without storing anything on your device. Your IP address is used only to tell visits apart and is never stored.

When you choose a new password, we check it against known data breaches by sending the first five characters of a hash of it to the Have I Been Pwned service. That fragment cannot be traced back to you or your password.

How long we keep it

• Your account and runs: until you delete them or your account.
• Runs you delete: in the trash for 7 days, so you can restore them, then gone.
• Accounts whose email address was never confirmed: deleted after 7 days.
• Exports: deleted 7 days after they are ready.
• When you delete your account, everything is deleted at once. Copies in our backups are gone within 7 days. We keep only an anonymous record that an account was deleted, with no name, email or other detail.
• Server logs: kept for Scaleway's standard retention and then deleted. They never hold your runs.

Your rights

You can do most of this yourself in Trajekt, and we answer every request within a month.

• See and take your data: request an export on the Privacy page. You get one file with everything: your profile, your consent history, every run with its route and samples, and your original files.
• Correct it: change your language, units, email and password in Settings.
• Delete it: delete a run from its page, or your whole account on the Privacy page.
• Withdraw your consent: on the consent page, at any time.
• Object or ask anything else: write to [contact email address].
• Complain: you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority where you live.

Cookies and storage on your device

Trajekt uses one cookie to keep you signed in and one to remember your language. When you are signed in, your browser also remembers whether the activity panel was open. That is all: no tracking cookies, no advertising, no cookie banner needed.

Security

Every connection is encrypted. Files are encrypted at rest. Passwords are stored only as hashes. Changing your email needs your old address to approve it, deleting your account needs your password, and changing your password signs out your other devices.

Changes to this policy

When we change how we process health data, we ask for your consent again before you can keep using your runs. The version and date of this policy are at the top of this page.