Untrack Cycling — Privacy Policy

**Last updated:** July 8, 2026

This Privacy Policy explains how Untrack Cycling collects, uses, stores, shares, and protects information when you use the Untrack Cycling mobile application, website, subscription features, route planning tools, ride recording tools, and related services (together, the “Service”).

1. Who We Are

The Service is operated by **Kosma Artur Lenar**, conducting business under the registered business name **Kosma Lenar ADHOC** (“Untrack,” “we,” “us,” or “our”).

**Operator / Application Provider / Controller:** Kosma Artur Lenar conducting business under the registered business name **Kosma Lenar ADHOC**

**Registered business address:** Modrzewiowa 11, 32-020 Wieliczka, Poland

**NIP:** 6831930905

**REGON:** 12127555900000

**Website:** https://untrack.cc

**Support:** support@untrack.cc

**Billing:** billing@untrack.cc

**Privacy:** privacy@untrack.cc

**Legal notices:** legal@untrack.cc

For purposes of applicable data protection laws, Kosma Artur Lenar conducting business under the registered business name Kosma Lenar ADHOC is the controller of personal information processed in connection with Untrack Cycling, except where a third party such as Apple acts as an independent controller for its own services.

2. Information We Collect

We collect the following categories of information depending on how you use the Service.

Account and authentication data

This may include your name, email address, user ID, Apple Sign In identifier, login method, password authentication data such as password hashes for email/password accounts, account settings, and account status.

Profile and preference data

This may include cycling preferences, route preferences, saved settings, profile information, preferred route types, and optional content you choose to add.

Location data

This may include precise location, approximate location, GPS tracks, route start and end points, route points, points along route, map interactions, location search context, geospatial context, and background location while ride recording is active.

Ride and fitness data

This may include ride recordings, distance, duration, speed, pace, elevation, auto-pause events, activity summaries, route history, and related cycling metrics.

Route and user content

This may include saved routes, generated routes, route names, route notes, route points, GPX exports, shared routes, feedback, support messages, and other content you submit, create, save, export, or share in the Service.

Subscription and purchase data

This may include App Store subscription status, product identifier, entitlement status, trial status, renewal or cancellation status, transaction identifiers, receipt-related identifiers, and subscription information received through Apple and RevenueCat. We do not receive or store your full payment card details.

Current Pro subscription product identifiers used in the app purchase flow include `untrack_pro_monthly` and `untrack_pro_season`.

Device, usage, notification, and diagnostic data

This may include device type, operating system, app version, language, region, website visits, page views, referral and campaign parameters, feature interactions, product interactions, internal diagnostics, server logs, error logs, security logs, route quality diagnostics, Mapbox attempt diagnostics, request metadata such as IP address and user agent, and push notification tokens such as Expo push tokens where notifications are enabled.

Communications

This may include support requests, emails, feedback, and other messages you send to us.

3. Location and Background Ride Recording

Untrack uses location data to provide route generation, route recommendations, map display, route context, weather context, ride recording, background ride recording, auto-pause ride metrics, activity summaries, and GPX export.

Background location is used only when a feature that requires it is active, such as ride recording, and only according to the permissions you grant through your device settings. You can change location permissions in iOS settings.

GPS and location data may be inaccurate or unavailable due to device settings, battery settings, operating-system restrictions, GPS signal, network conditions, environmental conditions, or provider outages.

4. Where Information Comes From

We receive information from:

• you, when you create an account, set preferences, save routes, start ride recording, export GPX files, contact support, or share content;
• your device, when you grant permissions such as location, background location, notifications, or motion/fitness permissions where applicable;
• Apple, for Sign in with Apple, App Store purchases, subscription status, app distribution, and device-level permissions;
• RevenueCat, for subscription entitlement management, purchase validation, restore purchases, and subscription status;
• our backend, database, and infrastructure providers, including Supabase, for account, route, ride, API, database, storage, and app functionality;
• map, routing, elevation, search, geospatial, OpenStreetMap/Overpass, and weather providers, when needed to provide route, weather, road context, elevation, map, and route confidence features;
• Expo Push Notifications, when notifications are enabled;
• internal diagnostics, server logs, security systems, and support processes.

5. How We Use Information

We use information to:

• create, authenticate, secure, and manage your account;
• provide route generation, route recommendations, saved routes, route points, route context, weather context, training route planning, ride recording, background GPS recording, auto-pause metrics, activity summaries, and GPX export;
• provide Untrack Pro, verify subscription status, process entitlements, restore purchases, and manage the one-time app-level trial where available;
• personalize route preferences and app experience;
• send service messages, support responses, security notices, and optional notifications where enabled;
• debug errors, monitor performance, maintain security, prevent abuse, and improve product quality;
• improve map, route, road context, and route reliability using aggregated, de-identified, or privacy-preserving information;
• comply with legal obligations, respond to lawful requests, enforce our Terms, resolve disputes, and keep required records.

6. Legal Bases for Processing

Where GDPR or similar law applies, we process personal information under the following legal bases:

• **Performance of a contract:** to create and manage your account, provide core app features, route generation, ride recording, saved routes, GPX export, Untrack Pro, subscription entitlement management, and support.
• **Consent:** for device permissions such as precise location, background location, notifications, or motion/fitness permissions where required by law or platform rules. You can withdraw device-level permissions in iOS settings.
• **Legitimate interests:** to maintain security, prevent fraud and abuse, debug errors, run internal diagnostics, improve product quality, improve route reliability, protect our rights, and understand feature performance in a privacy-conscious way.
• **Legal obligations:** to comply with tax, accounting, consumer protection, data protection, legal request, and regulatory obligations.

7. No Sale, No Tracking Ads, No AI Training on Personal Routes

We do not sell personal information. We do not use third-party tracking advertising SDKs. We do not use personal routes, rides, GPS tracks, or location history to train AI models in the current version of Untrack.

We may use aggregated, de-identified, or privacy-preserving information to improve product quality, route reliability, road context, performance, and safety-related context. If this changes materially, we will update this Policy and provide any notice or consent required by law.

8. Subscriptions, RevenueCat, and App Store Purchases

Untrack Pro subscriptions are purchased through Apple In-App Purchase. Apple processes payments and may act as an independent controller for App Store payment and account services.

We use RevenueCat to validate purchases, manage entitlements, restore purchases, and understand subscription status. RevenueCat may process subscription-related identifiers, product IDs, entitlement status, transaction or receipt-related data, and app user identifiers as needed to provide subscription management.

We do not receive or store your full payment card number.

Deleting your Untrack account does not automatically cancel your Apple App Store subscription. You must cancel subscriptions through your Apple Account settings.

9. Service Providers and Sharing

We share information with service providers only as needed to operate, secure, support, and improve the Service; comply with law; or provide features you request.

Current or potential providers used by the Service include:

• **Apple:** App Store distribution, Sign in with Apple, Apple In-App Purchase, subscription management, and device permission systems.
• **RevenueCat:** subscription entitlement management, purchase validation, restore purchases, and subscription status.
• **Supabase:** backend infrastructure, Supabase Edge Functions, API gateway, database, storage, and related infrastructure.
• **Mapbox:** native and web maps, cycling directions, map display, search, geospatial context, and Terrain-RGB elevation data.
• **GraphHopper:** cycling routing where configured in the route engine.
• **OpenRouteService:** optional cycling routing where enabled in the route engine.
• **OpenStreetMap / Overpass API:** points of interest, road context, and map/context enrichment.
• **WeatherAPI.com:** weather forecasts and route/weather context.
• **Google Analytics:** website traffic measurement, aggregate usage analytics, referral attribution, and campaign performance measurement.
• **Expo Push Notifications:** delivery of push notifications where notifications are enabled.
• **Internal diagnostics and server logs:** performance, security, debugging, route quality diagnostics, and abuse prevention.

We use Google Analytics on the website to understand aggregate traffic, referrals, and campaign performance. We do not currently use third-party crash-reporting SDKs in the mobile app release. If this changes in a later version, we will update this Policy and any App Store privacy disclosures as required.

We may also disclose information if required to comply with law, enforce our Terms, protect rights, investigate abuse, respond to legal requests, or in connection with a business transfer such as merger, acquisition, restructuring, or sale of assets.

10. Public or Shared Content

Public or shared routes, rides, profiles, links, and GPX files may be visible to other users or recipients depending on your settings and sharing choices.

Location data can reveal sensitive information, including home or work locations, routines, training habits, favorite roads, and places you visit. We recommend reviewing routes before sharing and avoiding publication of sensitive start or end points.

Recipients may copy, save, screenshot, export, forward, or re-share content outside Untrack.

11. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

As a general rule:

• account data is retained while your account is active and until deletion is completed;
• saved routes, rides, GPX files, preferences, and profile data are retained until you delete them or delete your account;
• app-level trial records may be retained to prevent repeated trial abuse and manage entitlement status;
• subscription entitlement records are retained while your subscription or account is active and for a limited period afterwards as needed for support, fraud prevention, accounting, tax, legal, and dispute purposes;
• internal diagnostic, error, performance, route quality, and security logs are normally retained for up to 90 days unless needed longer for security, debugging, fraud prevention, legal, or dispute purposes;
• support communications are normally retained for up to 24 months unless needed longer for legal, security, or dispute purposes;
• backup copies may remain for up to 90 days before being overwritten or deleted;
• aggregated or de-identified data may be retained for product analytics, reliability, and improvement without identifying you.

You may request deletion of your account in the app, currently available in **Settings → Profile → Delete Account**, or by contacting privacy@untrack.cc.

After deletion, we delete or de-identify personal information associated with your account unless we need to retain limited information for legal compliance, security, fraud prevention, accounting, dispute resolution, backups, or enforcement of our Terms.

Deleting your Untrack account does not automatically cancel your Apple App Store subscription. You must cancel subscriptions through your Apple Account settings.

12. Your Choices and Rights

Depending on your location, you may have the right to request access to your personal information, correction, deletion, portability, restriction of processing, objection to processing, and withdrawal of consent where processing is based on consent.

You can control device permissions, including location, background location, notifications, and motion/fitness permissions where applicable, through iOS settings.

You may exercise privacy rights by contacting privacy@untrack.cc. We may need to verify your identity before responding. We will respond within the period required by applicable law. In the European Economic Area, this is generally within one month, unless an extension is permitted for complex requests.

You also have the right to lodge a complaint with a data protection authority. If you are in Poland, the competent authority is the President of the Personal Data Protection Office (UODO).

13. International Transfers

Some service providers may process information outside your country, including outside the European Economic Area or the United Kingdom.

Where required, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, data processing agreements, the EU-U.S. Data Privacy Framework where applicable, transfer impact assessments, or other lawful transfer mechanisms.

14. Security

We use reasonable technical and organizational measures designed to protect personal information, including access controls, authentication, backend security measures, logging, and operational safeguards.

No method of transmission, storage, or processing is completely secure. We cannot guarantee absolute security.

You are responsible for keeping your account credentials secure and for configuring your device permissions appropriately.

15. Children

Untrack is not intended for children under 13. In the European Economic Area or the United Kingdom, where a higher age of digital consent applies, Untrack is not intended for users below the age at which they can lawfully consent to the processing of their personal information without parental consent.

We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided us with personal information, contact privacy@untrack.cc.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify you, such as by updating the date above, posting notice in the app, or using another appropriate method.

Your continued use of the Service after the updated Policy becomes effective means you acknowledge the updated Policy.

17. Contact

For privacy questions or requests, contact:

**Kosma Artur Lenar conducting business as Kosma Lenar ADHOC**

Modrzewiowa 11

32-020 Wieliczka

Poland

NIP: 6831930905

REGON: 12127555900000

Email: privacy@untrack.cc

Website: https://untrack.cc