Privacy policy
Last updated 21 October 2026
This policy explains what personal data Waymarker collects when you use the Android app or this website, why, who it is shared with, how long it is kept and what your rights are. We try to collect as little as we can. It is written to meet the UK GDPR and the Data Protection Act 2018.
1. Who we are
The data controller is Christian, trading as HDLM studios, based in the United Kingdom ("we", "us"). You can contact us at hdlmstudios@gmail.com.
The app is for people aged 16 or over. Please do not use it, or create an account, if you are younger.
2. The short version
- To sign you in we need your email address and, if you choose one, a password. The password is stored only as a one-way hash by Supabase, so nobody (including us) can read it.
- Anything you post (condition reports, feature pins) is shown to other riders with your display name, if you set one.
- Your phone uses your location to show you on the map. A ride only leaves your phone when you tap Save.
- We count how the app is used in our own database, only if you agree. There are no advertising or analytics companies involved, and you can change your answer in Settings, Privacy.
- We do not sell your data or show adverts.
- You can delete your account, and everything linked to it, at any time.
3. What we collect, why, and our lawful basis
Your account
What: your email address (you sign in with a password, or with an emailed link or code) and an optional display name.
Why: to create your account and sign you in. If you set a display name it is shown publicly next to the condition reports and feature pins you post.
Lawful basis: contract (to provide the account you ask for).
What you contribute
What:
- Condition reports: the trail, a status, an optional note, the time and your display name. They are visible to Pro riders for 30 days.
- Feature pins: a type (for example a jump), a point on the map, an optional note, your display name, and upvotes from other riders.
- Flags you raise on other people's content, so that it can be moderated. Three flags hide an item.
Why: to show riders what a trail is like and where its features are, and to keep that content accurate and safe.
Lawful basis: contract for your own reports and pins; legitimate interests (keeping shared content accurate and safe) for flags and moderation.
Rides and routes (Pro)
What: a ride is recorded on your phone, using background location (the app shows a "Recording ride" notification while it does) and the motion sensors for jump detection. Nothing is uploaded until you tap Save. Then we store a simplified GPS track, times, distance, climb, speed and your jumps (the point and the airtime). Saved routes are the routes you plan on trail sections.
Why: to show you your rides and stats and let you export them as GPX. Jump points are also combined anonymously across riders: when three or more riders jump the same spot, it is marked as a "confirmed jump" on the map for everyone, without saying whose jumps they were.
Lawful basis: contract (the Pro features you ask for); legitimate interests for the anonymous combining of jump points (improving the map).
Your location
What: the app uses your phone's location to show you on the map. When you use Near me, approximate coordinates are sent to our server to find nearby riding areas; they are not stored. Background location is used only while you are recording a ride.
Lawful basis: contract (it is how the feature works). You control it through Android's location permission, and can withdraw it at any time.
Usage statistics
What: a random install ID made by the app (it is not your advertising ID), and events such as the screens you open, the features you use, the Pro page and purchases, plus the app version and platform. If you are signed in the event also carries your account ID. We never record your location, name, email or any free text in these events.
Why: to see what works and what does not, so we can improve the app. The statistics go to our own database; they are not sent to an advertising or analytics company.
Lawful basis and your choice: your consent. They are off unless you switch them on, in the app's introduction or in Settings, Privacy, and you can switch them off again at any time. The random install ID is only made and stored on your phone once you agree.
Crash reports
What: if the app crashes, Android can send a crash report to Google Play (you control this in your phone's settings). We see the error, your device model and your Android version in Google Play Console, not who you are.
Why and lawful basis: to find and fix bugs; legitimate interests.
Early-access list (this website)
What: the email address you give in the "Get early access" form, whether you would like to test the app before launch, where you usually ride if you tell us, the page you signed up on and when.
Why and lawful basis: to tell you when the app is available and, if you ticked the box, to invite you to test it. Your consent, which you can withdraw at any time: email us and we remove you. We do not use the list for anything else or share it.
Feedback
What: the message you send, the app version, the screen you sent it from and the app's random install ID (so one phone cannot flood us with messages). If you are signed in you can also agree to an email reply.
Why and lawful basis: to read and act on it (legitimate interests). We only email you back if you agreed, which is your consent and which you can withdraw.
Purchases and Pro
What: Google Play takes the payment: we never see your card details. RevenueCat, which manages subscriptions for us, receives your account ID and your purchase receipts from Google Play. We store your subscription status (the product, whether it is a trial or paid, and the renewal and expiry dates) and the history of subscription events, including the price and currency.
Why and lawful basis: to run Pro for you; contract. If you start a free trial, the app schedules a reminder notification on your phone for two days before the trial ends; that notification is created and shown on your phone only.
This website
The website has no advertising or analytics cookies or trackers. Our web host (currently Cloudflare) keeps ordinary server logs. The delete-account page loads one script from the jsDelivr content delivery network, which sees your IP address, and keeps your sign-in in your browser tab only until you close it or delete your account.
4. Who we share data with
We use the companies below to run the service. We do not sell personal data and we do not share it with advertisers. We may also disclose data where the law or a court requires it.
| Who | What for | What they receive |
|---|---|---|
| Supabase | Database, sign-in and file storage. Hosted in London (AWS eu-west-2). | Everything described above that is stored on our servers. |
| Google Play | Payment and app distribution. | Your purchase. We never see your card details. |
| RevenueCat | Managing subscriptions. | Your account ID and your purchase receipts from Google Play. |
| Mapbox | Map tiles. | Tile requests and your IP address. Mapbox telemetry is switched off in the app. |
| Esri | Satellite pictures in the satellite view. | Picture requests (the area being looked at) and your IP address. |
| Amazon Web Services | Elevation tiles for the 3D terrain view. | Tile requests (the area being looked at) and your IP address. |
| MET Norway (Norwegian Meteorological Institute) | Weather forecasts for riding areas (Pro). | The location of riding areas, asked by our server every few hours. Nothing about you. |
| YouTube (Google) | The embedded video player. | When you play a video, Google receives the usual information about your device and viewing; Google's privacy policy applies to that. |
| OpenStreetMap and the Environment Agency | Sources of the trail and elevation data. | No personal data. |
| Cloudflare and jsDelivr | Hosting this website and serving one script on the delete-account page. | Your IP address and the page you asked for. |
5. Transfers outside the UK
Our main database is in London. Some of the companies above (RevenueCat, Mapbox, Esri, Amazon Web Services, Google and Cloudflare among them) are US companies or may process data outside the UK. Where that happens we rely on a safeguard the UK GDPR allows: UK adequacy regulations (including the UK-US data bridge, for providers certified under it) or standard contractual clauses with the UK addendum. Ask us if you want details for a particular provider.
6. How long we keep it
| Data | How long |
|---|---|
| Account (email, display name) | Until you delete your account. |
| Condition reports | Hidden from the app after 30 days, then kept until deleted (by you, with your account, or by us). |
| Feature pins, votes and flags | Until you delete your account (or we remove the content). |
| Rides, jumps and saved routes | Until you delete your account. |
| Subscription status and event history | Until you delete your account. Google Play and RevenueCat keep their own records under their own policies. |
| Usage events | Raw events are kept for 13 months, then only daily totals, which do not identify anyone. Events linked to your account are deleted with it. |
| Crash reports | Kept by Google Play under its own policy. |
| Feedback | Until we have dealt with it, or until you delete your account. |
| Early-access list | Until six months after the app is released, or until you ask us to remove you. |
| Website server logs | A short time, under our host's settings. |
7. Your rights
Under UK data protection law you have the right to:
- be told what we hold about you, and get a copy (access);
- have wrong data corrected;
- have your data deleted (see below, you can do this yourself);
- ask us to restrict how we use it;
- object to uses based on legitimate interests, such as crash reports;
- withdraw your consent to usage statistics at any time (switch them off in Settings, Privacy);
- receive your data in a portable form: you can export your rides and routes as GPX in the app;
- withdraw consent where we rely on it, for example for the email reply to your feedback or for location.
Email hdlmstudios@gmail.com to use any of these. We reply within one month. We do not make decisions about you by automated means that have legal or similarly significant effects.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO): ico.org.uk. We would appreciate the chance to put it right first.
8. Deleting your account
You can delete your account in the app (Profile, Settings, Delete account) or on the website's delete account page. It deletes the account and everything linked to it: your profile, rides, jumps, routes, condition reports, pins, votes, flags, subscription record, usage events linked to the account and feedback.
A Pro subscription is billed by Google Play and is not cancelled by deleting your account. Cancel it in Google Play too, or it keeps renewing.
9. Security
Data travels over encrypted connections and is stored with reputable providers. Access rules in the database limit who can read and change what. No system is perfectly secure, so if we ever find that your data has been put at risk we will tell you and the ICO as the law requires.
10. Changes to this policy
If we change how we use personal data we will update this page and its date, and for important changes tell you in the app.