Privacy Policy

2.1 Account and identity data

• Email address and password (authentication is handled by Supabase; passwords are stored hashed, never in plain text).
• If you choose "Sign in with Google", the identifier and basic profile information provided by Google's OAuth service.
• A unique user identifier (UUID) generated for your account.

2.2 Profile data (provided by you)

• Username / display name.
• Optional: date of birth, gender, profile photo (avatar).
• Home location name, preferred units (metric/imperial), language, and default sport type.
• Fitness profile data: height, weight, and FTP (Functional Threshold Power).

2.3 Location data

• Precise location (GPS) — used to show your position on the map and to provide navigation. We process precise location only after you grant the permission, and you can revoke it at any time in your device settings.
• Approximate location — your device may also be located approximately (e.g. derived from your IP address or coarse network location) to centre the map near you.
• Recorded GPS tracks, route geometry, waypoints, and elevation profiles.

2.4 Activity and health-related data

When you import or sync activities, we process fitness metrics that may include moving/elapsed time, distance, elevation gain, calories, average heart rate, power, and cadence, together with the associated GPS records.

Special-category data. Heart rate and other physiological metrics may qualify as health data ("special category" data under Article 9 GDPR). We process this data only with your explicit consent, which you give when you connect a device or import an activity containing such data. You may withdraw this consent at any time by disconnecting the integration or deleting the relevant activities.

2.5 Connected services

• If you link a Wahoo or Hammerhead account, we store the access tokens needed to sync your routes and activities. We never receive your password for those services.

2.6 Content and support data

• Routes, saved climbs/segments, and GPX files you create, import, or share.
• Feedback and bug reports you submit, including any diagnostic information you choose to include (e.g. app version).

2.7 Technical data

• Data necessary to operate the Service securely, such as your session token (stored encrypted on your device) and basic request metadata (e.g. IP address used to deliver API responses).
• If you sign in on this website (with Google, Apple or an emailed code) to connect or manage AI assistants, two strictly necessary cookies keep you signed in. They hold your session tokens, cannot be read by scripts on the page, are used only to act on your own account, and are deleted when you sign out or after 30 days without use.
• App preferences stored locally on your device (e.g. map layer settings).

4.1 What other users can see

Most of your data is private to your account. The following are visible to others only when you actively choose to share:

• Your username and profile photo may be visible to other users you interact with.
• When you share a route or create a public link, that route (its geometry and details) becomes accessible to anyone who has the link, until you delete or unshare it. Please consider that a shared route may reveal places you visit, such as your home or workplace.

We do not make your activities, recorded GPS tracks, or fitness metrics public, and we do not build public heatmaps or aggregated maps from your tracks.

4.2 AI assistants you connect

You can connect an AI assistant of your choice (for example Claude, ChatGPT or Cursor) to your Flamap account. Nothing is shared until you sign in, review the request on our consent screen, tick the box giving your explicit consent and approve it. The connection works as follows:

• What it can read: your rides (power, heart rate, heart rate variability (HRV), cadence, speed, elevation and temperature over time, ride summaries, and the town and country where each ride started), your efforts on climbs, your saved climbs, your planned routes (distance, climbing, surface, the climbs on them, and their town and country), and your profile (FTP, weight, height, gender and age). It can also run read-only database queries, limited to your own data. Access is read-only: it cannot change or delete anything, and it never receives your password or the credentials of your connected devices.
• Health-related data: heart rate, HRV and weight can reveal information about your health and may be special-category data under Art. 9 GDPR. Together with your detailed activity data, they are shared only with the explicit consent you give by ticking the box that names them.
• What is never shared: your GPS tracks, the exact route of any ride, and the points where your rides start and end. Only the town and country of a ride's start, or of a planned route, are shared. The assistant receives your age, never your date of birth.
• When data is shared: only while you use the assistant, when it asks Flamap for data it needs to answer you. Nothing is sent to it in the background.
• Who is responsible after sharing: once the assistant has received your data, its provider (for example Anthropic or OpenAI) processes it under the terms and privacy policy you have with that provider, and is responsible for that processing, including what it keeps and for how long. We have no control over that provider's processing.
• Record of your consent: when you approve, Flamap records which assistant you connected, the time, and the version of the consent wording you were shown, so that we can demonstrate your consent (Art. 7(1) GDPR). The record is kept while your account exists, is included in your data export and is deleted with your account.
• Transfer outside the EU: most assistant providers are based in the United States, so your data may be transferred outside the European Economic Area (EEA), to a country whose laws may not protect it as well as EU law does. This transfer relies on your explicit consent (Art. 49(1)(a) GDPR), which you give on the consent screen after being told of it.
• What we do not do: we do not sell this data, and we do not use it to train AI models.
• Withdrawing consent: you can disconnect an assistant at any time in Settings on this website, or from the assistant itself, and deleting your Flamap account removes every connection. Once revoked it can no longer renew its access, and any access it still holds expires within an hour. Withdrawing does not affect what was shared before, and does not delete what the provider has already received: ask that provider to delete it.

The legal basis is your consent (Art. 6(1)(a) GDPR), your explicit consent for health-related data (Art. 9(2)(a)) and your explicit consent to the transfer outside the EEA (Art. 49(1)(a)). You give it by ticking the box and approving the connection, and withdraw it by revoking the connection. Not connecting an assistant, or disconnecting one, does not affect the rest of the Service.