TRACK-ONN — Privacy Policy

Last update: May 22, 2026 · Version 1.0

TRACK-ONN ("the app", "we") is a mobile application that tracks sport activities (running, cycling, walking, hiking). This policy explains what data we collect, why, and with whom we share it. The app is designed to collect the strict minimum needed for it to work.

1. Data controller

Olivier Onno, individual · contact: olivier.onno@gmail.com.

2. Collected data and purposes

2.1 GPS and trip data

• GPS position while recording an activity (latitude, longitude, altitude, speed, timestamp).
• Barometric pressure (if the phone has the sensor), for accurate elevation.
• Heart rate (if a compatible BLE chest strap or watch is paired).

This data is stored only on your phone in the app's private folder. It's never sent to a server unless you explicitly choose to share it (GPX export, sharing an activity photo, etc.).

2.2 Live sessions with friends (optional)

If you use the "Friend session" feature, your real-time position and pseudonym are sent to Google Firebase Realtime Database (Europe). The data is only visible to friends with the same session code. Everything is automatically deleted when you leave the session.

2.3 Account (optional)

If you create an account, your email and a hashed password are stored by Google Firebase Authentication. The password itself is never readable, not even by us.

2.4 Photos

When you use "Create share image" in the activity summary, the app accesses your camera or gallery. The image stays on your phone. It is shared only if you explicitly trigger sharing via the Android menu.

3. Android permissions requested

• ACCESS_FINE_LOCATION + ACCESS_BACKGROUND_LOCATION: GPS tracking of your activities, even with screen off.
• FOREGROUND_SERVICE_LOCATION + WAKE_LOCK + POST_NOTIFICATIONS: keep tracking active and show the live notification.
• INTERNET: OpenStreetMap tiles, weather, routing, friend sessions.
• RECORD_AUDIO: voice route dictation ("bike from Béziers to Toulouse").
• BLUETOOTH_SCAN + BLUETOOTH_CONNECT: pairing a BLE heart-rate sensor.

4. Third-party services used

• OpenStreetMap — map tiles (no personal data sent). Policy: wiki.osmfoundation.org
• Open-Meteo — daily weather. Only latitude / longitude (rounded to the kilometer) are sent. No identification.
• OpenRouteService (via our Cloudflare proxy) — route directions for voice dictation. Start / end lat-lng sent, no identification.
• Microsoft Edge TTS (only if you enable "Premium voice") — voice cue text sent for synthesis. No identification.
• Google Firebase (Authentication + Realtime Database) — only if you create an account or use friend sessions.
• Google Speech Recognition — Android system engine for voice recognition (route dictation). Subject to Google's policy.

5. Data retention

• Recorded activities (GPS tracks): kept on your phone as long as the app is installed. Removed when you uninstall.
• Friend sessions: automatically deleted at the end of the session.
• Firebase account: kept until you delete it (see section 6).

6. Your rights

Under GDPR you can at any time:

• Access your data: everything is in the app + exportable as GPX.
• Delete your data: uninstall the app + delete your Firebase account via "Sign out" + email olivier.onno@gmail.com for permanent deletion.
• Request portability: use the built-in GPX export (activity summary → "Export as GPX").
• Refuse processing: don't grant the permissions, don't use the feature. The app stays functional for basic tracking.

7. Security

All network communication is encrypted with HTTPS / TLS. Passwords are hashed server-side (Firebase) — never stored as clear text. The OpenRouteService API key is protected server-side on Cloudflare (never bundled in the distributed APK).

8. Changes

If we modify this policy, the new version will be published on trackonn.app/privacy. Major changes will be notified via the app.

9. Contact

For any question or request: olivier.onno@gmail.com.