Privacy Policy — StreetPainter

01Who runs StreetPainter

StreetPainter is a street-coverage app for runners, walkers and cyclists. It is built and operated by one person. That operator is the data controller for everything described here, and is the only human with access to the production database.

The service is invite-only. You can reach the operator at streetpainter.dev@gmail.com.

02The short version

We collect your Google account basics, your GPS activity tracks, and what those tracks say about which streets you have covered.
We use that to run the app. Nothing else.
We do not sell data, do not run ads, and do not use a third-party analytics or tracking service.
Data is stored in the United States on Google Cloud.
You can export everything as a JSON archive, or delete your account outright, from your profile page. Deletion is real deletion.

03What we collect and why

This is the complete list. If something is not here, we do not have it.

Your account

When you sign in with Google we store your email address, display name, avatar URL and Google account id. We also store your timezone, your units preference (miles or kilometres), and your email-digest and push notification preferences, plus the time your account was created and the time you last signed in.

Why: to know who you are when you come back, to address you by name, to show distances the way you like them, and to send only the mail you asked for.

Your activities

For each run, walk or ride we store the GPS track itself — the full line of coordinates, with a timestamp and elevation for each point — plus the activity name, type, distance, duration, start time, the city it happened in, and where it came from (Strava, Garmin, Sports Tracker, or a file you uploaded) with the source's own id for it.

Why: the track is the product. Without the geometry there is nothing to match against streets and nothing to paint.

Your Strava connection

If you connect Strava, we store the OAuth access and refresh tokens, your Strava athlete id, the scopes you granted, and whether you opted in to write-back (StreetPainter adding a line to the description of activities on Strava). The tokens are encrypted with AES-GCM before they are written to the database.

Why: to import your activities on your behalf and keep the connection alive without asking you to sign in again every few hours.

Coverage and derived data

From your tracks we compute and store which street segments and park paths you have covered, which activity matched which street, your completion stamps per neighbourhood, periodic snapshots of your coverage, and match labels used to check the matching engine's accuracy.

Why: this is how the map gets painted and how percentages are calculated. It is derived from your activities and is deleted with them.

Planned routes

Routes you plan are stored with their start and end coordinates and their full geometry.

Why: so a route you built is still there tomorrow, and so you can export it to your watch or phone.

Posters and background images

Posters you render and any background image you upload are stored as files in Google Cloud Storage, with a database row pointing at them.

Why: to keep your gallery. Note that a poster you deliberately share by link is reachable by anyone who has that link, by design.

Crews and expeditions

If you join a crew we store your membership and any crew-scoped expeditions. Other members of that crew can see your name, avatar and the coverage you contribute to the crew.

Push subscriptions

If you turn on push notifications, your browser gives us a Web Push endpoint URL and a pair of keys, and we store them. Turning notifications off deletes them.

Server logs

Our servers write access logs: IP address, timestamp, request path, response status, user agent. These are ordinary operational logs used to find faults and spot abuse. There is no analytics product sitting on top of them.

04Location data is sensitive

Read this one

A year of GPS tracks shows where you live, where you work, when you leave the house and which route you take. It is some of the most revealing data a person can hand over, and StreetPainter is built around it. We treat it that way, and you should too.

Two things follow from that. First, we keep the circle of access as small as possible: tracks are never shared with anyone outside the parties named in section 6, and no advertiser or data broker ever sees them. Second, you get a blunt instrument to protect yourself — privacy zones. Set a home point and a radius, and everything inside that radius is clipped out of anything you share — shared activity links, share cards, posters and shared route links — before it leaves the app.

Privacy zones clip what you share. They do not clip what we store, because the full track is what the coverage engine needs, and they do not clip a file you download for your own use — a GPX with its first few hundred metres missing is not a route you could follow. If you want the stored copy gone, delete the activity or delete your account.

05Legal bases

If you are in the UK, EU or EEA, these are the bases we rely on under the GDPR.

Contract: Your account itself, your activities, your coverage, your routes and your posters. You asked us to run a street-coverage service for you; we cannot do that without this data.
Consent: Optional extras: email digests, push notifications, connecting Strava, and Strava write-back. Each is off until you switch it on, and you can switch each one off again at any time without affecting the rest of your account.
Legitimate interest: Keeping the service running and secure: server logs, error reports, abuse prevention, and the transactional email that tells you something happened to your account. We have weighed this against your interests and kept it to what an operator genuinely needs to keep a small service up.

Where we rely on consent, withdrawing it is as easy as giving it, and nothing in the app is withheld from you for withdrawing it.

This is the whole list of third parties. Each one is named, and each one gets only what it needs.

Google — sign-in: We use Google OAuth for sign-in. Google tells us your email, name, avatar and account id. We do not send Google anything else, and we do not use Google Analytics, Google Ads or any Google tracking product.
Google Cloud Platform — hosting: The app runs on Cloud Run with a Cloud SQL database and Cloud Storage for images, all in Google's us-central1 region. Google is our processor: it holds the data on our behalf and does not get to use it for its own purposes.
Strava — activity import: Only if you connect it. We receive your activities and athlete profile from Strava. If you opt in to write-back, we send a short description line back to activities on your Strava account. Nothing else goes to Strava. Your use of Strava is also governed by Strava's own privacy policy.
Resend — email: If email is configured on the deployment, transactional mail and digests are sent through Resend, which receives your email address and the content of the message. Nothing else.
OpenStreetMap Nominatim — geocoding: When you search for a place, the text you typed is sent to Nominatim to turn into coordinates. Your account is not identified in that request.
OpenFreeMap — basemap tiles: Map tiles are fetched by your browser from OpenFreeMap. That means OpenFreeMap sees your IP address and which map tiles you asked for — in other words, roughly where on the map you are looking. It does not see your account or your tracks.

We will also disclose data if a valid legal order compels it. If that ever happens and we are permitted to tell you, we will.

07Where data is stored

All of it is stored in the United States, in Google Cloud's us-central1 region. If you are in the UK, EU or EEA, using StreetPainter means your data is transferred to the United States. That transfer relies on the European Commission's Standard Contractual Clauses as incorporated into Google Cloud's data processing terms, together with Google's certification under the EU-US Data Privacy Framework.

We do not currently operate in any other region, and moving your data to one is not something we can offer.

08How long we keep it

While your account is open: your account, activities, coverage, routes and posters are kept until you delete them or delete your account. We do not expire your history — the whole point is the long record.
When you delete an activity: it goes, along with its coverage matches, immediately.
When you disconnect Strava: the stored tokens and athlete id are deleted immediately. Activities already imported stay, because they are yours; delete them individually if you want them gone.
When you delete your account: every row listed in section 3 is erased from the live database, and poster and background files are deleted from storage. This is not a soft delete or a deactivation.
Backups: be clear-eyed about this one. The database is backed up automatically, and those encrypted backups roll off on a 30-day cycle. So for up to 30 days after you delete something, a copy can still exist inside a backup snapshot. We do not mine backups, and we only ever restore one to recover from a failure. After the cycle completes, the copy is gone.
Server logs: retained for 30 days, then discarded.
Email records: Resend holds delivery records for its own retention period; we keep no separate copy beyond your preferences.

09Your rights, and how to use them

You have these rights regardless of where you live — we are not going to make them conditional on a jurisdiction.

Access and export: Go to your profile page and choose Export my data. You get a JSON archive containing your account record, every activity with its full track, your coverage, your routes, your crew memberships and your preferences. It is generated on demand — no ticket, no waiting on a human.
Correction: Name, units, timezone and notification preferences are all editable on the profile page. Activity names and types can be corrected on the activity itself. If something is wrong that you cannot edit, email us and we will fix it.
Deletion: Go to your profile page and choose Delete my account. It asks you to confirm, then erases everything described in section 3, subject only to the backup window in section 8. Individual activities can be deleted one at a time from the activity page.
Withdrawing consent: Email digests and push notifications each have a switch on the profile page. Strava has a Disconnect button, which deletes the tokens and athlete id on the spot. Write-back is a separate switch from the connection itself.
Restriction and objection: If you want us to stop a particular processing activity rather than delete everything, email us and say which one. In a service this small we can usually just do it.
Portability: The JSON export is the portable copy. Tracks are exported in a standard coordinate format so another tool can read them.
Complaint: If you are in the UK, EU or EEA and you think we have handled your data badly, you can complain to your national data protection authority. We would rather you emailed us first, but that right does not depend on us.

We answer requests sent to streetpainter.dev@gmail.com within 30 days, and usually much faster. We will not charge you for any of this.

10What we never do

We do not sell your data, and we do not share it for anyone's advertising.
We do not run ads.
We do not load a third-party analytics or tracking script. There is no Google Analytics, no pixel, no session recorder, no ad network tag.
We do not build advertising profiles or infer anything about you beyond which streets you have covered.
We do not use your tracks to train machine learning models for anyone else.

The only measurement we do is first-party: server logs and our own error reports, on our own infrastructure, used to keep the app working. Cookies are limited to the session cookie that keeps you signed in. There are no advertising or cross-site cookies to consent to.

11Security

What is actually in place, rather than what sounds good:

All traffic is encrypted in transit with HTTPS/TLS.
Strava OAuth tokens are encrypted with AES-GCM before being stored, so a copy of the database alone does not yield a working token.
The database is not exposed to the public internet. Services reach it over private networking, and disks are encrypted at rest by Google Cloud.
Access is invite-only: an email allowlist gates who can create an account at all.
Only the operator has production access, and it is protected by two-factor authentication.
Backups are encrypted and expire on the cycle described in section 8.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data we will tell you directly and promptly, and notify the relevant regulator where the law requires it.

If you find a security problem, please email streetpainter.dev@gmail.com before disclosing it publicly. You will get a reply.

12Children

StreetPainter is not for anyone under 16. We do not knowingly collect data from children, and accounts are invite-only, so there is no open sign-up for a child to walk into. If you believe a child has an account, email us and we will delete it.

13Changes to this policy

When this policy changes, the "Last updated" date at the top changes with it. For a change that materially affects you — a new third party, a new category of data, a new purpose — we will email every account holder before it takes effect, not quietly swap the page. Continuing to use StreetPainter after a change means you accept the updated policy.

14Contact

Privacy questions, rights requests and security reports all go to the same place: streetpainter.dev@gmail.com. One person reads it.

See also the Terms of Service and the Support page.

What we hold,and what you can take back.