Unbeaten Path records walking and cycling routes, lets you mark stops along them with photos and notes, and lets you share those routes with friends. This policy explains exactly what the app collects, why, and who else sees it.
| Data | Why | Where it goes |
|---|---|---|
| Precise location, including in the background while a route is recording | Recording your route is the core function of the app. Background access is required so the trace does not break when your screen locks or you switch apps. | Stored on your device. Uploaded to our database only when you save a route. |
| Name, email address, profile photo | To create your account and let friends recognise you. | Supabase (our database provider). Your name and photo are visible to anyone who has your friend code. |
| Photos and videos you attach to a stop or post as a story | To illustrate your routes. | Supabase storage. See section 3 on visibility. |
Friend code (UBP-XXXX-XXXX) |
A public handle so people can add you without sharing an email address. It is designed to be shared and is not secret. | Supabase. Readable by anyone using the app. |
| Device identifier | To keep a single account consistent across reinstalls. | Supabase. |
| Friends, comments, likes, story views | To make the social features work. | Supabase. Your friend list is visible only to you and the people in it. Who viewed or liked your story is visible only to you. |
Some of this is deliberately public, and you should understand it before you share anything.
These services receive data as a necessary part of making the app work. We do not sell data to anyone.
| Service | What it receives | Why |
|---|---|---|
| Supabase | Everything in section 1 | Database, authentication, and file storage. |
| Google Maps | Map region being displayed | To draw the map. |
| Google Sign-In (optional) | Your Google account email, name, photo | Only if you choose to sign in with Google. |
| OpenStreetMap / Nominatim | Coordinates you look up | To turn coordinates into place names. |
| Overpass API | A bounding box around your current position | To find nearby points of interest. |
| Google Gemini, via our own Cloudflare Worker | Text you submit for AI features, such as an imported social media link | To generate route suggestions. Requests are proxied through our server so the API key is never exposed in the app. |
| TikTok / Instagram | Only the link you choose to import or open | To attach the original post to a saved place. We have no other connection to these services and never read your account there. |
Open Profile → Delete Account. This permanently removes your account, your routes, your photos and videos, your comments, and your friend connections. It is immediate and cannot be undone. We keep nothing afterwards.
Routes you previously shared by link stop being reachable once deleted. Copies that other people saved or screenshotted are, of course, outside our control.
If you are in the EEA, the UK, or California, you have the right to access, correct, export, or delete your personal data, and to object to its processing. The delete function above satisfies the right to erasure immediately. For anything else, email us and we will respond within 30 days.
We do not sell personal information, and we have no "sale" or "sharing" of data to opt out of under the CCPA.
Unbeaten Path is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.
Data is transmitted over HTTPS and stored with row-level access control, so one account cannot read or modify another account's private data. Passwords are handled by Supabase Auth and are never stored by the app. No system is perfectly secure, but the app is designed so that a compromise of one account does not expose anyone else's.
If this policy changes materially, the date at the top will be updated and the app will surface a notice. Continuing to use the app after a change means you accept it.
Questions, requests, or complaints: crherbst1@gmail.com