Privacy Policy — GhosTrack
Last updated: 6 August 2026
This policy explains what personal data GhosTrack collects, how it is used, and what rights you have over it. It is written in accordance with Regulation (EU) 2016/679 (GDPR).
1. Data controller
The data controller is Alessandro Pallini, based in Italy.
For any request concerning your data, write to ghostrack.italia@gmail.com.
2. What data we collect
2.1 Account data
When you create an account, we ask for:
- email address — required for registration, account verification and password recovery;
- first name — shown to other users when you share a session;
- username — the identifier other users search for in order to share a session with you;
- profile picture (optional) — if you choose to upload one.
We do not collect surname, phone number, date of birth or any other identifying data.
2.2 Location data
GhosTrack is a running and cycling application: it needs to record your location during your activity in order to work.
When you start a recording, the app collects:
- GPS coordinates (latitude and longitude) sampled at regular intervals along your route;
- altitude;
- relative timestamps measured from the start of the session.
The timestamps stored with GPS points are relative to the start of the session, not absolute clock times: the recorded track reveals the route and its duration, but not the time of day at which the activity took place.
Background collection. So that you can run with the screen off while the voice coach and the off-route alarm keep working, the app reads your location while running in the background. This collection happens only while a recording session is active and stops when you end it. GhosTrack does not track your location outside of sessions.
Coordinates are not sent to any external service. They stay on your device and are synchronised only to our own servers, described in section 4.
Please do consider one point, however: the track is stored in full, and its first point is the place where you started recording. If you start at home, that point is your home. If you would rather avoid this, start and end your sessions at some distance from your home.
2.3 Data calculated from your activity
At the end of each session the app calculates and stores: distance covered, duration, average speed, maximum speed and elevation gain.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b) GDPR) |
| Recording, storing and displaying your sessions | Performance of a contract (Art. 6(1)(b) GDPR) |
| Synchronising sessions across your devices | Performance of a contract (Art. 6(1)(b) GDPR) |
| Allowing you to share a session with another user | Consent, given through the act of sharing (Art. 6(1)(a) GDPR) |
We do not use your data for advertising profiling and we do not sell it to third parties.
4. Where your data is stored
4.1 On your device
Sessions are first saved in local storage inside the app, on your phone. This data stays on the device and is removed when you uninstall the application.
4.2 On our servers
Saved sessions are synchronised to Supabase, the platform hosting our database and authentication system.
The servers run on Amazon Web Services infrastructure in the eu-west-1 region (Ireland), therefore within the European Union. No transfer of your stored data to third countries takes place.
Your profile picture, if uploaded, is stored on the same service.
5. Third-party services
GhosTrack uses the following external services:
Supabase — database, authentication and file storage. Servers in Ireland (EU). Receives your account data and your sessions.
MapLibre and OpenFreeMap — map display. Requests for map tiles transmit the device IP address, with no account identifying data.
Google Play Services — distribution and updating of the application, subject to Google's own privacy policy.
6. Sharing between users
GhosTrack lets you send one of your sessions to another user, who can then use it as a "ghost" to race against.
What is shared: the session name, date, distance, duration and the track points.
Because the track is shared in full, the recipient can see the route you followed, including the point you started from. Bear this in mind when deciding who to share a session with.
The recipient also sees your first name, username and profile picture. Sharing only happens through an explicit action on your part: no session is ever sent automatically.
If you delete your account, the sessions you had shared are also removed from the recipients' devices.
7. Profile visibility to other users
For sharing to work, registered users can search for you by username. Anyone who finds you sees your first name, username and profile picture.
Your email address is never visible to other users, under any circumstances, neither through search nor through shared sessions.
Your sessions are private: no other user can see them unless you explicitly share them.
8. How long we keep your data
We keep your data for as long as your account remains active.
When you delete your account, all data listed in this policy is permanently erased, as described in the following section.
9. How to delete your account and your data
You can delete your account at any time directly from the app: open your profile and select Delete Account.
The operation is immediate and irreversible and deletes:
- your account and login credentials;
- all your sessions, including GPS tracks;
- your profile (name, username, picture);
- all sessions you have shared and all those you have received.
Data held locally on your phone is removed by uninstalling the application.
If you cannot access the app, you can request deletion by writing to ghostrack.italia@gmail.com: we will act within 30 days.
10. Your rights
Under the GDPR you have the right to:
- access the data concerning you;
- obtain rectification of inaccurate data;
- obtain erasure of your data (which you can carry out yourself from the app);
- obtain restriction of processing;
- receive your data in a machine-readable format (portability);
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise these rights, write to ghostrack.italia@gmail.com. We will reply within 30 days.
You also have the right to lodge a complaint with your national supervisory authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).
11. Security
Access to data is protected by authentication and by rules enforced at database level, which allow each user to read and modify only their own data. Communication between the app and our servers takes place over an encrypted connection (HTTPS).
No system is absolutely secure: please choose a strong password and do not share it.
12. Children
GhosTrack is not intended for children under 16 and does not knowingly collect their data. If you believe a child under 16 has created an account, write to ghostrack.italia@gmail.com and we will delete it.
13. Changes to this policy
We may update this policy to reflect changes to the application or to applicable law. The date at the top of this document always indicates the latest revision. In case of substantial changes, we will give notice within the app.
14. Contact
For any question about this policy or about the processing of your data: ghostrack.italia@gmail.com.