OcoMap – Privacy Policy (GDPR) -  EN

OcoMap – Privacy Policy (GDPR)

Effective Date: September 25, 2026

Version 1.5

1. Introduction and Data Controller

This Privacy Policy describes how FellCode (sole proprietorship / Toni Limnell, "we", "us", "our") collects, uses, stores, and protects your personal data when you use the OcoMap mobile application ("Application", "Service").

Application website: https://www.fellcode.com/ocomap

Personal data means any information relating to an identified or identifiable natural person, such as location data, device identifiers, health metrics, or Strava integration credentials.

We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR, 2016/679) and applicable national privacy laws. OcoMap is engineered around Privacy by Design principles; the Application operates primarily locally on your device without requiring a mandatory user account on our servers.

Data Controller:

FellCode / Toni Limnell

Privacy and Support Email: support@fellcode.com

Website: https://www.fellcode.com

2. Data We Process

2.1 Location, Speed, and Elevation Data

When using location-based features, the Application processes positioning and sensor metrics from your device:

- GPS coordinates (latitude and longitude)

- Elevation metrics (GPS altitude and device barometer sensor pressure elevation)

- Speed (km/h, knots, m/s) and heading

- Positioning accuracy metrics

- Atmospheric pressure metrics (hPa) and sea-level reference pressure fetched from OpenWeather API for barometer calibration

- Timestamps

Purpose: Location and sensor metrics are essential for rendering your position on the map, orienting the compass, recording routes in the background, calibrating barometric altitude, and saving outdoor waypoints. Location data is stored strictly on your local device.

2.2 User-Generated Content

Data created and saved by you within the Application:

- Saved Places: Custom waypoints, titles, descriptions, coordinates, assigned icons, and folder names.

- Routes: Recorded and planned tracks including track points with timestamps, distance, duration (active motion time and total elapsed time taking pauses into account), average speed, assigned activity mode (walking, hiking, running, cycling, paddling, workout, weight training, HIIT, treadmill, indoor cycling, driving), lap metrics, elevation profiles, and optional heart rate or cadence data. For indoor modes, users may also manually input distance and elevation from their fitness equipment (e.g., treadmill). Routes can be exported in GPX, TCX, and JSON formats.

- Markings: Freehand drawings and shapes created using the drawing tool.

- Folders: Custom groups for organizing places and routes.

- Photos: Geotagged photos captured with the camera tool.

All user-generated content is stored locally on your device.

2.3 Search Data

When using the place search tool:

- Search terms entered by you (e.g., lake or island names)

- Approximate location or map center (to prioritize relevant local search results via NLS Finland geocoding API)

2.4 Health Data and User Profile (Optional)

If you pair a Bluetooth BLE heart rate belt and enter your profile details:

- Heart rate measurements (bpm) and timestamps

- User profile metrics: height (cm), weight (kg), age (years), and gender

- Calculated statistics (average heart rate, max heart rate, calories burned)

Processing of health data is based on your explicit consent (GDPR Article 9(2)(a)), granted by pairing the heart rate belt and entering your profile. All health data is processed locally on your device to calculate accurate calorie burn based on the scientifically validated Keytel formula.

2.5 Strava Integration Data (Optional)

If you connect OcoMap to your Strava account (Strava Inc.):

- Strava athlete name / profile ID

- OAuth 2.0 access and refresh tokens (stored locally in secure device DataStore)

- Auto-upload preferences and upload badge status for routes

- During activity upload, the route name, description, sport type (walk, run, ride, kayaking, workout, indoor sports, etc.), and GPX or TCX route track (coordinates, timestamps, elevation, laps, and optional heart rate or cadence data) are transmitted to Strava Inc. For indoor activities (e.g., treadmill, indoor cycling), a specific Trainer flag is also transmitted so the activity is correctly recognized as an indoor workout.

2.6 Purchase Data (Tip Jar)

When you voluntarily tip the developer:

- Purchased tip product (e.g., Coffee, Pastry, Trail Snack)

- Transaction timestamp and purchase token

Payment processing is handled entirely by Google Play Billing. FellCode does not access or store your financial or credit card information.

2.7 Device Data and Technical Logs

For technical functionality and diagnostics:

- Device brand and model

- Operating system version

- Application version and language

- IP address (transiently during requests to map tile servers, OpenWeather API, and Strava API)

2.8 Diagnostics and Analytics

To ensure Application stability, monitor performance, and continuously improve the Service, OcoMap integrates Google Firebase Crashlytics and Firebase Analytics:

- Crash reports: Stack traces and technical logs generated during application crashes.

- Analytics: Anonymous usage metrics (e.g., map layers selected, backups completed, app language).

Note: These tools collect non-identifiable telemetry data automatically to help us maintain a robust application. No sensitive or personally identifiable user content (such as specific saved locations) is sent to analytics.

2.9 Local Storage, Google Drive Backup, File Exports, and Strava

All your data remains on your device.

- Google Drive: If you enable Google Drive backup, the Application backs up your data directly to your personal Google Drive account. OcoMap adheres to the Google API Services User Data Policy (Limited Use). The Application accesses only its own backup files.

- File Exports (GPX, TCX, JSON): You can export your waypoints and routes locally to your device as standardized files.

- Strava: If you enable Strava uploads, selected routes, laps, and heart rate metrics are transmitted to your Strava account.

3. Device Permissions

The Application requests the following permissions as needed:

- Location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION): Displaying location on the map, distance measurement, and navigation.

- Background Location & Service (FOREGROUND_SERVICE_LOCATION): Uninterrupted route recording while the screen is locked.

- Notifications (POST_NOTIFICATIONS): Displaying active route recording status in the system tray.

- Bluetooth (BLUETOOTH_SCAN, BLUETOOTH_CONNECT): Connecting to Bluetooth BLE heart rate belts.

- Camera: Capturing geotagged photos.

- Internet (INTERNET): Fetching map tiles, weather calibration, Google Drive backup, and Strava sync.

4. Purposes and Legal Bases for Processing

We process your personal data under the following GDPR legal bases:

1. Performance of a Contract (Article 6(1)(b)):

- Providing map and navigation features

- Recording routes, managing activity modes, calculating lap metrics, distance, speed, and elevation

- Place searching and geocoding

- Data backup, restoration, and file exports (Google Drive, GPX, TCX, JSON)

- Processing Tip Jar purchases

- Uploading routes and activities to Strava upon user request

2. Consent (Article 6(1)(a) and Article 9(2)(a)):

- Processing heart rate data and profile metrics for calorie calculation (Health Data)

- Auto-uploading activities to Strava

3. Legitimate Interests (Article 6(1)(f)):

- Processing diagnostic crash logs (Firebase Crashlytics) and anonymous usage analytics (Firebase Analytics) to ensure app stability, identify bugs, and improve user experience.

- Technical support, troubleshooting, and maintaining Application security and performance.

5. Data Sharing and Ad-Free Policy

- We do not sell, rent, or trade your personal data to third parties for commercial purposes.

- No Ads: OcoMap is 100% ad-free. Your data is never shared with ad networks or used for targeted advertising.

6. Third-Party Service Providers

The Application utilizes trusted third-party providers:

- Google Firebase (Analytics, Crashlytics, Remote Config): Diagnostics, analytics, and remote configuration. Privacy Policy: https://firebase.google.com/support/privacy

- Google Play Billing & Google Drive API: Purchase processing and backups. Privacy Policy: https://policies.google.com/privacy

- Map Data Providers (NLS Finland, Traficom, Kartverket, Lantmäteriet, IGN Spain, OpenTopoMap, Esri, Waymarked Trails, OpenSeaMap, OpenSnowMap): Map tile delivery.

- OpenWeather: Fetching ambient pressure data for barometer calibration based on coarse location. Privacy Policy: https://openweather.co.uk/privacy-policy

- Strava Inc.: Optional route and workout synchronization to user's Strava account. Privacy Policy: https://www.strava.com/legal/privacy

7. International Data Transfers

Your data is processed primarily within the European Economic Area (EEA). Google services and Strava Inc. may process technical telemetry and uploaded activity data in the United States under the EU-US Data Privacy Framework and EU Standard Contractual Clauses (SCCs), ensuring an adequate level of data protection.

8. Data Retention, Deletion, and Disconnecting Strava

All saved places, routes, and settings are retained on your device.

- You can delete individual places or routes directly in the Application, clear Application data in your device settings, or uninstall the Application to immediately remove all locally stored data.

- You may delete your Google Drive backups directly from your personal Google Drive storage at any time.

- Disconnecting Strava: You can disconnect Strava at any time in OcoMap Settings ("Disconnect Strava"), which immediately deletes Strava tokens from your device. You can also revoke OcoMap's application access in your Strava account settings at: https://www.strava.com/settings/apps

9. Data Security

Network traffic between the Application and third-party APIs is encrypted using industry-standard HTTPS/TLS protocols.

10. Your Rights Under GDPR

Under GDPR, you possess the following rights:

- Right of Access (to obtain a copy of your personal data)

- Right to Rectification or Erasure ("Right to be Forgotten")

- Right to Restrict or Object to Processing

- Right to Data Portability (via GPX, TCX, and JSON export features)

- Right to Withdraw Consent at any time (e.g., disconnecting the heart rate belt or Strava)

Because OcoMap does not maintain server user accounts, your personal data resides on your own device, where you can exercise these rights directly.

You also have the right to lodge a complaint with a supervisory authority:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)

Postal Address: PL 800, 00531 Helsinki, Finland

Email: tietosuoja@om.fi

Website: https://tietosuoja.fi/en

11. Children's Privacy

OcoMap is not directed to children under 13 years of age. We do not knowingly collect personal data from children without parental consent.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available at: https://www.fellcode.com/ocomap.

13. Contact Us

For any privacy questions or requests regarding your personal data, please contact:

FellCode / Toni Limnell

Email: support@fellcode.com

Website: https://www.fellcode.com/ocomap