Privacy Policy
Last updated: 5 August 2026
The short version. Pakmandidos has no account, no email address, no analytics, no advertising and no tracking. Your GPX files never leave your phone. Your location is used on your device to navigate; it is only ever uploaded in two cases — when you deliberately report a hazard at a place, and when you switch on live position sharing with your own crew.
1. About this Policy
This Policy explains what personal data the Pakmandidos iOS app ("the App") and this website process, why, and what rights you have. It is written for the EU General Data Protection Regulation (GDPR).
2. Data we collect
2.1 Identity
There is no registration. No email address, no password, nothing to sign up for. The App signs in anonymously and is given a random ID. You pick a rider handle, and that is the only name anyone ever sees next to your hazard reports and on your team leaderboard.
2.2 Location
The App uses your device's GPS to draw your position on the track, give turn cues, and score your ride. This processing happens on your device. Location leaves the device only in these cases:
- Hazard reports. When you flag a washout, fallen tree, water crossing, gate, closure or camp spot, the coordinates of that place are uploaded with the hazard type, your optional note and your rider handle, and shared with other riders.
- Live crew presence (off by default). If you switch it on and join a team, your current coordinates, your handle and your team code are uploaded so your teammates can see you on the map. See §7 for exactly how this behaves.
The App does not record or upload a history of where you have been. Your recorded rides and imported tracks stay on the device.
2.3 Ride statistics
If you join a team, your points, distance and moving time are uploaded with your handle for the leaderboard.
2.4 Your files and keys
- GPX files you import never leave your device.
- Your OpenAI API key, if you add one, is stored in the iOS Keychain. We never receive it — it goes only to OpenAI, in your own requests.
3. What we do not collect
No advertising identifiers. No analytics or crash-reporting SDK. No cookies in the App. No email address. No access to your photos, contacts or health data. The App contains no third-party advertising or tracking libraries of any kind.
4. Legal basis for processing (GDPR Art. 6)
| Purpose | Basis |
|---|---|
| Navigation, scoring and on-device features | Art. 6(1)(b) — performance of a contract |
| Hazard reports shared with other riders | Art. 6(1)(f) — legitimate interest in rider safety |
| Live crew presence | Art. 6(1)(a) — your explicit consent, withdrawable at any time |
| Team leaderboard | Art. 6(1)(a) — your consent, given by joining a team |
| Waypoint research and spoken voice via OpenAI | Art. 6(1)(a) — your consent, given by adding your own API key |
5. Third-party processors and recipients
| Service | What it receives | Why |
|---|---|---|
| Google Firebase (Authentication, Firestore) | Anonymous user ID, rider handle, hazard reports, ride statistics, presence records | Stores the shared safety and team data |
| OpenAI (only if you add your own API key) | Waypoint names and coordinates from your track; text to be spoken aloud; prompts used to generate your collection cards | Waypoint write-ups, natural voice, card artwork |
| Map and routing services (Protomaps, OSRM, Overpass / OpenStreetMap) | Your IP address and the area you are requesting — which indicates your approximate location | Map tiles, matching the track to real roads, speed limits |
| PayPal (only if you choose to donate) | Whatever you provide to PayPal to make the payment | Voluntary contributions. PayPal is the controller for that transaction; we receive only the fact that it happened |
| Apple | App download and, if you contact us through the App Store, your correspondence | App distribution |
We do not sell personal data, and we do not share it with anyone for advertising.
6. International data transfers
Firebase and OpenAI may process data outside the European Economic Area, including in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
7. Live crew presence — exactly how it works
Please read this section before switching presence on.
- It is off by default. Nothing about your position is uploaded until you turn it on.
- Your position is shared at full GPS precision, not approximated or blurred.
- It is visible to anyone using your team code. Treat a team code like a password — anyone who has it can see the current position of everyone in that team.
- Your presence record holds only your most recent position, direction of travel and speed — not a trail or history. Each update replaces the last. Direction and speed are there so your crew’s map can move your dot smoothly between updates.
- Switching presence off, or leaving the team, deletes your presence record.
- If the App is force-quit or the device loses power before it can delete the record, your last known position may remain stored until you next open the App and turn presence off, or until you ask us to delete it.
There is no global or public map of riders, and we will not build one.
8. Data retention
- Hazard reports are about places rather than people and are kept while they remain useful to other riders. Your handle stays attached unless you ask us to remove it.
- Presence records are deleted when you switch presence off or leave a team — subject to the caveat in §7.
- Ride statistics are kept while you use a team, and deleted on request.
- On-device data — your GPX files, offline map packs, recorded rides, collection cards and API key — is deleted when you delete the App.
9. Children's privacy
Pakmandidos is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Your rights under the GDPR
You have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict processing of (Art. 18), port (Art. 20) and object to the processing of (Art. 21) your personal data, and to withdraw consent at any time without affecting processing already carried out.
Because there is no account, we need your rider handle to find your data. Email the address in §14 and we will respond within one month.
11. Right to lodge a complaint
You may complain to a supervisory authority in the EU member state where you live or work. For the controller named below, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.
12. Data security
Everything is encrypted in transit. Your OpenAI key sits in the iOS Keychain, encrypted by the operating system and unreadable by other apps. Access to the shared data is restricted by security rules tied to your anonymous ID.
13. Changes to this Policy
We will update this page when the App's data handling changes, and we will change the date at the top. Material changes will also be noted in the App's release notes.
14. Data controller and imprint
The controller for the purposes of GDPR Art. 4(7), and the provider under § 5 TMG, is:
Dovydas Jakstas (sole trader)
Hedwig-Porschütz-Straße 11
10557 Berlin
Germany
Email: dovydz@gmail.com
15. Contact
For any privacy question, or to exercise any right above, email dovydz@gmail.com.