Privacy policy

Version of 4 September 2026

Data controller

[Alain Simac], [293 route du tunnel 73370 Le bourget du Lac], [alain.simac@gmail.com].

Data processed

• GPS position during a crossing: recorded on the phone. In shareable mode it is sent live to the server to feed the tracking page. When an account is signed in within the app, every finished crossing (personal or shared) is archived on the server so it can be viewed on aquatracking.live (“My account”) and exported as GPX. Without an account, nothing leaves the phone.
• Account (optional): name, email address, password (stored as a bcrypt hash), account code.
• Purchases: App Store transaction identifiers and purchased product, needed to credit the account and prevent duplicates. No banking data passes through our servers.
• Technical logs of the server (IP address, timestamp, route called), kept at most 30 days by the hosting provider.

No advertising tracking, no third-party trackers, no resale of data. The app does not collect any advertising identifier.

Purposes and legal bases

Providing the service (performance of the contract); security and fraud prevention on purchases (legitimate interest); accounting obligations (legal obligation).

Public tracking page and “Live” page

When a user starts a crossing in shareable mode, a page aquatracking.live/t/CODE shows their first name, position, track, distance and time live to anyone who has the link. This disclosure results from an explicit choice by the user at each crossing. If they also tick “Visible on the Live page”, the crossing is listed on aquatracking.live/live, accessible to everyone, for its duration and up to two hours after the finish. This option is off by default.

Recipients and hosting

Data is hosted in Europe by IONOS SE. It is not transferred to any other third party, except Apple for purchase validation.

Retention

Account data and crossings: until the user deletes the account (immediately, from the app) or after 3 years of inactivity. Positions of a tracking session: kept with the crossing. Transactions: 10 years (accounting obligation).

Your rights

Access, rectification, erasure, portability, objection and restriction: from the app (profile edit, account deletion), from the “My account” area of the website (view, rename, delete and GPX export of each crossing) or by email to [contact email]. Complaints may be lodged with the CNIL (cnil.fr).

Security

Encrypted connections (HTTPS), hashed passwords, hashed session tokens, database access restricted to the application.