Privacy Policy

Effective Date: March 18, 2026

tracekit is self-hosted software — you run it on your own hardware or a server you control.

1. Self-Hosted tracekit

When you run tracekit on your own hardware or a server you control, you are the operator and you are responsible for your own data. tracekit stores everything in a database you own — SQLite by default, or PostgreSQL if you configure it.

What is stored locally

Activity metadata: name, type, date/time, duration, distance, elevation, equipment, heart-rate averages, temperature, and provider-assigned IDs
Provider credentials: OAuth tokens and API credentials for connected services, in your own database or .env file
Source activity files (optional): GPX, FIT, or TCX files you place in your data directory — these stay on your own filesystem

tracekit does not store GPS tracks, per-second sensor streams, or any data belonging to other users.

Your control

Access: all data is in the database file on your server
Delete: use Settings → Danger Zone, or python -m tracekit reset
Revoke: disconnect tracekit from any provider via that provider's connected-apps page

2. How Data Is Used

Display: your cached activities are shown in the tracekit calendar and sync status pages — only to you.
Matching: records from different providers are compared by timestamp and distance to identify the same activity across platforms.
Writeback: tracekit only writes to a third-party platform (e.g. setting an activity name or gear assignment on Strava) when you explicitly click a button to trigger that action. No writes to connected services happen without your direct instruction. In the future, you may be able to create rules for specific automatic actions — any such feature will require explicit opt-in.

tracekit never:

Aggregates or compares data across different users
Shares your data with third parties (other than the providers you explicitly connect)
Uses your data for advertising, machine learning, or AI model training
Sells, licenses, or discloses your data to anyone

3. No AI or Machine Learning

tracekit does not use AI or machine learning models on your data — for any purpose. Specifically:

Your activity data, files, and account information are never passed to an AI or ML model for analysis, classification, or any other processing.
Your data is never used to train, fine-tune, or evaluate any AI or machine learning model, whether by tracekit or any third party.
No AI-generated inferences or scores are derived from your data.

4. Third-Party Platforms You Connect

tracekit connects to the platforms below using credentials you provide. Your use of those platforms is governed by their own terms. tracekit is not affiliated with or endorsed by any of them.

Strava — Strava API terms
Garmin — garmin.com
RideWithGPS — ridewithgps.com

5. Data Retention & Deletion

You control retention entirely. Delete data via Settings or the CLI at any time.

6. Security

Provider credentials are stored in your own database/config file
All traffic should use HTTPS
Passwords are stored as bcrypt hashes and never in plaintext

7. Changes to This Policy

This policy may be updated as the project evolves. The effective date at the top reflects when it was last changed.

8. Contact

For any privacy-related questions or requests, contact chris@tracekit.app.