Privacy policy
OnTrace works without an account: importing a trace and reading the map record nothing about you. This page says what changes when you create an account, what the site processes, and how to take back control of your data.
Last updated: 24 October 2026
This is a translation for convenience. The French version of this text is the one that applies, and prevails in case of any difference.
Who is responsible for your data
The data controller is the publisher of the site: a private individual who has not made their identity public (see the legal notice). You can reach them, for any question about your data, at dpo@ontrace.xyz.
What we process, why, and for how long
We only collect what the service needs. No data is sold, and OnTrace has no ads. Visits are counted without any cookie, as detailed below.
| What | Why | Legal basis | How long |
|---|---|---|---|
| The GPX trace you send for a search, without an account | Finding the places around the route. The trace is read in memory and not kept. Only geographic areas are sent to OpenStreetMap and refuges.info to get the places. | Performance of the service you asked for (art. 6.1.b GDPR) | Not kept, unless you share it |
| The pages you visit, with no cookie: the time, the page address and its language (never the rest of the link), the site you came from, the country, region and city inferred from the connection, the browser, the system and the device type | Knowing which pages are useful, as a number of visits, with Vercel Web Analytics, on our behalf only. A visit is recognized by a hash of the request, without keeping your IP address. No profile is built and nothing is linked to your account. You can object to it from the cookie policy. | Legitimate interest (art. 6.1.f GDPR): audience measurement limited to the site’s statistics, exempt from consent (art. 82 of the French Data Protection Act) | The hash is forgotten after 24 hours. Totals can be viewed for 1 month on Vercel’s free plan, up to 24 months on a paid plan, and Vercel may keep them longer |
| The blog posts you read, with no cookie: a hash of your IP address, browser and language, mixed with a secret drawn at random every day | Knowing how many people read each post, on our own servers and on our behalf only. The same person is counted only once a day. Neither the IP address nor the browser is kept, and the hash cannot lead back to you. You can object to it from the cookie policy. | Legitimate interest (art. 6.1.f GDPR): audience measurement limited to the site’s statistics, exempt from consent (art. 82 of the French Data Protection Act) | The hash and the secret of the day are erased the next day. Only two numbers per post and per day remain: readers and views |
| Your account: e-mail address, username, color, chosen language, encrypted password (or sign-in link sent by e-mail) | Creating and managing your account, identifying you on traces and comments, writing to you in your language | Performance of the contract, that is the terms of use (art. 6.1.b) | As long as you use the account. Deleted on request, in one click. An account unused for 3 years is deleted, after a warning e-mail one month before |
| Your session: session cookie, IP address and browser of the session | Keeping you signed in, protecting the account, limiting abusive attempts | Performance of the contract and legitimate interest in security (art. 6.1.b and 6.1.f) | 7 days for the session. Rate-limit counters are erased after 24 hours |
| The traces you share, groups, roles and group comments | Preparing a route together, as you asked | Performance of the contract (art. 6.1.b) | As long as the group exists. You can delete a trace you shared at any time, from “My traces”: the group, its members and its comments are then erased. If you delete your account, your comments become “Former member”, or are erased if you ask |
| Your public reviews of places: state seen, note, date, username | Telling others about the state of a water point, a hut or a shop | Performance of the contract and legitimate interest of the community (art. 6.1.b and 6.1.f) | As long as the review is useful. You can remove it at any time. Public by nature |
| The zones you draw on the map for everyone: outline, subject (camping or protected area), calendar, description, username | Telling others where camping is allowed, tolerated, restricted or forbidden, and which areas are in a park or reserve | Performance of the contract and legitimate interest of the community (art. 6.1.b and 6.1.f) | As long as the zone is useful. You can delete it at any time. Public by nature, reviewed by the team. If you delete your account, it goes under “Former member”, or is erased if you ask |
| The zones you draw and the points you place for a single trace (aid station, meeting point, first aid…): outline or position, type, name, note, calendar | Preparing your route or your race. Nobody else sees them and the team does not read them | Performance of the contract (art. 6.1.b) | Until you delete them. Erased with your account |
| The race plan of a trace attached to an organization: posts (aid, first aid, marshals), their position, the team, the times, the name and phone number of the contact you enter, the needs and notes | Letting an organization prepare and print its teams’ sheets. Only the members of the trace’s group see it, never the public. The contact entered is a third party: tell them | Performance of the contract (art. 6.1.b) | As long as the trace exists or until you delete the post. If you delete your account, the posts stay with the group without your name |
| Your membership of an organization: its name, your role, the date you joined, the traces attached to it, their edition, the approvals you make (date, note, your username) and the organization’s activity log (who added, removed, attached or approved what) | Letting a team (club, race organizer, agency) prepare its traces together and follow their activity. Members of an organization see who belongs to it | Performance of the contract (art. 6.1.b) | As long as you belong to it. You can leave at any time. The activity log is kept for one year. Erased with your account |
| Moderation: flags, decisions, reasons, team notes, appeals, notifications | Enforcing the rules, handling flags, telling you about decisions, letting you appeal them | Legal obligation (LCEN, EU Digital Services Act) and legitimate interest (art. 6.1.c and 6.1.f) | As long as the account exists. The name is replaced with “Deleted account” in the log if you leave |
| The service’s e-mails: sign-in link, moderation decisions, team alerts | Telling you about what concerns your account | Performance of the contract (art. 6.1.b) | Not kept by OnTrace after sending. See the providers below |
| Demo requests for the Pro offer: name, e-mail, organization, message | Answering your request | Pre-contractual steps at your request (art. 6.1.b) | 3 years after the last exchange |
| Content notices sent through the public form: name, e-mail, description, language of the page | Examining the notice and answering you | Legal obligation (LCEN, EU Digital Services Act) (art. 6.1.c) | 1 year after the answer |
| Your cookie choice: a random identifier, the accepted categories, the version of the questions | Proving that you were asked and what you answered | Legal obligation (art. 82 of the French Data Protection Act, art. 7.1 GDPR) | 13 months. No IP address and no link with your account |
| The host’s technical logs: IP address, date, page requested | Running the site, protecting it, understanding outages | Legitimate interest in security (art. 6.1.f) | A few days to 30 days depending on the host |
A group’s comments can only be read by people who have the group’s link. The moderation team only reads them if they are flagged to it.
Who receives your data
Your data is only read by the small number of people who run and moderate OnTrace, and by the following technical providers, who process it on our behalf:
| Provider | Role | Where |
|---|---|---|
| Vercel Inc. | Hosting of the site, technical logs and audience measurement | United States and global delivery network |
| Neon | Database: accounts, traces, reviews, comments, zones | Union européenne (Francfort, Allemagne) |
| Resend | Sending the service’s e-mails | United States |
The site also queries open data sources, without passing on any information about you: OpenStreetMap (Overpass) and refuges.info receive geographic areas to return places, and Transitous receives the position of a transport stop, when you open its card, to return the next departures. Open-Meteo receives a few points of the trace with a date and time, only when you ask for the weather, to return the forecasts. IGN’s elevation service receives the points of a route you build on the map, or of a trace whose file gives no elevation, to return their elevation.
Finally, your browser itself contacts a few services to show the page. They then see your IP address:
- OpenTopoMap and IGN for the base maps. They are needed for the map to show.
- Wikimedia Commons and Mapillary for photos of places. They only load with your consent.
Transfers outside the European Union
Some providers (the host, e-mail sending) are established in the United States. The transfer relies on the EU–US Data Privacy Framework when the provider is certified under it, or otherwise on the European Commission’s standard contractual clauses.
Your rights, and how to exercise them
You have the right to access your data, correct it, have it erased, restrict its use, object to it, get it back in a readable format, and withdraw your consent when a processing depends on it. You can also give instructions about what happens to it after your death.
- Access and download: “My profile”, then “Download my data”. You get a JSON file with everything the site keeps about your account.
- Correct: “My profile” changes your username and your color.
- Erase: “My profile”, then “Delete my account”. Deletion is immediate and final. Your public reviews, comments and zones stay under “Former member”, unless you tick the box to erase them too. Zones drawn and points placed for a single trace are always erased.
- Remove a review: “Remove my report” under the review.
- Withdraw your consent to third-party photos:
- Object to audience measurement: untick the box in the cookie policy.
- Anything else: write to dpo@ontrace.xyz. We answer within one month.
If, after contacting us, you think your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority: Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr/fr/plaintes.
Automated decisions
No decision with effects on you is made by automated processing alone. Two automatic rules exist, and a human stays in charge:
- a review containing a link, an e-mail address or a phone number is flagged to the team, but stays online until it decides.
- a review containing a term from the watch list may be held for review by a moderator. You are told and can appeal.
The details are on the moderation page.
Security
Exchanges are encrypted (HTTPS). Passwords are never stored in clear. Access to the moderation tools is restricted to the team, by role, protected by two-factor authentication, and every decision is written to a log. In case of a data breach likely to put you at risk, you and the CNIL would be told within the time the law sets.
Minors
OnTrace is meant for people aged 15 and over. Below that age, a parent’s consent is needed to create an account. If you think a child under 15 created an account without that consent, write to us: we will delete it.
Changes to this policy
This policy may change when the site changes. The date of the last update is at the top of the page. If you have an account, a change in what we do with your data is announced to you by e-mail, at your account’s address.