In short
Tarnoo uses no analytics, no trackers, no advertising and no profiling. We do not sell or share your data with advertisers. The only cookies we set are the ones needed to sign you in and remember your language — which is why we do not ask for cookie consent.
Who is responsible
Tarnoo, reachable at tarnoo.com.
Data controller: [NAME / COMPANY], [ADDRESS].
Questions or requests: [CONTACT EMAIL].
What we process
Account
- Email address
- Password (stored hashed — we never see it)
- Optional: two-factor authentication (TOTP)
Profile — all optional
- Display name, avatar, bio, website
- Home region, preferred sports, fitness level
- Visibility and privacy settings
Your content
- Planned routes: waypoints, route line, elevation profile, surface
- Uploaded activities (GPX/FIT): the full GPS track with timestamps, speeds and duration
- Saved places, collections, highlight photos, tips and comments
- Likes and bookmarks
Social
- Who you follow and who follows you, including pending follow requests
- Blocks and reports you make
Technical
- Sign-in session in a cookie (strictly necessary)
- Language choice in a cookie (strictly necessary)
- Your IP address, briefly, for rate limiting and abuse prevention
A note on recorded rides and walks
A GPS track often starts or ends at your home or workplace. You control visibility per route (private, followers, close friends or public) and can set a default in your profile. Privacy zones — which automatically hide the start and end of a track — are not available yet. For now, keep routes around your home address private if you would rather not share that.
Why we process it
- Providing the service: your account, your routes and sharing them
- Legitimate interest: security, abuse prevention and rate limiting
- Consent: optional profile fields and anything you deliberately make public
Who processes data for us
On our servers:
- Supabase — database, authentication and file storage, in the EU (Frankfurt)
- Vercel — website hosting, in the EU (Frankfurt)
- Our own server — route calculation and place names, in the EU
- Open-Meteo — weather forecast on a highlight page
Directly from your browser (so these parties see your IP address):
- OpenFreeMap — the map tiles
- Waymarked Trails — trail network overlays, only when you enable that layer
- AWS Open Data — elevation data, only when you enable 3D relief
How long we keep it
For as long as your account exists. If you delete your account, we delete your profile and your content. Reports and admin audit logs are kept longer so we can act on abuse, but without reference to your account.
Your rights
You have the right to access, correct, delete, port and object.
- Deleting is self-service: your profile → Account → delete account
- Taking your data is self-service: export any route as GPX, TCX or FIT
- For anything else, email [CONTACT EMAIL]
If you disagree with how we handle your data you can complain to your national data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.
Map data
Maps, routes and highlights are based on OpenStreetMap, available under the ODbL licence.
Changes
If we change this policy substantially we will say so on the site.