# PRIVACY POLICY

## GPS Analyzer
#### Last updated October 13, 2026

Ma ja Sa OÜ (“we”, “us”, or “our”) makes GPS Analyzer: the apps for iPhone, iPad, Mac and Android (the “App”) and the web app at gpsanalyzer.majasa.ee (the “Web App”), together the “Application”. This Privacy Policy explains what information the Application handles, where it goes, and the choices you have. Please read it carefully. IF YOU DO NOT AGREE WITH THIS PRIVACY POLICY, PLEASE DO NOT USE THE APPLICATION.

## SUMMARY
- Without an account, the App keeps your GPS logs, sessions, activities and settings on your device, and analyzes them there.
- A GPS Analyzer account is optional. If you sign in, the App copies your logs and records to our server, so that they are backed up, reach your other devices and the Web App, and can be shared if you choose.
- Your sessions are private unless you share them. A shared session shows your display name and where you were.
- We do not sell your data, show ads, or use analytics or tracking.
- You can delete single items, sign out, or delete your account at any time.
- Some features use other services when you use them: map images, place names, and exports you choose.

## DATA ON YOUR DEVICE
The App works with:

- GPS logs recorded by your GPS logger or imported from files, with the positions, times and speeds in them;
- the sessions, activities, titles and notes you create, and the analyses of your logs;
- the GPS loggers you connect to: the name you give each one, its serial number and its network (MAC) address;
- your settings.

Without an account, this data stays on your device and we have no access to it.

## YOUR ACCOUNT (OPTIONAL)
You can create a GPS Analyzer account in the App (Settings → Server account) or in the Web App. For your account we keep:

- your email address, to sign you in and to answer your messages;
- the display name you choose, which others see if you share a session;
- a hash of your password, if you set one (never the password itself);
- an account number, when the account was created and how much storage it uses.

You sign in with a code we email you, valid for 15 minutes, or with your password. The App then keeps a sign-in key in your device's secure storage; on Apple devices this is the Keychain, for that device only and not included in backups. The Web App keeps the key in a cookie that only our server can read. A sign-in stays valid for 30 days after you last use it. Our server stores only a hash of the key.

## SYNC: WHAT GOES TO OUR SERVER
While you are signed in, the App syncs with our server when it starts and shortly after you make changes. It sends:

- your GPS log files as they are, including the full tracks with times and positions;
- your sessions, activities, titles and notes, and the analyses your device made;
- the GPS loggers you use: their names, serial numbers and network addresses.

When you first sign in, the logs and records already on the device are sent too. Your other devices signed in to the same account receive them, and so does the Web App.

We use this data only to provide the service: to store it, to analyze logs that arrive without an analysis, to name where sessions took place, and to show it to you on your devices and in the Web App. Our server names places from GeoNames place data that it keeps itself; it does not ask any other service.

If you sign in to a GPS Analyzer server that someone else runs, that server's operator handles your data, not us.

## SHARING SESSIONS
Every session is private until you choose to share it. You can make a session visible to signed-in users, or to everyone (public, also without signing in).

For a shared session, others see your display name, the session's title and description, its times, its start and end points, the place name, its speeds and other results, and the full track. They do not see your email address, your file names or the names of your loggers.

A shared track shows where you were. Share only what you are comfortable showing. When you make a session private again, our server stops showing it at once, but browsers and networks may keep showing a stored copy for up to 5 minutes.

## THE WEB APP
- **Cookie**: the Web App sets one cookie, needed to keep you signed in. It sets no other cookies and does no tracking.
- **Guest use**: if you use the Web App without an account, our server keeps the files you add in a temporary guest account, linked to that cookie. A guest account is deleted 30 days after you last use it. If you then create an account or sign in, its data moves to your account.
- **Settings** you change in the Web App are kept with your account.
- **Support messages** you send from the Web App reach us by email with your display name, your email address, your message and the app version, so that we can answer you.

## THIRD-PARTY SERVICES
Some features use services that we do not run. These connections happen only when you use the feature:

- **Maps**: map images come from CARTO, based on OpenStreetMap data. These requests show CARTO your IP address and the map area you are viewing.
- **Place names in the App**: to name where a session took place, the App asks your device's built-in place-name service, sending the session's start point. On iPhone, iPad and Mac this service is Apple's; on Android it is usually Google's.
- **Exporting or uploading activities**: if you choose to upload or share an activity (for example, to an external speed-analysis or fitness platform, or via your device’s share sheet), the selected data is sent to that third party under their own terms and privacy policy.
- **GPS logger device**: the App communicates directly with your GPS logger over your local network or Bluetooth. This communication stays between your device and the logger.
- **App stores**: the store from which you download the App (such as the Apple App Store or Google Play) has its own privacy practices that we do not control.

We do not control these third parties and are not responsible for their practices. We encourage you to review their privacy policies before using features that rely on them.

## SERVER RECORDS AND LIMITS
- Our server records failed and refused requests with the time, your IP address and, if you are signed in, your account number, so that we can find faults and stop misuse.
- To stop misuse, it counts requests such as sign-in attempts per IP address and per account over short periods.
- Our mail server records the address each email was sent to.
- To check for new logger firmware, the App downloads the list of versions from our firmware server (esplogger.majasa.ee). The request contains no personal data, but like any web server it sees your IP address.

We keep these records only as long as needed for these purposes.

## WHY WE USE YOUR DATA
- To provide the account, sync and sharing you ask for: this is needed for our agreement with you.
- To keep the service secure and working (server records and limits): this is our legitimate interest.
- Sharing a session is your choice, and you can undo it at any time.

## DATA RETENTION
- **On your device**: until you delete it or uninstall the App.
- **On our server**: your account and its data until you delete them.
- **Sign-in codes** expire after 15 minutes, **sign-in keys** 30 days after you last use them, and **guest accounts** 30 days after their last use.
- **After you delete your account**, its records are removed at once. Its log files and analyses are removed within a day, unless an identical file is also kept in another account.

## DATA DELETION
You can delete your data at any time:

- **Delete specific data**: remove individual logs, sessions or activities in the App or the Web App. While you are signed in, an item you delete on one device is also removed from your account at the next sync.
- **Sign out**: in the App, Settings → Server account → Sign out. The App asks first, then removes your account's data from that device. Data that was on the device before you signed in stays, and your account keeps its copy.
- **Delete your account**: in the App, Settings → Server account → Delete account, or in the Web App's account page. You confirm with a code we email you or with your password. This removes your account and everything in it from our server. Data on your devices stays until you delete it there.
- **Delete everything on a device**: uninstall the App.

If you have any questions about deleting your data, contact us at info@majasa.ee.

## YOUR RIGHTS
Under the EU General Data Protection Regulation you can ask us for a copy of your personal data, ask us to correct or delete it, ask us to limit or stop using it, and ask to receive it in a portable form. The App can also export your logs yourself. To use these rights, contact us at info@majasa.ee. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

## DISCLOSURE OF YOUR INFORMATION
We do not sell or rent your data and do not share it for advertising. Others see your data only as described above, when you share a session. If we are ever required to respond to a lawful request, we can only provide information we actually hold, which does not include data kept only on your device.

## SECURITY
- Data on your device is protected by your device’s own security features (such as your passcode, biometric lock, and the operating system’s app sandboxing). We encourage you to keep your device and its operating system up to date.
- Connections between the Application and our server are encrypted (HTTPS).
- Our server stores passwords and sign-in keys only as hashes.
- Each account's data is kept apart; other people see only the sessions you share.

No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security, including for data you choose to send to third-party services.

## CHILDREN’S PRIVACY
The Application is not directed to children under the age of 13, and children under 13 should not create an account. If you believe that a child under 13 has created an account, contact us and we will delete it.

## LINKS TO THIRD-PARTY SITES
The Application may contain links to third-party websites or services that are not operated by us. This Privacy Policy does not apply to those sites, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any third-party site you visit.

## CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. We will indicate changes by updating the “Last updated” date at the top of this Policy, and we encourage you to review it periodically. Your continued use of the Application after a change takes effect means you accept the revised Policy.

## CONTACT US
If you have questions or comments about this Privacy Policy, please contact us at:

Ma ja Sa OÜ
Uus 3
50603 Tartu
Estonia
+372 5163487
info@majasa.ee