Privacy Notice | PaceSpace

Version: 1.0.43

Last updated: 21 September 2026

1. Who is responsible

Data Controller / Operator: PaceSpace
Registered address: PaceSpace
Privacy contact: [email protected]
EU/UK/Türkiye representative or data-protection contact, where required: PaceSpace — [email protected]

This notice explains the data practices of the PaceSpace: Run, Walk, Bike mobile application ("PaceSpace"). The Operator must ensure this information continues to match the relevant store listing and public support contact.

2. Summary and required acknowledgement

Google Play subscriptions

On Android, Google Play processes subscription payments under its own terms and privacy policy. The App receives product identifiers, eligible localized prices and billing phases, purchase state, signed receipt data, purchase token and acknowledgement state to check access and complete the store transaction. Receipt verification occurs on the device using the application's public Play licensing key. The App does not collect card details or create a PaceSpace login. To verify current access and the purchased monthly or yearly plan, the App sends the purchase token over HTTPS to the first-party PaceSpace API at pacespace-app.com. The API sends this proof to Google Play Developer API and returns access status, plan identity and the server purchase record identifier. The server keeps purchase-operation records needed for duplicate prevention, entitlement state, refunds, revalidation and reconciliation. These records can include the App-supplied user identifier, product/provider identifiers, provider order identifier, purchase status, purchase and expiry times, amount/currency when supplied by the provider, a one-way token hash, the provider purchase token needed for later provider operations, status history and provider-event references. Purchase tokens, authentication secrets and other configured secret fields are masked from structured application logs and are not returned by Admin read APIs. Server service-account credentials never enter the App. Google Play retains its own transaction records under Google's terms.

A separate device-local preference record stores the number and time of automatic subscription offers, to limit repeated prompts. It is excluded from portable exports, imports and in-App settings reset; OS data clearing or uninstall removes it. Access continuation uses a process-local monotonic timer and requires another store query after restart. Saved plans and reminder selections remain stored when Premium ends, but are disabled until access is restored. Deleting local data does not cancel the store subscription.

PaceSpace is a local-first walking, running, and cycling app for adults. It has no account, login, server-side activity sync, social network, or advertising feature. Your profile, exercise history, route points, metrics, planned appointments, preferences (including the saved device/light/dark colour theme, independent local workout voice and vibration guidance, TTS language, and voice choices), the completed launch-story sequence version, consent choices, and active-session draft are stored in local app storage on your device. The App does not send that local data outside the device except for a specific export, share, save-to-gallery, Help, Report an issue, or opted-in analytics action described below, or for the sanitized automatic diagnostic event sent when a valid Sentry configuration is present.

The Km/Miles measurement preference is stored only on this device and defaults to Km. It changes distance/speed displays, plan input, share output, notifications and spoken guidance; underlying activity and plan records remain in metres and kilometres per hour. It does not change body measurements or add data collection. This preference is not included in portable JSON exports/imports; settings reset, deleting all local data or uninstalling restores Km.

Before you can use the App, you must make an 18+ declaration. By choosing Accept and continue, you accept the Terms of Service and acknowledge that you have read this Privacy Notice. That legal acknowledgement is required. Product Analytics is presented afterwards as a separate, optional, default-off choice; declining it does not prevent the local exercise functions.

The App can make limited network requests in six situations:

it requests OpenStreetMap tiles to render a map;
when you choose Help or Report an issue and press Send report, it sends the selected support category and up to 250 characters of text you enter, prefixed with the selected language code, to configured Sentry;
when a valid Sentry configuration is present, it sends a sanitized automatic error diagnostic event described in section 5;
if you separately opt in, it sends the limited Product Analytics events described in section 6 to PostHog's EU ingestion endpoint.
if a version contains a visible launch-story external action and you press it, the App may open its fixed, disclosed, allow-listed HTTPS destination in the system browser. The current bundled sequence contains no enabled external destination.
after onboarding or when you open Announcements, it requests the first-party story catalogue and images from pacespace-app.com as described in section 5.

3. Data the App processes locally

Category	Examples	Purpose	Storage and retention
Optional profile information	locally generated profile id, height, weight, creation and update times	improve non-medical exercise and calorie estimates when you choose to provide measurements	local App storage until you reset settings, clear the App's data, or uninstall, subject to device behaviour
Exercise and location information	selected on-foot or bicycle mode, precise route points, altitude, accuracy, time, speed, distance, duration, estimated calories, map preview	apply mode-specific movement validation, speed colours, and non-medical calorie estimation; record, display, recover, and summarise your exercise	local App storage; while a user-started exercise is active, undelivered foreground-service location fixes may be held only until handed to the local recording listener or the service stops; completed activities remain until you clear data or uninstall; a matching draft is removed when the activity is completed
Workout-plan information	plan name, ordered target-speed and duration steps, repeat counts, the most recently selected saved plan, and the selected plan's immutable session snapshot	let you create, reuse, and execute an optional planned workout; restore your most recent saved-plan choice; preserve the plan used by an active or completed workout	saved plans and the most recent saved-plan choice remain in local App storage until you remove the selected plan, clear App data, or uninstall; a selected plan snapshot remains with its active or completed workout record independently of later plan edits or removal
Planned activity and local reminder information	selected date/time, optional plan, repeat rule, reminder offsets, completion marker, and the device-wide workout-reminders switch	show a future walk or run, schedule device-local reminders, and open the selected appointment when a reminder is tapped	local App storage and the operating system's local-notification store until you delete the appointment, reset settings, delete all App data, or uninstall
Motion information	step-count, accelerometer, gyroscope, GPS speed/displacement, and derived movement state	validate active movement and improve the reliability of the route and metrics; bicycle mode relies on GPS movement rather than step distance and accepts its documented higher-speed range	used during recording; derived session information is retained locally as above
Preferences and legal choices	language, saved device/light/dark colour theme, completed launch-story sequence version, route-smoothing preference, the device-local choices to suppress automatic physical-activity explanations or the optional height/weight invitation, independent workout voice- and vibration-guidance choices, selected TTS language and voice, 18+ declaration, acknowledgement of this notice and the Terms, the acknowledged document versions, UTC time, displayed language, action source, and optional analytics choice with its selection time and source	configure the App, show a versioned local launch-story sequence once, honour appearance, prompt, and workout-cue choices, enforce its adults-only gate, and retain evidence of the acknowledgement	local App storage until you reset settings, clear data, or uninstall
Technical configuration	platform permission state, native pause timing, live-session recovery state, and already-delivered workout cue identifiers	enable requested device functions, preserve active-duration semantics, and recover an interrupted user-started session without repeating cues	local App storage while relevant
Map tile cache	OpenStreetMap tile images and HTTP freshness/validation metadata for map areas you viewed	avoid unnecessary repeat tile requests and follow the tile service's caching requirements	platform cache storage with a nominal 1 GB size ceiling; freshness follows server headers or a seven-day fallback; entries may remain for revalidation until size or operating-system eviction, App-data clearing, or uninstall

Workout voice guidance uses the operating system's installed text-to-speech engine for audio output. PaceSpace does not record or upload microphone audio, spoken text, TTS language choices, voice identifiers, or spoken cue text. TTS failures do not stop an active workout. Vibration guidance is a separate, default-on setting. When enabled on Android, each planned-step start and workout completion asks the existing local-notification system for a one-second, soundless vibration and a transient local notification. PaceSpace does not use a custom haptic channel. Notification permission, channel, Do Not Disturb, and device vibration settings can suppress delivery; failure does not stop the workout.

PaceSpace does not collect your exact age or date of birth. Its 18+ gate stores only a completed eligibility declaration. Height and weight are not required during onboarding. If measurements are missing, the App asks before entering an exercise whether you want to provide them for a better calorie estimate. Not now continues that exercise and allows the invitation to return next time; Don't ask again stores a local suppression preference; Let's do it opens the measurement choices and returns to the same exercise preparation. If you have enabled Product Analytics, the App may send that the prompt was shown, your normalized prompt action, and whether workout measurement setup was saved, cancelled, or failed. It does not send the local profile, height, weight, entered values, or the stored suppression state to PostHog.

When you choose Help or Report an issue, the message draft remains only in the open dialog until you cancel or press Send report. Pressing that button is a separate, user-initiated disclosure: the selected category and up to 250 characters of text are sent to configured Sentry. If Sentry delivery is not available on Android, the App opens your email application with the same text addressed to the Operator's release-configured support address; you review and send or cancel that draft in the email application. The App does not automatically attach your route, location, profile, map preview, or activity values. The input warns you not to enter location, health, or identity information, but you are responsible for the content you choose to submit. The App does not add the message to its Hive local storage after the dialog closes; Sentry may use its own delivery storage according to its configuration.

When a valid Sentry configuration is present, an automatic diagnostic can be sent when an unhandled or handled application error occurs. The App rebuilds that event from a technical allow-list: sanitized exception type/module, sanitized function or package symbols, line and column numbers, application release/environment, timing, platform, and a fixed error-source label. It does not send the exception message or value, user or request fields, route or activity data, profile data, contexts, extras, breadcrumbs, source paths, source lines, variables, screenshots, replay, transactions, or performance traces. This is an application-level filtering design, not a guarantee that a network provider cannot process ordinary transport metadata such as an IP address. The configured Sentry recipient, retention, transfer safeguards, and legal basis must be completed in the published version before release.

Upon an explicit user request, the App may produce an activity-share image or a local JSON export containing only categories selected in the export dialog. The user can choose the operating system share sheet or Android's document creator, where the user selects the visible destination before the UTF-8 JSON is written. For a generated activity-share image, the user can choose the share sheet or save it to the device gallery. The share screen includes a default-on Show route control; turning it off omits the route and its start/end markers from the generated image. The App does not upload the export or share image to a PaceSpace service, create a social account, or post on the user's behalf. Each of those image-saving choices is an explicit user action. A selected external recipient may process a shared file under its own terms and privacy notice. Import reads only JSON the user either pastes into the App or explicitly selects through Android's system file picker. The 18+ declaration, Privacy Notice acknowledgement, Terms acceptance, their evidence, and the Product Analytics preference are never exported or imported. A legacy permissionsAndPrivacy category in an imported file is ignored and does not change the current installation's legal or analytics choices. The device-local choices to suppress automatic physical-activity permission explanations or the optional height/weight invitation are also not exported or imported.

When the workout-reminders switch in Settings is enabled and the user first saves a planned activity with at least one reminder choice, the App may ask for notification permission and, on supported Android versions, the special exact-alarm permission needed for on-time delivery. It schedules only those device-local reminders. The user can remove every reminder choice; saving with no reminder choice does not request notification permission or schedule a reminder for that activity. Disabling the device-wide switch cancels pending device-local reminder schedules. A reminder can open that same local appointment, even if its time has passed. The reminder itself is not sent to a PaceSpace server.

4. Permissions and exercise recording

The App asks for location, physical-activity/motion, and, when needed, notification permissions. Missing notification access is requested during exercise preparation so the ongoing exercise notification can be visible; refusal does not prevent recording. It can also be requested when you save a planned activity with a reminder choice. It is not offered on Home or after exercise completion. Android exact-alarm access is tied only to that reminder-scheduling action. It accesses these permissions only to provide the current exercise-recording functions you start or use. When physical-activity access is missing, the App first presents an Activity access request explaining that this access reads steps and confirms movement during an activity you start and does not access calls, messages, contacts, photos, or files. The Android system permission prompt opens only after you choose Allow activity access. Choosing Not now, or declining the system permission, allows the explanation to be offered again during the next preparation. Choosing Don't ask again stores a device-local preference and suppresses future automatic explanations. The App's Settings has no separate Permissions page or location/activity permission controls. You can grant, review, or revoke operating-system permissions directly in your device settings. Resetting the App's settings clears the Don't ask again choice. If physical-activity access is declined or the explanation is dismissed or suppressed, the App explains that motion verification will be limited and GPS tracking will continue. This result does not block countdown once two usable location samples are available. Location access remains required for route recording and its denial can block preparation. Android may maintain a visible foreground-service notification throughout a user-started active exercise, including while its exercise screen is visible. That notification may show the current locally calculated total duration, the active plan's target speed and time interval when applicable, current speed, distance, estimated calories, and GPS/motion status; it does not show route coordinates or profile values and does not send those values to a recipient. The App does not declare or request Android's ACCESS_BACKGROUND_LOCATION permission. On iOS, Core Location background updates are configured only for an active exercise you started and the system may show its location indicator. The App does not start a new exercise or location collection in the background.

You can decline or revoke permissions in your device settings. That can prevent exercise recording or reduce its accuracy, but it does not automatically erase previously stored local data.

5. Network recipients and disclosures

First-party API diagnostic logs

PaceSpace web/API services produce structured operational logs for security, fraud and abuse investigation, diagnosis and service operation. Depending on the service and configured logging profile, a record can include a server-generated TrackId, OriginTrackId for outbound calls, UTC time, service and environment identity, HTTP method, route/controller/action metadata, URL and query metadata, request/response headers, bounded API request/response bodies, response status, duration, class/method and structured exception-chain details. Records also include the client IP address and the directly connected peer IP address. For public requests routed through Cloudflare and Caddy, the services accept the originating client IP only through the configured trusted-proxy chain. For server-side UI-to-API calls, the UI passes the verified client IP using a short-lived, cryptographically signed internal value. Arbitrary client-supplied forwarding or internal IP headers are not treated as authoritative. UI logging does not capture rendered HTML/CSS/JavaScript/image/font/binary response bodies.

A central sanitizer masks configured sensitive header/query/body fields such as Authorization, cookies, API keys, passwords, secrets and purchase tokens before structured log export. The application does not intentionally include raw authentication credentials or raw purchase tokens in Elasticsearch events. Structured application logs are sent to the Operator's self-managed Elasticsearch service. No automatic deletion or maximum retention period is currently configured for these records; they may remain stored until the Operator deletes them manually. Hosting, Cloudflare, Caddy, SSH and other infrastructure logs are separate and may be subject to their respective configurations and retention practices.

Android update-policy checks

The Android app contacts pacespace-app.com/api/v1/update-policy over HTTPS after onboarding, normally once per 24 hours while foregrounded, with limited retries or an explicit retry action. Requests include the Android platform and a fresh random challenge to prevent replay, not an account, device identifier, profile, route or activity record. The hosting provider necessarily receives ordinary connection metadata such as IP address. This feature is independent of analytics consent. The .NET endpoint signs the release policy and server time; it does not persist the challenge or create user records. Hosting/proxy logging remains subject to the operator's disclosed configuration. A dedicated local control record stores the signed response, receipt time and first deferral/target. If you choose Not now before any successful check, it also stores the local start time of a one-time 15-day first-use period; this timestamp is not sent to the server. It is excluded from exports/imports and in-app preference/activity deletion, contains no activity or profile data, and is removed by OS app-data clearing or uninstalling. It is not encrypted or tamper-proof. Google Play handles requested installation under its own terms. See the Terms for first-use verification and the 15-day limits on starting new workouts.

Launch-story external links

If the announcement catalogue fails to load or exceeds the five-second loading limit, the App skips launch announcements without marking them viewed. You can retry from Announcements. This does not bypass the separate mandatory application-version verification rules.

Launch stories and PaceSpace Announcements load first-party product content and images from https://pacespace-app.com over HTTPS after onboarding or when you open Announcements. Requests include the selected language, light/dark theme and launch filter. The server receives ordinary connection metadata, including the IP address. No profile, location, activity, installation identifier or analytics consent value is appended. Validated catalogue responses and decoded images are held in process memory; no persistent catalogue cache is created. While a story is playing, the App may load the next story image in advance into this memory cache; announcement cards use smaller preview images. You may manually replay a completed group from Announcements; replay does not change the saved completed launch-story version and creates no impression, progress, skip, completion, or click telemetry. A future authorised App version may configure a separate visible action with its destination host and an “Opens in browser” notice. It opens only after your tap, only for a fixed HTTPS URL whose canonical host is on that version's exact allow-list. PaceSpace does not append user, device, installation, profile, activity, legal-choice, progress, measurement, or attribution data to that URL. The destination may receive normal browser request metadata under its own terms and privacy notice. The prohibition on news means a general or third-party news feed, not these first-party product announcements. Advertising, sponsored content, targeting, attribution, or a new recipient requires a new product decision and legal review; none is enabled in the current sequence.

OpenStreetMap tile service

When you view a map or generate a map preview, the App requests tiles from https://tile.openstreetmap.org. A tile request includes normal network request data such as IP address and user-agent information and identifies requested map tiles. Tile coordinates and request patterns can reveal areas associated with a route or current map view. The App does not upload the full activity record, raw GPS route as an App payload, profile values, or map preview to this service. Map availability and the provider's processing are governed by that provider's own terms and privacy information. The App does not bulk-download, prefetch, or offer offline tile downloads. Its built-in cache follows HTTP freshness and validation metadata, with a seven-day fallback when freshness metadata is insufficient.

Sentry diagnostics (only when configured)

If the release contains a valid Sentry DSN, the App initializes Sentry with automatic error diagnostics enabled through the allow-list described in section 2, while navigation, session, client-report, replay, breadcrumb, transaction, and performance delivery are disabled. Automatic errors contain only sanitized technical exception and stack-symbol metadata; they do not contain user-entered exception text, local exercise/profile data, user/request fields, contexts, extras, paths, source lines, variables, screenshots, or replay. Choosing Help or Report an issue and pressing Send report sends a Sentry User Feedback item, tagged as either help or issue, together with the selected language code and user-entered message (up to 250 characters, formatted as {language} - {message}). The App does not add this message to its Hive local storage after the dialog closes; Sentry may use its own delivery storage according to its configuration. The App does not set a Sentry user or automatically attach route, location, profile, map-preview, or activity values. A deliberate support request can still include the language-prefixed user-entered text and the minimal runtime, device, operating-system, application-version, timing, and network information Sentry needs to receive that request. Sentry's configured endpoint, retention, and international-transfer safeguards must be published by the Operator before release.

If configured Sentry delivery is unavailable on Android, the App may instead open the device email application with the same language-prefixed message and the Operator's release-configured support address. The email is not sent by the App; the user reviews, sends, or cancels it in the email application, whose provider may process the message under its own terms and privacy notice.

PostHog product analytics (only after opt-in)

The App limits waits for analytics SDK operations to five seconds per operation so optional analytics does not indefinitely block onboarding. If setup or consent synchronization fails, the App stops allowing analytics events and may report a sanitized technical error through configured Sentry. This does not enable analytics without your consent.

If you enable Product Analytics and the App contains valid configuration, the App sends only the allow-listed events in section 6 to PostHog's EU ingestion endpoint. The SDK may use a pseudonymous technical identifier to deliver analytics; the App does not create a user account or PostHog person profile. Every allowed event contains a fixed, non-user deployment label (for example, production) and the installed App version. As the sole geographic exception, the App permits PostHog to derive IP-based geographic properties from the ordinary network request after opt-in. Depending on PostHog's service, those properties may include country, continent, region, city, postal code, or time zone. The App does not send GPS, a route, map centre, coordinates, or profile data for this purpose. The App disables Session Replay, rage-click, push-subscription and push-open events, surveys, feature-flag events, lifecycle events, PostHog error capture, and PostHog logs.

We do not sell your location, profile, route, or activity data through the App, and the App does not implement targeted advertising or a social-data sharing feature.

6. Product Analytics

Product Analytics is optional and default-off. The App sends no App-initiated PostHog product event until you enable it after acknowledging this Privacy Notice and accepting the Terms. You can change the setting in PaceSpace Settings at any time. Turning it off immediately stops future App-initiated product events.

The App has a fixed allow-list. Product Analytics can contain only the following categories:

Category	Examples
Safe screen data	an approved, normalized product screen name
Onboarding completion	onboarding completed after the first durable legal-consent transition; supported App language
Optional workout profile prompt	prompt shown; normalized action (`never_ask_again`, `not_now`, or `set_up`); setup result (`saved`, `cancelled`, or `failed`); no height, weight, entered measurement, local profile, or stored suppression state
Workout lifecycle	start attempted; preparation result and fixed failure reason; tracking started, paused, resumed, finish requested, durably completed, recovery available/result/success, and fixed technical issue type
Workout segmentation	fixed physical type (`walk_run` or `bike`), saved-plan structure (`free` or `workout_plan`), schedule context, and explicit start source; no plan name or identifier
Plans, scheduling, and reminders	saved-plan create/update/duplicate/delete/select with step-count bucket and repeat-group flag; scheduled-activity create/update/delete with plan structure, reminder flag, and fixed repeat type; reminder setting changes and a verified local-reminder tap; no name, identifier, or exact date/time
Permissions	fixed permission, product context, and operating-system result for a request actually presented by the App
Weekly summary and sharing	weekly activity-count bucket; share surface/style/output request and platform-confirmed gallery save, without the image, route, activity measurement, or destination
Deployment and GeoIP exception	fixed non-user deployment label, installed App version, and PostHog IP-derived geographic properties; no App-supplied GPS, route, or coordinates

Product Analytics does not send route coordinates, precise location, altitude, addresses, map tiles, map previews, raw activity points, exact distance or duration, speed, calories, step count, accelerometer, gyroscope or other sensor readings, Workout Plan names or identifiers, scheduled timestamps, profile values, height, weight, gender, age, date of birth, email, name, contacts, account data, user-entered free text, import or export content, shared images, Session Replay content, screenshots, surveys, feature-flag events, lifecycle events, rage-click events, automatic PostHog push-subscription/open events, PostHog logs, stack traces, raw exceptions, or PostHog error-capture events.

Your Product Analytics choice, its selection time, and its source are stored locally with your other App preferences. Refusing analytics does not deny the local exercise-recording functions. Disabling the choice prevents future App-initiated events but does not undo events already received by PostHog.

7. Why we process data

We process the local data needed to provide the functions you choose to use, such as recording an exercise and retaining its local history. Optional Product Analytics requires your affirmative choice in the App before App-initiated events are sent. A support request is sent only after you enter its message and press Send report. Diagnostic reporting is used to secure, maintain, and improve App reliability when configured.

The exact legal basis for automatic diagnostic reporting depends on the law that applies to the Operator and you. Before publication, the Operator must map each processing purpose and transfer to an applicable legal basis, including any required explicit consent, and add that jurisdiction-specific information to this notice. This notice does not use acceptance of the Terms as a substitute for consent where consent is required.

8. Retention, deletion, and security

You can remove a saved workout plan or planned appointment, delete one occurrence from a recurring planned appointment, or delete an individual completed activity. Removing one occurrence preserves the other occurrences in that group; removing the planned appointment removes the whole group. This does not remove a plan snapshot held by an active or completed workout. Reset settings removes the saved colour theme, completed launch-story version, and other settings, profile, saved plans, planned reminders, and local consent choices while preserving completed history. Delete all App data removes the local records held by the App, including completed history and any active draft. While either clearing action is running, colour-theme changes and another clearing action are unavailable; the App does not recreate the removed theme setting during that operation. If the local storage clear fails, the App reloads the theme value that remains in local storage. Export creates JSON only for the categories you check and can open the system share sheet or save it to the user-visible Documents/PaceSpace directory; import reads only JSON you paste or explicitly select through Android's system file picker and replaces only included local categories. A generated activity-share image can separately be saved by you to the device gallery; it is outside local App storage and may remain after you delete App data or uninstall, subject to device-platform behaviour. These actions do not create cloud backup, an account, or remote recovery. Legal acknowledgements, the 18+ declaration, their evidence, the saved colour theme, and the Product Analytics preference are excluded from export and ignored on import, including when a legacy file contains them. You can also use device App-data controls or uninstall; platform behaviour may affect when local files are removed. On Android, this App disables automatic App backup and device-to-device restore. It does not add its own application-level encryption to its Hive local storage. Keep your device protected.

Recipient-held Sentry or PostHog data may have separate retention settings. Those settings are not defined in this repository and must be stated in the published version before a configured recipient is used. A submitted support message cannot be withdrawn from Sentry through the App; use the published privacy contact for a request concerning a recipient-held message. Disabling an optional analytics choice stops further App-initiated collection; it does not retroactively delete data already received by a recipient. The App's local Delete all data action does not delete automatic diagnostic events already received by Sentry; use the published privacy contact and the Operator's recipient-side process for those requests.

9. Your choices and rights

You can control operating-system permissions in device settings and change the saved device/light/dark colour theme in the App's Settings. You can change your Product Analytics choice in the App's Settings; a change is applied immediately to future App-initiated PostHog collection. You may choose not to submit a Help or Report-an-issue message; submitting one is not required to use the local exercise features. The Product Analytics choice does not control automatic diagnostic reporting; if applicable law requires a separate choice for that reporting, the Operator must provide it before publication.

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, and to complain to a supervisory authority. Because PaceSpace has no account or server-side copy of your local activity history, the Operator may not be able to retrieve or alter data that remains only on your device. Use the privacy contact above for data-protection requests, including requests relating to configured third-party recipients.

10. International transfers and third parties

Tile-service, Sentry, and PostHog requests can involve processing outside your country. PostHog is restricted by this App's configuration to the EU ingestion endpoint. The OpenStreetMap service is fixed in this repository; the configured Sentry endpoint is not. The Operator must verify each recipient's data region, contractual safeguards, and legal transfer requirements before release.

11. Changes and contact

We may update this notice when App behaviour, recipients, legal requirements, or safeguards change. A material change will be made available before it takes effect and will use a renewed choice where required. Contact the privacy contact in section 1 for questions or requests.