Your routes are personal.

Who is responsible

For privacy questions, requests or complaints, contact CourseCrafter at hello@coursecrafter.co.uk.

Information we use

• Route information: a searched place, selected start point, activity, distance or duration, pace, route preference and the resulting route geometry.
• Saved and shared routes: routes saved on your device and route snapshots you deliberately publish using a shareable link.
• Subscription information: a customer reference, email address, Stripe subscription identifiers, plan and subscription status. CourseCrafter does not receive or store your full card details.
• Device access information: a randomly generated browser token. A one-way hash of this token is stored so the browser can remember Pro access.
• Restore requests: the subscriber email, an expiring one-time token and the subscription reference needed to restore Pro on another browser. Restore links expire after 15 minutes and cannot be reused.
• Anonymous service metrics: daily aggregate counts for page views, route-generation attempts and outcomes, GPX downloads, checkout activity and broad error categories. These metrics do not include searched places, start locations, route coordinates, names, email addresses, payment details, device tokens or browser identifiers.
• Technical information: normal server and security records such as IP address, request time, browser information and errors may be processed by our hosting and service providers.
• Messages: your email address and anything you include when contacting us.

How and why we use it

We use information to generate and display routes, provide shareable links, create GPX files, activate and manage subscriptions, respond to support requests, prevent misuse, maintain security and improve reliability. Anonymous aggregate metrics help us identify failed route generations, payment problems and GPX-export errors after launch.

Our main lawful bases under UK data-protection law are performance of our contract with you, our legitimate interests in operating and protecting CourseCrafter, and compliance with legal obligations such as accounting and consumer-protection requirements. Where consent is required, you may withdraw it.

Local storage and cookies

Routes you choose to save are stored locally in your browser and remain private to that browser unless you create a share link. CourseCrafter also uses local browser storage to remember your Pro device token and preferences.

CourseCrafter does not currently use advertising, cross-site tracking cookies or third-party analytics profiles. Its own reliability figures are stored as aggregate daily counts rather than user histories. Stripe and other external services may use essential technologies on their own pages under their respective policies.

Sharing and service providers

We use carefully selected providers only where needed to run the service:

• Stripe for checkout, payment processing, receipts and subscription management.
• Resend for sending secure subscription-restoration emails.
• OpenAI Sites and Cloudflare infrastructure for application hosting, storage and security.
• OpenStreetMap services, BRouter and Open-Meteo for maps, place search, routing, surface data and elevation. Requests can disclose your IP address and the locations needed to calculate a route.

We do not sell personal information. A shared route can be viewed by anyone who receives its unguessable link, so only share links with people you trust.

Retention and deletion

Device-saved routes remain until you delete them or clear browser data. Shared routes are retained so their links continue to work; you can request removal by emailing us with the share link. Restore links expire after 15 minutes, and restore-request records are kept only briefly for expiry and anti-abuse checks. Anonymous monitoring figures are stored as daily aggregate totals and contain no route locations or account identifiers. Subscription and transaction records are retained for support, fraud prevention and legal or accounting requirements. Support messages are kept only as long as reasonably needed.

International processing and security

Some providers may process information outside the UK. Where required, they use recognised safeguards for international transfers. We use access controls, restricted secrets, hashed browser tokens and reputable payment and hosting providers, but no online service can promise absolute security.

Your rights

Depending on the circumstances, you may ask to access, correct, erase, restrict or object to use of your personal information, or request a portable copy. You may also complain to the UK Information Commissioner’s Office. Contact hello@coursecrafter.co.uk first and we will aim to help.

Changes

We may update this policy when CourseCrafter, its providers or applicable rules change. The effective date above will be updated when material changes are published.