Privacy

One cookie, named NEXT_LOCALE. It stores which language you chose so the site can serve it again on your next visit, and it holds nothing else: no identifier, no history, nothing that could distinguish you from anyone else who picked the same language. The site keeps one more preference in your browser’s own storage: whether you chose the light or the dark theme, a single word that never reaches the server. Under CNIL guidance a cookie or a stored preference strictly necessary to deliver what the user asked for does not require consent, which is why this site has no cookie banner, and the visit counting described next changes nothing there: it sets no cookie and stores nothing in your browser.

The site counts its visits with Plausible Community Edition, a statistics tool we run ourselves, on our own server at OVH, rather than a service somebody else hosts. It sets no cookie and stores nothing in your browser, and there is no Google Analytics, no pixel, no session recording and no heatmap. For each visit it records the page, the site you came from, your country, the type of device, the browser and the operating system, how far down the page you scrolled and how long it stayed open, and, if you follow a link that leaves the site, such as the ones to the App Store and Google Play, that click and the address the link leads to. Your IP address is used for two things only: working out your country, and, with the description your browser gives of itself, making a code that changes every day, so that two pages seen on the same day count as one visitor. Then it is dropped: Plausible never stores it. None of this is attached to a name or an account, and none of it is shared with anyone. The legal basis is our legitimate interest in knowing which pages are read and whether the site sends people on to the stores. You can object by writing to us, but since nothing in these statistics points to a person once the day is over, there are no rows we could find as yours, and so none we could delete. Separately, the server’s own access log records the standard data of every request, the counting ones included, and your IP address with it; that is a technical necessity of serving a page, the log stays on the machine for seven days and then goes, and it is used to build no profile. That log, and the counters the server keeps about itself, are described under “Server logs and counters” below.

The typefaces are served from this site’s own domain. Your browser makes no request to Google, to a CDN or to any third party while loading these pages, with two exceptions. On an iPhone or iPad, Safari itself asks Apple’s App Store for the app’s name and icon, to show the banner offering Adret at the top of the page. On Android, Chrome itself asks Google Play for the same, so that the Google Play badge can open Chrome’s install sheet without leaving the page. This site sees nothing of either exchange.

Apart from what you give the pages an assistant sends you to, which have a section of their own below, the contact form is the one thing on this site you can send. It carries your name, your email address and your message, and nothing else: no identifier, nothing read from your browser. The message goes out as an email through our own mailbox at OVH, in France, and lands in the mailbox one person reads; your address is put on it only so that a reply reaches you. It is kept there for as long as it takes to answer you and for a year after the last exchange, in case you write again, then deleted, or sooner if you ask. The legal basis is our legitimate interest in answering the people who write. The address printed on the contact page reaches the same mailbox, if you would rather not use the form. A poster you send there is an email like any other, kept the same way. It is shown on this site or in one of our posts only if you have said yes to that poster, under the name you chose or under none, and it stays up until you ask for it to come down; the legal basis for showing it is your consent, which you can withdraw at any time.

The app is a different thing from this website, and this section is about the app. On its first import, or the first time you open the Adret Pro screen if that comes sooner, it creates a session: an identifier with no name, no email address and no password attached to it, held on your phone and on our own server rather than a third party’s. Every request the app makes to this domain carries that identifier, so the server knows whose daily allowance to charge: a poster drawn here when the phone cannot draw it itself, the two steps of a print file, the map tiles the phone fetches to draw one, and a short check at launch asking whether the map data has been rebaked, which is answered with one short string that is the same for everybody. The counts attached to it, how many posters and how many tiles you have asked for today, are held in memory and gone by the end of the day. The sign-in system underneath keeps a little more than that: a row for the session, the IP address and the device signature it was opened and last refreshed from, and a log of those sign-ins and refreshes. None of it is used for anything but keeping sign-in working, and there is no scheduled purge of idle sessions yet; this page will change when there is. Separately, at every launch the app asks Expo’s servers, in the United States, whether a newer version of its own code is available. That request carries a random identifier created when the app was installed, which lets Expo tell one installation from another, and, after a crash, the text of the error, which is how a broken update gets noticed. Expo receives neither your session identifier nor anything about your tracks. The legal basis for all of this is the contract between us: it is the only way to give you the service and to stop one person using all of it.

The app counts how it is used too, with the same Plausible on our own server. It sends which screen you open (never what is on it, and never an identifier) and a few actions: importing a recording, and which way it came in (a GPX, FIT or TCX file, Strava, Apple Health or the sample route); exporting or sharing a poster, and in which form; opening the Adret Pro screen, and which of its features brought you there; subscribing, with no amount and no plan; finishing or skipping the editor’s tour; and, in the editor, opening a panel and making a change there, with which panel it was and, when the change applies a style, which of the styles that come with Adret, or only that it was not one of those. Each request also carries the type of device, the operating system and its version, and the version of the app. What is never sent: your session or account identifier, your email address, the recording or anything that says where the outing went, a title or any other text you typed, the colours you chose, the names of your own styles. Your IP address is treated as it is for the website: used for the country and the daily code, then dropped. None of it is shared with anyone. It is on from the start, on the basis of our legitimate interest in knowing which parts of the app are used. You switch it off in My account, under “Usage statistics”, and from then on the app sends none of it. As on the website, there are no rows we could find as yours.

The Adret app draws your poster on your phone. When it cannot (a route covering more ground than the phone can fetch, or terrain we hold no map data for), it sends the recording to this site to be drawn here instead. A print file, with Adret Pro, is always made here, in two steps: the recording is sent to be drawn again at print size, then the finished poster, with its title and stats, comes back to be turned into the file you get. Either way, what reaches the server is held in memory for the seconds the work takes and then discarded: it is never written to disk, never placed in a database, and there is no copy to come back for afterwards. The exceptions are Adret Pro’s film and drawing from an assistant, set out in the next two sections. The title and the name you put on the poster travel with the request and are blanked out of the server’s logs before those are written. What the logs do keep is the size of the track, its distance and its climb, and, whenever a piece of the map was missing, which square of the world it was in: a square about nine kilometres across, never the track. The map tiles the phone fetches to draw a poster itself are requests for the same squares, and the server’s logs see those requests the way they see any request. Together they say roughly where a track went, not who recorded it, and they are kept for the periods described under “Where it all lives, and for how long”. On the phone, your recordings and finished posters sit in the app’s own documents folder, which your phone’s own backup, iCloud or Google, includes unless you have turned that off. The website’s one upload form is the page an assistant links you to, with Adret Pro, and the section on assistants says what becomes of a recording or a photo dropped there. If any of that changes, this page will say exactly what is stored, for how long, and how to delete it, before the feature ships rather than after.

Adret Pro can turn a poster into a short film of the route drawing itself. The app sends the finished poster, with its title and stats, to this site, which passes it to our server to be drawn as a film. The poster carries the route as it is drawn on it, but not the recording itself, with its points and times. It is held in memory while the film is drawn and then discarded. The film is written to the server’s disk under a random name tied to your session, and waits there until your phone fetches it: it is deleted as soon as the phone has it, and an hour after it was ready at the latest, whether or not it was ever fetched. A restart of the server deletes any film still waiting. Nothing about a film goes into a database, and the logs keep only figures about it, such as its size and how long it took to draw. If you allow notifications, the request also carries your phone’s notification token and the two lines of the notification, in your language; the server uses them once, to ask Expo to tell your phone the film is ready, and then forgets them. Expo passes the notification to Apple or to Google, which deliver it. The legal basis is the contract: the film is part of what Adret Pro is.

With Adret Pro, you can add Adret to an assistant such as Claude or ChatGPT and ask it for posters and films. To connect one, you sign in on this site with a six-digit code sent to the email address of your Adret account, and say yes. That sign-in is held in the page’s memory only: nothing is stored in your browser, and closing the page ends it. Saying yes creates a connection in our sign-in system: the name the assistant registered itself under, the date, and a session the assistant keeps refreshing so it can draw for you, with the same rows, IP addresses and log entries any sign-in leaves, as the app section describes. The session stops being used when you remove Adret from the assistant; to have it ended on our side as well, write to us, and deleting your account ends it with everything else. The assistant sends us a recording in one of two ways: inside its request, or through a page on this site, linked from the conversation, where you drop the file yourself. Either way it is turned into a GPX and written to the server’s disk under a random name only your account can draw from, so that it can be drawn several times, and it is deleted an hour after it arrived. The posters and films drawn from it are written there too, under a random address that anybody holding the link can download, and are deleted an hour after they were made; a film is also deleted from where it was drawn as soon as it is copied there. A photo of yours, to place under a poster, comes through the same kind of link. Only a copy of it is kept, reduced to 3,072 pixels at most on its long side and stripped of the data the camera wrote into it, the place it was taken included, under a random name only your account can draw from, and it too is deleted an hour after it arrived. A restart of the server deletes all of it sooner. None of it goes into a database, and the logs keep only what they keep for any other poster. What it is used for is counted too, with the same Plausible on our own server: each tool the assistant calls; for a poster or a film, which of Adret’s styles, which size or shape and which language, and whether the recording came through the page or inside the request; which assistant it was (Claude, ChatGPT or another); and, when a request is turned down, whether for want of an account, of Adret Pro, or of the day’s allowance. These requests come from the assistant’s servers rather than from your device, so there is no IP address of yours to count a visitor by: in its place, each one carries a code made from your account with a key that exists only in our server’s memory and changes whenever it restarts, which Plausible turns into its daily code and then drops, as it does an address. What is never sent: your account identifier, your email address, the recording or anything that says where it went, a title or any other text, the colours you chose. As for the website, once the day is over nothing in these statistics points to a person, so there are no rows we could find as yours. The legal basis for this counting is our legitimate interest in knowing how the connector is used. What you tell the assistant, the recording you give it and the posters it receives back are also handled by the company that makes it, under its own privacy policy: it acts for itself, because you chose to use it. The legal basis is the contract: drawing from an assistant is part of what Adret Pro is.

You can put one of your photos under a poster. The app does not ask for access to your photo library: your phone’s own picker opens, outside the app, and Adret receives only the photo you choose there. The app makes a copy of it, reduced to 3,072 pixels at most on its long side and stripped of the data the camera wrote into it, the place it was taken included, and keeps that copy in its documents folder beside the poster, which your phone’s own backup includes like the poster itself. The copy is deleted with the poster, and the copy of a photo you have replaced or removed is deleted when you close the editor. The photo leaves your phone in two cases only, and always inside the finished poster: a print file, with Adret Pro, whose second step carries it to this site, and a film, which is drawn from the poster as you see it, photo included. Both are handled as the sections on your GPS tracks and on the film describe: the poster is held in memory while the work is done and then discarded, and the film is kept an hour at most. The legal basis is the contract: it is part of the service you asked for.

The app can connect to a Strava account, so that an outing you already recorded there can become a poster without your having to find a file first. It is optional in the plainest sense: nothing else in Adret changes if you never do it, and every other way of importing still works. When you connect, Strava asks you on its own screen what to allow. Adret asks to read your activities, including the private ones: most people have some, and a list that quietly left them out would be worse than no list at all. What it reads is that list, which is the name, date, distance and climb of each activity, and then, for the one activity you choose, its points, elevations and times. Your phone fetches all of that from Strava directly: it does not pass through this site, and our server never sees it. The GPX Adret writes from it is your file on your device, and it reaches the server only under the rule set out above, when the phone cannot draw the poster itself, and is discarded there in exactly the same way. One step does go through our server, and only one: turning Strava’s approval into an access token, because that exchange needs a secret which cannot be put inside a phone. The code and the tokens pass through it in memory on their way to your device; none of it is stored, written to a database or logged, and the connection itself lives in your phone’s keychain and nowhere else. The legal basis here is your consent, given on Strava’s own screen, and Disconnect in the app is how you withdraw it, which also removes Adret from your Strava settings rather than leaving it listed there. Strava acts for itself, under its own privacy policy, and only because you asked it to.

The app can read Apple Health on an iPhone, so that a workout your watch already recorded can become a poster without your exporting anything first. It is optional in the plainest sense: nothing else in Adret changes if you never allow it, and every other way of importing still works. When you tap the Apple Health row, iOS asks you on its own screen what to allow; the permission is Apple’s to grant and Apple’s to take back, and Adret is never told which you chose. What it asks for is your workouts and their routes, and nothing else: not your heart rate, not your steps, not your weight, not your sleep, none of which it has any code to read. It never writes anything into Health. What it reads is the list of workouts that could have a route (the activity, the date, the distance and the duration of each) and then, for the one workout you choose, its points, elevations and times. None of that goes anywhere: Health is on your phone and so is Adret, and there is no step here that involves this site at all. The GPX Adret writes from it is your file on your device, and it reaches the server only under the rule set out above, when the phone cannot draw the poster itself, and is discarded there in exactly the same way. The legal basis here is your consent, given on Apple’s own screen. You withdraw it in Settings › Privacy & Security › Health › Adret, which is also the only place it can be seen: because iOS does not tell an app what was allowed, Adret cannot show you the answer and does not try to guess it. A list with nothing in it is what a refusal looks like from in here, and it is also what somebody with no recorded outdoor workouts sees.

Subscribing needs no account. The subscription is attached to the session described above, the identifier with no name on it, and “Restore purchases” in the app brings it back after a reinstall, from the App Store or Google Play account that pays for it. The payment itself happens with Apple or Google, who take the money and hold your payment details; we never see a card number. Between the store and us sits RevenueCat, a company in the United States that turns the store’s receipt into a subscription record. It receives that session identifier (or your account identifier, once you have signed in), the receipt and some information about the phone, but no name and no email address, and it sends us an event at every change (a purchase, a renewal, a cancellation, a refund, a subscription moving from one identifier to another), which we keep as it arrives. Against the same identifier we keep the state of the subscription: whether it is active, until when, and which plan. Signing in is optional, can be done at any time from the account screen, and is what lets you use Adret Pro on another phone. There are three ways in: Sign in with Apple, which gives us an email address, usually Apple’s private relay version of it; Sign in with Google, which gives us the address, the name and the profile picture on your Google account, as Google sends them; and a six-digit code sent to an address you type. The Apple sheet asks for your name as well, because Apple makes that choice part of the sheet; the app never reads it. Signing in replaces the phone’s session with the account’s, and a subscription bought before it moves to the account. What the account holds is that address, the name and picture if you came in through Google, and the state of the subscription. The account screen deletes the account from inside the app, without asking us: it revokes the Apple sign-in, deletes the account and its subscription record, and leaves two things behind. The payment events, with the identifier still inside them, are kept because a refund or a dispute can only be settled with them; and RevenueCat keeps its own record of the purchase, which we will have deleted if you ask. A Google sign-in is not revoked at Google: Adret stays listed among the connections in your Google account until you remove it there. If you subscribed without ever signing in, there is no account to delete in the app: ask for the subscription record to be deleted through the contact page, as “Your rights” below describes. Deleting the account, or that record, does not cancel the subscription: that is done in your phone’s subscription settings, because Apple and Google own it. The legal basis is the contract, and for the payment events our legitimate interest in being able to settle a dispute.

Running a server means knowing whether it is working, and two things are collected for that and for nothing else. The first is counters: how many requests each door answered and with which status, how many callers were turned away and by which limit, and how many distinct sessions used the app today. These are plain numbers. There is no identifier of any kind inside them and no route from one back to a person: the number of people who used the app today is a single integer, not a list of who they were, and it is built from fingerprints computed under a key that is made fresh every time the server restarts and is written down nowhere. The fingerprints are forgotten at midnight UTC or at the next restart, whichever comes first, and never written to disk; the totals, and only the totals, are read off once a minute and kept at Grafana Cloud for fourteen days. The second is request logs, which hold the ordinary technical record of a request. Before they leave the machine, IP addresses are cut down to their network, identifiers are replaced and access tokens are stripped; what still goes through is the map squares described above. The unredacted originals stay on the server, where the applications’ logs overwrite themselves within days and the web server’s access log is discarded after seven days. The redacted logs go to Grafana Cloud, whose servers for this account are in Germany, where they are kept for fourteen days and used to keep the service up and secure. The legal basis is our legitimate interest in a service that works. It is proportionate because none of it builds a profile, none of it is shared with anyone or sold, and none of it touches advertising.

Everything above runs on one server rented from OVH, a French host, including the sign-in system, which is our own installation rather than somebody’s hosted service. Once a night, the databases are copied, encrypted, to OVH’s object storage in Gravelines, France, and the copies are kept on a rolling schedule: the last seven days, the last four weeks and the last six months. So anything deleted, an account or a session, lingers in a backup for up to six months, unread unless the server ever has to be rebuilt from one. On the server itself, the access log is kept for seven days and each application’s own log is a few tens of megabytes that overwrite themselves. At Grafana Cloud, in Germany, the logs and the counters are kept for fourteen days. The visit and usage statistics are kept on the server for as long as the site exists, because once their day is over nothing in them points to a person. A film made with Adret Pro waits on the server for an hour at most, and is gone sooner once your phone has it. A recording or a photo sent through an assistant, and the posters and films drawn from them, wait on the server for an hour at most. In the mailbox, a message you sent is kept for a year after the last exchange. A Strava connection is not on this list at all, because it is not held here: it lives in your phone’s keychain for as long as you leave it connected, and disconnecting or uninstalling ends it. Permission to read Apple Health is not on it either, and for a stronger reason: it is held by iOS rather than by Adret, so there is nothing of it on this server or in the app to keep for any length of time.

Nothing is sold, nothing is shared for advertising, and nothing goes to a data broker. These are the companies that handle some of it on our behalf, and why. OVH, in France, hosts the server, the mailbox and the backups. Grafana Labs, on servers in Germany for this account, receives the redacted logs and the counters. Expo, in the United States, answers the app’s update check and, if you allow notifications, sends the one that says a film is ready, through Apple’s or Google’s notification service. RevenueCat, in the United States, handles the subscription. Apple and Google act for themselves rather than for us: they take the payment and handle the sign-in, under their own privacy policies. Strava is in that same position if you have connected an account: it acts for itself, under its own policy, and only because you asked it to. So is the maker of an assistant you connect to Adret, such as Anthropic for Claude or OpenAI for ChatGPT. For Expo and RevenueCat, which do act on our behalf, the transfer rests on the European Commission’s standard contractual clauses, which their data-processing terms include.

The controller of all of this is the publisher named in the legal notice, and the contact page is how to reach us. Under the GDPR you have the right to access, correct, delete and port your personal data, to restrict or object to its processing, and to lodge a complaint with the CNIL, the French data protection authority. The GDPR applies because the publisher is in France, so these rights are yours wherever you live, and if you live elsewhere you can also turn to your own country’s data protection authority. This website holds nothing to exercise them against except a message you sent us, which we delete on request. In the app it depends on whether you have signed in. Without an account, the identifier is on your phone and nowhere we could read it back from: we cannot tell which session is yours, so there is nothing we could look up, hand over or delete for you, and deleting the app abandons it. The session row stays on our side, naming nobody, until idle sessions are purged, as the app section says. A subscription is the exception, because a purchase can be traced: if you subscribed without signing in, write through the contact page with something that identifies the purchase, such as the order number on the receipt Apple or Google sent you, and we delete the subscription record and have RevenueCat delete its copy; only the payment events stay, for the reason the Pro section gives. With an account, the account screen deletes it from inside the app, as the Pro section describes, and what it leaves behind is deleted on request through the contact page.