Last updated: 18 October 2026
This Privacy Policy explains how ActivitySafe (“the App”, “we”, “us”) collects, uses, and protects your information. ActivitySafe is operated by Kaloyan Todorov Peychev (“we”, “us”), a natural person, an individual sole IT developer, citizen of Bulgaria, address: Maystor Pavel ot Krimin 3 str, 1618, Sofia, Bulgaria, acting as the data controller under the EU General Data Protection Regulation (GDPR).
Contact: privacy@activitysafe.app
ActivitySafe is a real-time activity location-sharing and safety smartphone app for cycling, hiking, running and other outdoor activities. It tracks your live location during a session so it can show your safety status and optionally let people you invite watch your activity live.
1.1.1 Email address — you provide this to sign in via a password-less magic link.
1.1.2 User identifier — a Firebase Authentication user ID (UID) generated when you create your account.
Only the minimum amount of operational data needed to run the service (e.g. app version, anonymized log events) is collected and processed. We do not use third-party advertising or tracking SDKs.
We do not collect payment card details (handled by the app stores if/when paid features launch), contacts, photos, or microphone data.
ActivitySafe is built around a strict privacy principle we call the Telemetry Firewall:
Location data is highly transient:
| Data | Purpose | Legal basis | Data Retention Period |
|---|---|---|---|
| Email, User ID | To create, manage, provide access to the App service and secure your account; sign you in. | Performance of a contract (Art. 6(1)(b) of GDPR) | Until account deletion |
| Email, User ID | We use only the email addresses provided at account registration to improve the App. To generate performance statistics and optimize our service, we share this data with the following third-party processor: Firebase. | Art. 6(1)(f) of GDPR | Until account deletion |
| Precise Location (“rotated ID”) | Provide live ride tracking, group live-view - your main App subscription service. | Your consent (Art. 6(1)(a)), given via the OS location permission and by starting a session/ride; You can withdraw location consent at any time by stopping the ride and/or revoking the location permission in your device settings. The App will simply stop tracking. Performance of a contract (Art. 6(1)(b)) | Immediately when the session/ride ends (see § 3 above) |
| Operational Logs | Keep the service secure and reliable. | Performance of a contract (Art. 6(1)(b)) | 30 days |
| Support Request Data | To properly answer your request, we process the details you provide in your message – such as your email address, the details of your request, and your name (optional). | Performance of a contract (Art. 6(1)(b)) | Stored within three years. |
| Data Collected Through Third-Party Services | When logging in via a third-party account, we access only your email address for the purpose of setting up your account. | Performance of a contract (Art. 6(1)(b)) | Until account deletion |
Your personal data will be automatically deleted or permanently anonymized three years after your last account activity.
We may keep your data longer if necessary to comply with legal and regulatory requirements or to fulfill legitimate business interests, such as tax and accounting obligations, dispute resolution, enforcing our agreement enforcement, or security maintenance.
We do not sell your personal data and do not share it with advertising or data-broker networks.
We use a small number of data processors and feeds strictly to run the service:
Our infrastructure provider — the backend, runs on a private, self-hosted server (Hetzner Cloud, EU). Location streams stay within this controlled environment for their brief, ephemeral lifetime. While we use the services of the internet map provider (Open Street Maps) to display your location and enable the App's core functionality, this does not involve any data sharing with Open Street Maps.
Certain third-party partners may process your data outside the EU. Your information remains protected under the appropriate safeguards, including the EU-U.S. Data Privacy Framework, EU Standard Contractual Clauses (SCCs), and Data Processing Addendums (DPAs).
You have the following rights under GDPR:
Delete your account and data yourself, in-app: open the App → Profile → Delete Account. This permanently erases your account and associated records.
Or email privacy@activitysafe.app and we will action your request within 30 days, as required under the GDPR, unless an extension is necessary due to the complexity of the request or a high volume of requests.
If you believe we have mishandled your data, you may lodge a complaint with your local EU data protection authority or the Bulgarian Commission for Personal Data Protection (CPDP / КЗЛД, Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, E-mail: kzld@cpdp.bg, web-site: https://www.cpdp.bg).
We apply consistent technical and organizational measures to protect the App, secure data and guarantee legitimate use.
All communication between the App and our servers is encrypted in transit using industry-standard HTTPS with TLS/SSL encryption, reinforced by transport-layer encryption, and secure WebSockets (WSS). Account access is protected by Firebase Authentication. Live location is additionally protected by the Telemetry Firewall and its ephemeral lifecycle (§2-§3).
We protect our backend infrastructure with multiple layers of security. To ensure secure authentication, access is granted using a unique token derived from your personal data while firewalls and updates provide continuous data protection.
By standard configuration, your App usage data is not accessed by us, unless you decide to send it to us for resolving technical or other issues.
We limit local device storage to what is strictly necessary for the App to function. Uninstalling the App deletes all of this data from your device, except for Android devices, where some data stored on external memory may remain.
The screens in the App rendering as web pages belong entirely to us and are not third-party sites.
If there is ever a security breach, we will step in immediately to fix the issue and protect your information. We will timely let you know if your personal data is at risk, and we will notify data protection authorities within 72 hours of finding out about the incident.
The App is intended for users aged 16 years and older.
We do not knowingly allow users below the age of 16 years to create their own accounts, and we do not knowingly collect personal data directly from them.
A parent or legal guardian may create and manage an account and use the App to track his/her child under their direct supervision (for example, a parent following a child's ride). In that case the parent or guardian is the account holder and data controller contact for that account, who consents to the App’s Privacy Policy and contractual terms (Terms of Service) on behalf of the user below the age of 16 years, and is responsible for all activity under that account.
If you believe a user below the age of 16 years has created an account without parental consent, contact privacy@activitysafe.app and we will delete the account and associated data.
We may update this policy from time to time. Material changes will be reflected by an updated “Last updated” date at the top of this page.
Questions or requests: privacy@activitysafe.app