Privacy Policy — ActivitySafe

Last updated: 3 July 2026

This Privacy Policy explains how ActivitySafe (“the App”, “we”, “us”) collects, uses, and protects your information. ActivitySafe is operated by Kaloyan Todorov Peychev, an individual sole developer based in Bulgaria, acting as the data controller under the EU General Data Protection Regulation (GDPR).

Contact: privacy@activitysafe.app

ActivitySafe is a real-time activity location-sharing and safety app for cycling, hiking, and other outdoor activities. It tracks your live location during a session so it can show your safety status and optionally let people you invite watch your activity live. In its cycling safety mode (“CyclistGuard”), it can also broadcast active rides to public-safety map feeds (such as Waze and Google Maps) to make you more visible to nearby drivers.

1. The data we collect

a) Account data (identity).

• Email address — you provide this to sign in via a passwordless magic link.
• User identifier — a Firebase Authentication user ID (UID) generated when you create your account.

b) Location data (precise geolocation).

• The App collects your precise GPS location only while you have an active tracking session that you started. During a session, location is collected continuously — including while your screen is off or your phone is locked — via a foreground service that shows a persistent notification (on Android) or the equivalent iOS location session with the system location indicator visible. This powers your live safety status, group live-view, and public-safety broadcasts.
• We do not collect your location silently, when no session is active, or after you close the App. Ending the session — or closing/force-stopping the App — stops location collection.

c) Technical/service data.

• Minimal operational data needed to run the service (e.g. app version, anonymized log events). We do not use third-party advertising or tracking SDKs.

We do not collect payment card details (handled by the app stores if/when paid features launch), contacts, photos, or microphone data.

2. The Telemetry Firewall — how your location is kept separate from your identity

ActivitySafe is built around a strict privacy principle we call the Telemetry Firewall:

• Your account identity (email, user ID) and your live location stream are handled as two isolated planes.
• While a ride is active, your location points are tied only to an ephemeral, rotating session token (“rotated ID”), never to your email, your real name, or your raw device identifier.
• People who watch your ride (group viewers) and our public-facing systems only ever see coordinates keyed to that rotating token — not to you personally.

3. Data ephemerality — location is deleted when your ride ends

Location data is highly transient:

• Live location points are processed in fast, in-memory structures during your ride.
• When a tracking session terminates (you stop the ride, or it ends), the raw location points for that session are permanently deleted.
• We do not build long-term location histories or movement profiles from your raw coordinates.

4. Why we process your data, and our legal basis (GDPR Art. 6)

You can withdraw location consent at any time by stopping the ride and/or revoking the location permission in your device settings. The App will simply stop tracking.

5. Who we share data with

We do not sell your personal data and do not share it with advertising or data-broker networks. We use a small number of processors and feeds strictly to run the service:

• Google Firebase (Authentication) — manages your sign-in and account identity.
• Public-safety map feeds (e.g. Waze, Google Maps) — when you have an active ride with broadcasting enabled, anonymized ride coordinates (tied to the rotating token, not to you) may be sent so drivers near you are alerted to your presence.
• Our infrastructure provider — the backend runs on a private, self-hosted server (Hetzner Cloud, EU). Location streams stay within this controlled environment for their brief, ephemeral lifetime.

Some processors (e.g. Google) may process data outside the EU/EEA. Where that happens, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep data

• Raw location points: deleted immediately when the ride session ends (see §3).
• Account data (email, User ID): kept while your account exists, and deleted when you delete your account.
• Anonymized, non-identifying ride aggregates (if any) contain no raw coordinates and cannot be tied back to you.

7. Your rights (GDPR)

You have the right to: access your data; correct it; erase it (“right to be forgotten”); restrict or object to processing; data portability; and to withdraw consent at any time.

• Delete your account and data yourself, in-app: open the App → Profile → Delete Account. This permanently erases your account and associated records.
• Or email privacy@activitysafe.app and we will action your request.

If you believe we have mishandled your data, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP / КЗЛД, https://www.cpdp.bg), or your local EU data protection authority.

8. Security

All communication between the App and our servers is encrypted in transit using industry-standard HTTPS and secure WebSockets (WSS). Account access is protected by Firebase Authentication. Live location is additionally protected by the Telemetry Firewall and its ephemeral lifecycle (§2–§3).

9. Children

The App is intended for users aged 13 and older. Users between 13 and the age of majority in their country may use the App only with the consent and supervision of a parent or legal guardian.

We do not knowingly allow children under 13 to create their own accounts, and we do not knowingly collect personal data directly from them. A parent or legal guardian may create and manage an account and use the App to track a child under their direct supervision; in that case the parent or guardian is the account holder and data controller contact for that account.

If you believe a child under 13 has created an account without parental consent, contact privacy@activitysafe.app and we will delete the account and associated data.

10. Changes to this policy

We may update this policy as the App evolves. Material changes will be reflected by an updated “Last updated” date at the top of this page.

11. Contact

Questions or requests: privacy@activitysafe.app
Controller: Kaloyan Todorov Peychev, Bulgaria.