Privacy Policy

Draft: pending legal review before production use.

This policy is issued by SmartGPX and is governed by French law (see the "Governing law" section of the Terms of Service).

What we collect

Account. When you sign up: your email address and a password (stored as a hash, never in plain text). We also keep your preferred language and the date your account was created.

Google Maps → GPX conversions. Every successful conversion stores the original Google Maps link, the origin, destination, any intermediate stops, the full route geometry (coordinates), travel mode, distance, and duration. The GPX file itself is not stored. It's regenerated on demand from this data. Failed conversions are not associated with a file or a track.

Chrome extension. If you connect the extension, we keep an authorization token (in hashed form), a device label derived from your browser, and the last time it was used. This token grants the extension the same access as your web session (creating and downloading conversions).

Payments. Credit purchases go entirely through Stripe Checkout. Your card number never reaches our servers. We only keep a record of the purchase itself (amount, currency, credits granted, status).

Contact form. If you write to us via /contact, we receive the name, email, and message you submitted.

Why we collect it

To provide the service (creating your account, running conversions, managing your credits), process payments, send account-related emails (email verification, password reset, purchase confirmations), respond to your messages, and prevent abuse (rate limiting).

Who we share it with

• Google Routes API: to compute a route, we send the origin, destination, stops, and travel mode to Google's Routes API, since this is required to generate your GPX file. This is subject to Google's own privacy policy.
• Stripe: processes payments and receives your email and payment details directly. See Stripe's privacy policy.
• Google Fonts: our pages load fonts directly from Google's servers, which receive your IP address as part of that request.
• Email delivery: transactional emails (verification, password reset, purchase receipts, contact-form responses) are sent through our email delivery provider.

We do not sell your data.

Analytics

We use Google Tag Manager and Google Analytics 4 to understand how the site is used (pages viewed, checkout starts and confirmed credit purchases). These tools only load after your explicit consent via the banner shown at the bottom of the page: until you click "Accept," nothing is ever sent to Google, and declining (or ignoring the banner) means they never load at all. The purchase events we send contain only aggregate commercial information (amount, currency, number of credits), never your email, your name, or any payment details (card number, billing address). See Google's privacy policy.

Cookies and local storage

• A session cookie, strictly necessary to keep you signed in.
• Your browser's local storage remembers your light/dark theme choice. This never leaves your device.
• Your browser's local storage also remembers your analytics cookie choice (accepted or declined). If you accept, Google Tag Manager may then set its own cookies: see "Analytics" above.

Data retention

We do not currently run automatic deletion schedules for account or conversion-history data. Deletion can be requested manually, see "Your rights" below.

Your rights

You can request access to, correction of, or deletion of your data by writing to [email protected]. The Chrome extension's access to your account can be revoked at any time from your Extensions page, with no need to contact us.

Children

SmartGPX is not directed at anyone under 16, and we do not knowingly collect data about them.

Changes to this policy

We may update this policy from time to time; any material change will be reflected by a new "last updated" date at the top of this page.

Contact us

For any question about this policy, write to [email protected] or use the contact form.