Privacy

The short version

There is no database, no file storage and no user accounts. Your Garmin data passes through the server while you are using the app and is gone the moment the request ends. The only lasting copy of anything is the zip of your original recordings that you download to your own machine.

Your Garmin credentials

Your email and password are sent to Garmin's sign-in service to obtain session tokens. They are never written to disk or logged. The resulting tokens are encrypted and placed in a cookie that only the server can read.

That cookie has no expiry date set, which makes it a browser-session cookie: closing your browser signs you out. It also expires on its own after 12 hours.

Your activity data

To build a preview and to merge, the server downloads the original FIT files from Garmin, decodes them in memory, and returns chart data to your browser. Nothing is written to disk. When the request finishes, the files are discarded.

When you approve a merge, the server deletes the original activities from your Garmin account and uploads the merged file. That is the only change ever made to your Garmin account.

Third parties

• Garmin Connect— where your activities live. Governed by Garmin's own privacy policy.
• Vercel — hosting. Request logs (timestamps, status codes, error messages) are retained by Vercel. They contain activity IDs, never credentials or activity content.
• Vercel Analytics — anonymous page view counts. No cookies, no cross-site tracking.
• OpenStreetMap / CARTO — map tiles for the route preview. Your browser requests tiles for the area your activity covers, so those services see your IP address and the map area.

Deleting your data

Sign out, or close your browser. That is the whole procedure — there is nothing on our side left to delete.