Privacy Policy

Effective Date: February 15, 2026 • Last Updated & OWASP Disclosure Verified: March 2026

Architectural Claim: Client-Side Isolation

In accordance with OWASP transparency recommendations regarding sensitive information, logging, storage, and disclosure, we make a clear technical distinction between two very different claims:

The Common Claim (Not Ours)

“We don't intentionally store your data”

This claim means data is sent across the internet to backend servers, but the company promises not to save it. If logs or servers are compromised, in-transit data can still be exposed.

The TrailShorts Guarantee

“Your data technically never reaches our servers”

For video generation and stats images, your GPX coordinates, heart rate, elevation, and MP4 videos are processed 100% inside your browser's WebAssembly & WebGL engine. Zero activity data is sent to our servers.

12 Key Privacy Questions Answered

Explicit answers regarding sensitive data collection, logging, retention, and third-party disclosure.

1. Do you collect GPS coordinates?

Technically Never Reaches Our Servers (Studio & Videos)

For standard video creation and stats rendering, GPS coordinates never leave your browser runtime.

Standard Studio & Video Generation: All GPX route parsing, elevation calculations, track smoothing, and 3D WebGL flyovers occur entirely in your local browser's JavaScript / WebAssembly engine. Zero coordinate packets are transmitted to TrailShorts backend servers.

Optional 3D Embed Tool: Only if you voluntarily choose to upload a GPX file for public 3D web embedding (rather than supplying a self-hosted GPX link/URL), that file is stored on our cloud storage to stream route data to viewers of your embed.

2. Do you collect Strava activity IDs?

Technically Never Reaches Our Servers

Strava activity IDs, athlete IDs, and session tokens remain strictly inside your local browser context.

When using the TrailShorts Chrome Extension or importing directly from Strava, activity identifiers and access tokens are held exclusively in browser memory and local storage to fetch your streams.

We do not run an intermediate Strava sync backend, proxy server, or database that logs or harvests your Strava activity IDs.

3. Do you collect heart-rate data?

Technically Never Reaches Our Servers

Biometric and sensor streams (heart rate, cadence, power, temperature) are processed strictly in browser memory.

Any biometric telemetry present in your GPX/FIT files is parsed locally to calculate telemetry HUD overlays on your videos and stats cards.

This sensitive health data is never uploaded, logged, inspected, or transmitted to any remote TrailShorts server or third party.

4. Do you collect names or usernames?

No Collection on Servers

No accounts, logins, or name databases exist for standard use.

TrailShorts does not require user accounts, email registration, or usernames to build flyover videos, generate stats images, or create embeds.

If an activity name or athlete name is embedded in your GPX metadata or Strava activity title, it is rendered on-screen by your local browser and is not cataloged in any server-side database. If you email our support team directly, we receive your email and display name solely to reply to your inquiry.

5. Do you collect IP addresses?

Infrastructure Routing Only (No Application Logging)

Application does not log IP addresses. Standard CDN edge proxies (Cloudflare) receive IP addresses during network routing.

Application Level: TrailShorts code does not collect, record, or link your IP address to your activities, routes, or files.

Infrastructure Level: In accordance with standard internet protocols, our CDN edge provider (Cloudflare) receives IP addresses ephemerally during TCP/HTTP requests to provide SSL termination, DDoS protection, and rate limiting.

6. Do you use Google Analytics?

Yes (Anonymized Aggregate Telemetry Only)

Yes, we use Google Analytics 4 (GA4) with IP masking for aggregate web traffic metrics.

GA4 collects aggregate telemetry such as page views, referrer URLs, screen resolutions, and general geographic region (country/city level).

Strict Boundary: No GPS coordinates, route names, heart rate stats, athlete names, or activity files are ever shared with or sent to Google Analytics.

7. Do you use Sentry or another crash reporter?

No (Errors Remain in Browser Console)

No. We do not use Sentry, Bugsnag, Datadog, or external client crash reporters.

We do not bundle or run third-party error-tracking SDKs that transmit stack traces, local state, or console payloads over the network.

Client-side JavaScript exceptions and WebGL warnings remain purely within your local browser developer console.

8. Do you use Cloudflare logs?

Standard CDN Edge Proxy Logs Only

Yes, standard CDN proxy access logs exist at the network boundary for security & DDoS defense.

As our reverse proxy and security perimeter, Cloudflare processes inbound HTTP requests. Cloudflare logs standard edge metadata (timestamp, HTTP status code, requested URL path, client user-agent, edge datacenter location, and connecting IP).

These logs are managed under Cloudflare's standard security retention windows and are used solely for infrastructure diagnostics, traffic anomaly detection, and abuse mitigation.

9. Do you store generated videos?

Technically Never Reaches Our Servers

No. Video files are rendered locally via Canvas/MediaRecorder and downloaded directly to your disk.

When you click “Export Video” or “Download MP4/WebM”, your browser captures the WebGL canvas frame-by-frame, encodes the video stream on your local CPU/GPU, and saves the file directly to your downloads folder.

The generated video file is never uploaded to, processed on, or cached on TrailShorts servers.

10. How long is data retained?

Strict Retention Boundaries

Local data is controlled by your browser; server CDN logs and embed files follow strict boundaries.

  • Local Browser Data (IndexedDB / LocalStorage): Stored locally until you clear your browser data or click “Delete Activity” in the app.
  • Local Studio RAM: Discarded immediately when you close or reload the browser tab.
  • Cloudflare Edge Logs: Ephemeral, purged per standard CDN retention cycles (typically 3 to 30 days).
  • Google Analytics Metrics: Retained in aggregate form per GA4 configuration (up to 14 months).
  • Optional Embed GPX Files: Retained in storage until deletion is requested by the publisher.

11. Do third parties receive anything?

Direct Service Providers Only

Only essential infrastructure providers (Mapbox for 3D tiles, Google Analytics for traffic metrics, Cloudflare for CDN).

  • Mapbox GL JS: Your browser requests satellite imagery and terrain elevation tiles directly from Mapbox to render the 3D map.
  • Cloudflare: Proxies HTTP assets and delivers web pages.
  • Google Analytics: Receives anonymized aggregate usage statistics.
  • Zero Ad Brokers / Data Resellers: We never sell, rent, or trade your activity data to third-party data brokers or marketing networks.

12. How can a user request deletion?

Instant Self-Serve + Direct Email

Delete local data instantly via browser cache or app UI; request embed GPX deletion via email.

Local Browser Storage: You can purge all saved activities, preferences, and cached tracks instantly by clicking “Clear All Activities” inside the app, or by clearing your browser's site data for trailshorts.xyz.

Server-Stored Embed GPX Files: If you uploaded a GPX file for 3D embed hosting and want it permanently deleted from our server storage, send an email to privacy@trailshorts.xyz with your embed URL or file reference. Requests are processed within 3 business days.

1. Executive Summary & Privacy Principles

Welcome to Trail Shorts (“we”, “our”, or “us”). We believe your athletic, biometric, and geographic data belongs to you. Our platform operates on a privacy-first, client-side execution model.

Core Operating Principles:
  • We do not sell, rent, or monetize your personal data.
  • GPX tracks, heart-rate streams, cadence, and power metrics are parsed and rendered locally in your browser.
  • Standard generator rendering requires zero server uploads. For 3D flyover embedding, server storage is 100% optional and we encourage providing a link (URL) to your GPX rather than uploading the file itself.
  • Saved activities reside strictly in your browser's local IndexedDB cache.
  • Local ad suggestions are evaluated ephemerally in your browser and are never sent to or stored on our servers.

2. Information Processing & Data Lifecycles

2.1 GPX Files & Activity Telemetry

When you load a .gpx, .fit, or .tcx file, the file is read and parsed directly by your device's JavaScript / WebAssembly engine. Route coordinates, elevation, timestamps, heart rate, and cadence streams remain entirely inside your local browser memory.

Local Location Ad Suggestions: We may evaluate the latitude and longitude coordinates of your processed GPX tracks locally within your browser to suggest relevant advertisements (such as outdoor stores, bike repair shops, or cafes located near your route). We do not upload, track, or store your GPX coordinates on our servers for advertising or any other purpose. All matching happens ephemerally in your browser.

2.2 Web Analytics & Aggregated Metrics

We use Google Analytics (GA4) to measure site traffic, device screen resolutions, browser versions, and feature usage. This helps us ensure compatibility across all devices and optimize 3D map rendering performance. GA4 operates with IP anonymization enabled. No GPS tracks, health streams, or personal activity files are ever transmitted to Google Analytics.

2.3 Local Storage & Cookies

We use browser storage (LocalStorage, SessionStorage, IndexedDB) to save your custom themes, aspect ratio settings, and offline activity list. See our dedicated Cookie Policy for detailed specifics.

2.4 TrailShorts Chrome Extension Privacy & Data Disclosure

The TrailShorts Chrome Extension operates strictly within your local browser context. When you click to export or visualize an activity:

  • The extension fetches the activity's route coordinate data directly into memory via your active Strava session.
  • The coordinate data is passed directly to the local TrailShorts web app tab using secure browser storage.
  • The extension does not collect, log, transmit, sell, or store your Strava credentials, personal profile details, or activity data on any remote servers.
  • No third-party trackers, analytics, or remote scripts are executed by the extension.

2.5 3D Flyover Embedding & Optional GPX Storage

To display interactive 3D flyovers on external websites or mobile applications, we collect and store the GPX file on our server so it can be streamed to visitors loading your embedded map.

100% Optional — Self-Hosted Links Encouraged: Uploading the GPX file to our server is 100% optional. If you have the ability to host the GPX file yourself (e.g., on your own website, Cloudflare R2, AWS S3, or GitHub), we actively encourage you to provide us with the direct link (URL) to your GPX file rather than the file itself.

No Secondary Usage: If you choose to upload your GPX file to our server for embed generation, we do not plan to, nor will we ever, inspect, analyze, monetize, or use that data for any other purpose.

3. Third-Party Integrations & Network Handshakes

To provide high-definition 3D terrain and map rendering, the Service connects with:

  • Mapbox GL JS: Streams satellite imagery, street map tiles, and terrain elevation DEMs directly to your WebGL canvas. Governed by Mapbox Privacy Policy.
  • Cloudflare: Provides global CDN caching, SSL termination, and DDoS mitigation. Edge proxy access logs are retained strictly for infrastructure security.
  • Google Analytics (GA4): Processes aggregated usage statistics with IP masking enabled.

4. California Privacy Rights (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to:

  • Know what personal information is collected and whether it is sold or shared (TrailShorts does not sell or share user data).
  • Opt-out of the sale or sharing of personal information.
  • Request the deletion of their personal information.
  • Non-discrimination for exercising their statutory privacy rights.

5. European Privacy Rights (GDPR)

If you are an EU or UK resident, you enjoy comprehensive data rights including the Right to Access, Rectification, Erasure, Data Portability, and Objection. Because standard activity data technically never reaches our servers, you retain full unilateral control over your data directly on your local device. Please consult our complete GDPR Statement for details on how to exercise these rights.

6. Data Security & Storage Architecture

We enforce strict transport layer security (HTTPS with TLS 1.3) across all endpoints. Because activity files, GPS tracks, heart rates, and generated videos are processed client-side and not sent to our servers, there is no centralized database of user activity tracks that could be compromised or subjected to data breaches.

7. Data Deletion Requests

Users have multiple ways to purge data:

Local Activities (Self-Serve)

Clear your browser's IndexedDB cache or click “Delete Activity” in the app interface. Purging occurs instantly on your physical device.

Embed GPX Files (Server)

Email privacy@trailshorts.xyz with your embed link. We will permanently delete the server-hosted GPX file within 3 business days.

8. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect new features, infrastructure changes, or legal requirements. When updates are published, the revised policy will be posted on this page with an updated “Effective Date”.

9. Contact Us

If you have any questions, concerns, or deletion requests regarding our Privacy Policy or OWASP transparency disclosures, please contact our Privacy Team:

Privacy Team: privacy@trailshorts.xyz
Website: https://trailshorts.xyz