Privacy Policy

What we collect

Account data — when you create an account we store your name, username, email address, a securely hashed password, and your language preference. You may optionally upload a profile photo.

Sign-in with Google — if you use Google to sign in, Google shares your name, email address, Google account identifier, and profile picture with us so we can create or match your account. We never receive your Google password.

Content you submit — GPX files you upload and the data we derive from them (the track geometry, start location, distance, elevation and other statistics, and the region), together with trail names and descriptions, ratings, comments, saved trails, and any reports you file.

Usage and technical data — records of the trails you download, and technical information our hosting generates automatically, such as your IP address, browser and device type, and access-log timestamps.

Audience measurement — we count visits using privacy-friendly analytics that set no cookies and store nothing on your device. We see which pages were viewed and which site or search engine sent you, along with general details such as country, browser and device type. No IP address or other identifier that could single you out is stored, and the results are aggregate only. See our Cookie Policy for the detail.

Email — the address you give us is used to send transactional emails (email verification, password reset, and notices about your uploads or reports).

Why we use it, and our legal basis

To provide the service — creating and running your account, showing and letting you download trails, and delivering the transactional emails the service depends on. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).

To keep the site safe and lawful — moderating uploads, handling reports, preventing abuse, and securing the platform. Legal basis: our legitimate interests (GDPR Art. 6(1)(f)) in a safe, working service.

To understand how the site is used — counting visits and seeing which pages and trails riders find useful, so we know what to improve and whether anyone is finding us. The measurement is aggregate and cookieless, and cannot identify you. Legal basis: our legitimate interests (GDPR Art. 6(1)(f)) in understanding and improving the service.

To meet legal obligations — for example responding to lawful requests from authorities. Legal basis: legal obligation (GDPR Art. 6(1)(c)).

Where we ever rely on your consent (GDPR Art. 6(1)(a)) — for anything beyond the above — you can withdraw it at any time.

What is public

trails.bg is a place to share trails, so some data is public by design: your username and profile photo, the trails you publish (their map, stats and description), and your ratings and comments. Your email address, your saved (favourite) trails, and any reports you file are never shown publicly.

A trail you upload stays visible until you delete it or a moderator removes it. Because others may rely on it, we may keep a copy of removed content for our moderation records (see Retention).

Who we share it with

We do not sell your personal data, and we do not share it with third parties for their own marketing or advertising purposes. To run the site we rely on infrastructure providers (processors) — for application hosting, database storage, file storage, transactional email delivery, and audience measurement — each bound by contract to process data only on our instructions and only as needed to provide the service. They do not use your data for their own purposes.

If you choose to sign in with Google, Google processes your sign-in data under its own privacy policy for that step.

We may also disclose data where the law requires it, or to protect our rights and the safety of our users.

International transfers

Some of our providers may process data on servers outside the European Economic Area. Where that happens, the transfer is covered by an appropriate safeguard under the GDPR, such as the European Commission's Standard Contractual Clauses. Contact us at hello@trails.bg for details.

How long we keep it

We keep your account data for as long as your account exists. You can request account deletion at any time by emailing hello@trails.bg; once we action the request, we delete or anonymise your personal data, except where we must keep something to meet a legal obligation or to defend a legal claim.

Content removed by moderation (a trail, a comment) may be kept in a soft-deleted state so we have a record of moderation decisions; it is no longer shown on the site.

Technical and access logs are kept only for a limited period for security and troubleshooting.

Cookies

We use only strictly necessary and functional cookies — to keep you signed in and to remember your language and theme. We do not use advertising or tracking cookies. Our Cookie Policy explains each one; because they are essential, they do not require your consent.

Your rights

Under the GDPR you have the right to access your data, to correct it, to erase it, to restrict or object to our processing, and to receive it in a portable format. Where we rely on consent, you may withdraw it at any time.

You can edit your profile and trails yourself from the site. To delete your account, or to exercise any other right above, email us at hello@trails.bg and we will respond within the time the law allows.

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg) or your local supervisory authority.

Children

trails.bg is not directed at children under 16. If you believe a child has given us personal data, contact us at hello@trails.bg and we will remove it.

Changes and contact

We may update this policy; the date at the top shows the latest version, and we will flag material changes on the site.

Questions or requests: hello@trails.bg.