Privacy Policy

Last updated: September 7, 2026

This policy explains what Peaksur collects, why, and the choices you have. The short version: we collect what the app needs to work, we don't sell your data, and we don't track you across other apps or websites.

The Service is operated by Peaksur LLC, a California limited liability company, which is the data controller for the information described below. You can reach us at [email protected] or by post at 3400 Cottage Way, Ste G2 #36472, Sacramento, CA 95825-1474.

Washington and Nevada residents: our Consumer Health Data Privacy Policy is section 3 below.

1. What we collect

• Account info — name, username, email or phone number, and profile details you add.
• Location & activity data — GPS tracks, distance, elevation, and duration when you record an activity. Recordings are private by default; you choose what to share. Location is used in the background only during an active recording, so your track keeps recording with the screen off or another app open; background use stops the moment you end the recording.
• Photos & videos — only the ones you pick to attach to activities, posts, or films.
• Health data (optional) — with your permission, heart rate, calories, steps, and workout data during recordings, plus your weight from Apple Health for calorie estimates. Health data is never used for advertising and never sold. See section 3 for the full details, including how to delete it.
• Contacts (optional) — if you use friend discovery, phone numbers are hashed on your device before being matched; your address book is never uploaded.
• Content & messages — posts, comments, and the messages you send. Messages are encrypted in transit and at rest, but they are not end-to-end encrypted: our servers read a message only to build its push notification preview, and a person at Peaksur only sees a message if someone reports it to us.
• Subscriptions — Peaksur Premium is billed by Apple (in the app) or by Stripe through its Link service, the merchant of record (on peaksur.com). They process your payment and we never see your card details; we store your subscription record — its status (active, trialing, canceled and so on), the plan and its price, when it renews or ends, where it was bought and whether a free trial has been used — to unlock Premium features, plus the Stripe customer and subscription identifiers needed to manage a web subscription.
• Device & push tokens — if you turn on notifications, a Firebase Cloud Messaging (FCM) token that identifies your device is stored on your account so we can deliver them. Turning notifications off in the app deletes the token; signing out removes it from that account.

2. How we use it

• To provide the Service: tracking, maps, 3D flyovers, feeds, and messaging.
• To keep the community safe: handling reports, blocks, and abuse prevention.
• To operate and improve the app (crash reports, aggregate usage).
• To send you transactional email you've asked for or need (sign-in links, account and security notices).

We do not sell personal data, show third-party ads, or track you across other companies' apps and websites.

3. Health data — Consumer Health Data Privacy Policy

This section is Peaksur's consumer health data privacy policy for the purposes of the Washington My Health My Data Act, Nevada SB 370, and similar laws. It applies to the health data described here no matter where you live.

What we collect. With your permission, during an active recording Peaksur collects your heart rate, active calories, step count, and workout data (activity type, distance, elevation, pace, and duration) — together, "Health Data". Sources: Apple Health and a paired Apple Watch through HealthKit, your phone's motion sensors, and the GPS track of the recording. We also read your weight from Apple Health, on your device only, to estimate calories; it is not uploaded.

Why. To show your stats during and after a recording, to store them with that activity so you can look back at it, to estimate calories, and — if you've enabled it — to save the workout back to Apple Health. We do not use Health Data for advertising, we do not sell it, and we do not use it to build profiles for any other purpose.

Your consent. We only collect Health Data after you grant permission in the iOS Health prompt, and we ask separately before sharing it with anyone. You can withdraw permission at any time in iPhone Settings → Privacy & Security → Health → Peaksur (or in the Health app under Sharing → Apps). Withdrawing stops new collection; Health Data already saved with your activities stays until you delete those activities or your account. We will not collect, use, or share Health Data beyond what this section describes without asking you first. We do not use geofencing around health care facilities.

Where it's stored. Health Data is stored with the activity it belongs to on our servers, hosted by Google Firebase in the United States, and in the app on your device. Your Apple Health store itself stays on your device under Apple's control.

Who can see it. Nobody, by default — activities are private until you share them. If you choose to share an activity, post, or film that includes Health Data (for example the heart-rate or calorie stats on an activity card), the people you share it with can see those stats. Our service providers in section 4 process Health Data only to run the Service for us (Google Firebase stores it). We do not share Health Data with any other third party or affiliate.

Your rights and how to delete. You can access, download, correct, and delete your Health Data at any time. In the app: open an activity and delete it to remove its Health Data, or delete your account (Profile → Settings → Delete Account) to remove all of it. You can also email [email protected] to exercise any of these rights or to withdraw consent; we'll verify the request using your account email and respond within 30 days. If we decline a request, we'll tell you why, and you can appeal by replying to that email — we'll answer your appeal in writing. We never discriminate against you for exercising your rights.

Retention. We keep Health Data only as long as the activity it belongs to exists and your account is active. Deleting an activity removes its Health Data; deleting your account removes all of it. Backups clear on a rolling basis within 30 days.

4. Who processes data on our behalf

We use service providers to run Peaksur; they process data only to provide their service to us:

• Google Firebase — authentication, database, storage, and push notifications.
• Supabase — application infrastructure.
• Mapbox — map rendering (map tile requests include approximate location by nature).
• Apple — Weather (WeatherKit), Apple Music previews, Apple Health (on-device), Sign in with Apple, and App Store billing.
• Stripe and Link — peaksur.com billing: your name, email, billing address and payment details go directly to Stripe, and Link, as the merchant of record, sends your receipts and handles refunds and disputes. Card details never reach us. You can ask Link to delete your data at link.com; doing so cancels any peaksur.com subscription.
• Resend — transactional email (sign-in links, account and security notices): your email address and the message content.
• OpenWeatherMap — weather map overlays: tile requests include your IP address and the coordinates of the map tiles you're viewing.
• Jamendo — music search in the film editor: the search terms you type (not linked to your account).
• Wikimedia (Wikipedia, Wikimedia Commons, Wikidata) — the place descriptions and licensed photos shown on trail and point pages: requests include your IP address and the name or coordinates of the place being looked up.
• Overpass API — OpenStreetMap trail and point lookups: requests include your IP address and the coordinates of the area you are viewing.
• U.S. National Park Service and Recreation.gov (RIDB) — official park, campground and alert information: requests include your IP address and the park or campground being looked up.
• Mixkit and Unsplash — stock imagery and audio used in the film editor: requests include your IP address.

5. What we store on your device

Peaksur does not use cookies. The website stores a small amount of information in your browser's local storage, and all of it is needed for features you asked for — none of it is advertising, and none of it tracks you between sites:

• whether you are signed in, and enough of your profile to draw the page before your account loads;
• your map preferences — the map style, the 3D view and the night-sky layer;
• a draft of a route you are building, so closing the tab does not lose it;
• a referral code you arrived with, until your account is created;
• a count of the free features you have used, which is what the Premium limits are measured against.

Signing in also lets Firebase store your session in the browser so you are not asked to sign in on every page. You can clear all of it at any time by clearing site data for peaksur.com in your browser; you will simply be signed out and your preferences reset. The iPhone app stores the same kinds of preferences on your device rather than in a browser.

6. Sharing you control

Content you post publicly is visible to other users. Activities you keep private stay private. You can change a post's audience or delete it at any time.

7. International transfers

Peaksur is based in the United States and your data is processed and stored there by the providers above. If you use Peaksur from outside the US, your information is transferred to the United States, where privacy laws may differ from those in your country. Where required (including for users in the EEA, UK, and Switzerland), those transfers are protected by standard contractual clauses or equivalent safeguards with our providers.

8. Data retention & deletion

We keep your data while your account is active. Deleting your account (Profile → Settings → Delete Account) permanently removes your account, activities, posts, and media from our systems, and revokes your Sign in with Apple token. Backups clear on a rolling basis within 30 days.

9. Your rights

Depending on where you live (including GDPR and CCPA rights), you can request access to, a copy of, correction of, or deletion of your personal data. Email [email protected] and we'll respond within 30 days. We don't discriminate for exercising your rights.

10. Children

Peaksur is not directed to children under 13, and we don't knowingly collect data from them. If you believe a child is using the Service, contact us and we'll remove the account.

11. Security

Data is encrypted in transit (HTTPS) and stored with access controls on infrastructure provided by Google and Supabase. No system is perfectly secure, but we design for least access — for example, contact matching is hashed on-device and 3D flyover rendering happens on your phone, not our servers.

12. Changes

If we make material changes to this policy, we'll notify you in the app or by email before they take effect.

13. Contact

Privacy questions or requests: [email protected]
General support: [email protected]