Privacy Policy

Data controller

Topok processes the data required to operate its website and mobile application. For any question or request concerning your data, please use our contact form.

Data we process

• Account data: email address, display name, user identifier, and communication preferences.
• Saved content: treks, plans, routes, and associated offline maps.
• Activities: precise GPS location, timestamps, distance, duration, elevation, and the recorded track when you voluntarily start an activity.
• Product usage: screens viewed, search criteria, treks displayed or opened, feature interactions, session frequency and duration, device platform, app version, and subscription events. Precise GPS coordinates, names, and email addresses are not sent to product analytics.
• Technical data required for security, diagnostics, and reliable operation of the service.

How we use your data

We use this data to authenticate your account, synchronize your choices, provide route planning and GPS navigation, save your activities, secure the service, and respond to your requests. Background location is used only while a GPS activity recording is active. Processing required to provide these features is based on performance of the service requested by you. Security, diagnostics, and measurement of aggregate product usage are based on Topok's legitimate interest in operating and improving the service.

Product analytics

Topok uses PostHog Cloud EU to understand how the application is used and improve its features. Events may include app lifecycle and screen views; onboarding, authentication, paywall and subscription actions; treks displayed, opened or saved; planning and activity-recording actions; and search parameters such as requested duration, period, destination area, landscape preferences, physical level, isolation, and transport preference.

PostHog assigns a persistent random technical identifier to an installation. If you sign in, Topok associates subsequent analytics events with your internal Topok user ID so usage can be understood across sessions and devices. We do not send your name, email address, free-form support messages, or precise GPS coordinates to PostHog. Touch autocapture and session replay are disabled. Analytics data is not used for targeted advertising, is not combined by Topok with data from other companies for advertising measurement, and is not sold to data brokers.

Service providers

Topok relies in particular on Supabase for authentication and data storage, Vercel for hosting, Mapbox for maps, Open-Meteo for weather forecasts, RevenueCat for subscription status, Stripe for web payments, Sentry for technical error diagnostics, PostHog Cloud EU for product usage analytics, Crisp for support chat, and Apple or Google when you choose their sign-in service. Crisp receives the messages you send and, when you are signed in, your email address and display name so that the conversation can be followed up. PostHog receives a persistent technical identifier and the product interactions described above; Topok does not enable session replay and does not send precise GPS coordinates, names, or email addresses to PostHog. These providers process only the data required for their function, under their own data-protection commitments. Topok does not sell your personal data and does not use these services to track your activity across apps or websites owned by other companies.

Retention and security

Account-related data is retained while your account remains active or for as long as required by law. Downloaded maps and some activities awaiting synchronization remain on your device. We apply appropriate technical and organizational safeguards, although no system can guarantee absolute security.

Your rights and analytics choices

Under the GDPR, you may request access, correction, deletion, restriction, or portability of your data, or object to processing based on legitimate interests, including product analytics. You can delete your account and associated data directly from the Profile section of the app. You can also consult our account deletion page or use our contact form to exercise your rights or request that your analytics identifier be excluded or deleted. You may lodge a complaint with the French data protection authority, the CNIL.

Changes to this policy

This policy may change as the service or applicable regulations evolve. The date displayed at the top of this page indicates the latest update.