Privacy policy
Maxvarv is an iPhone, Apple Watch and Android app that records enduro, motocross, snowmobile and ATV rides, shows statistics and lets you follow other riders. This policy explains which personal data we process, why, for how long, and your rights.
1. Controller
Kim Sahlström (private individual), Sweden Email: hej@maxvarv.se
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Account | email address, password (stored hashed by our provider), user ID | you |
| Profile | display name, username, bio, profile picture, private/public account, and if you choose: your user names on Instagram, YouTube, TikTok and Facebook | you |
| Consents | which terms and privacy policy you accepted and when, your health data and marketing choices | you |
| Rides | start/end time, duration, distance, speed, altitude, ascent | your phone/watch |
| GPS routes | location points during the ride | your phone/watch |
| Health data | average/max heart rate, calories – only with your explicit consent | Apple Health, your Wear OS watch or your Garmin watch |
| Privacy zones | location and radius of zones you create (e.g. around home) | you |
| Community | who you follow, follow requests, likes, comments, blocks, reports | you |
| Messages | chat messages between you and riders you follow each other with (text, who and when). Only the two of you can read them | you |
| Posts | text, up to 4 photos and a link to a YouTube video you add to a ride | you |
| Trail map | places you add (name, description, vehicles, whether riding is allowed, start/parking position, link), photos, comments and ratings you add, and which tracks you follow | you |
| Club admin | if you are a club admin for a track: which track, and the track status (open/closed) and messages you publish for it | you and the app administrator |
| Notifications | when someone follows you, gives a Ride On or comments, or when a track you follow updates its status or sends a message, we store a notification for you (who or which track, what and when) | automatic |
| Technical | sign-in times and security logs at our hosting provider | automatic |
Photos: photos are made smaller on your phone before they are uploaded. Maxvarv does not keep the photos' location data (EXIF/GPS) – it is removed when the photo is made smaller.
We do not collect data for advertising, we do not track you across apps or websites, and we never sell personal data.
Apple Health: Maxvarv reads workouts, heart rate, calories and routes from Apple Health and saves rides there, only with your permission in iOS. Apple Health data is never used for advertising or marketing.
Health Connect (Android): If you switch it on under More → Health Connect, Maxvarv saves your rides (time, route, distance, ascent and calories) to Health Connect on your phone. Maxvarv does not read any data from Health Connect. You can switch it off at any time and delete the data in Health Connect. Health Connect data is never used for advertising or marketing.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, save rides, show statistics, sync between devices | Contract (Art. 6(1)(b)) |
| Community: following, feed, likes, comments, leaderboards | Contract (Art. 6(1)(b)) |
| Store heart rate and calories in your account and – if you choose – show them to others | Explicit consent (Art. 9(2)(a) and 6(1)(a)) |
| News and offers by email | Consent (Art. 6(1)(a)) |
| Security, preventing abuse, handling reports and blocks | Legitimate interest (Art. 6(1)(f)) |
| Legal obligations | Legal obligation (Art. 6(1)(c)) |
You can withdraw any consent at any time under More → Privacy & Consent. Withdrawing health data consent deletes your heart rate and calories from your account.
4. Who can see your data
- Other signed-in users see your profile (name, username, bio, profile picture).
- Rides and statistics follow your settings: only you, followers, or all signed-in users. With a private account you approve new followers.
- GPS routes are shown to others only if you share the route of that ride. Points inside your privacy zones are always hidden from others.
- Heart rate and calories are shown to others only if you turn sharing on.
- Blocked users cannot see your rides, and you cannot see theirs.
- Text, photos and the YouTube link on a ride are shown to the same people who can see the ride.
- Your social media links (Instagram, YouTube, TikTok, Facebook) are shown to the same people who can see your rides: all signed-in users if your account is public, only your followers if it is private. Blocked users cannot see them.
- Places on the trail map – with photos, comments and ratings – are shown to all signed-in users, together with your display name. The position you give for a place is public to all signed-in users.
- Which tracks you follow is not shown to others – the club and other riders only see how many follow the track.
- Track status and club messages published by a club admin are shown to all signed-in users and sent as a notification to the track’s followers.
5. Processors and transfers
- Supabase (Supabase Inc.) – database, sign-in, storage of profile pictures and photos on rides and places. Data is stored in the EU (Ireland). Supabase is a US company; any access from outside the EU/EEA is protected by the European Commission's Standard Contractual Clauses under Supabase's data processing agreement.
- Resend (Resend Inc.) – delivers account emails such as email confirmation and password reset. Resend processes your email address and the message itself. Resend is a US company; the transfer is protected by the European Commission's Standard Contractual Clauses under Resend's data processing agreement.
- Garmin – if you use the Maxvarv app for Garmin watches, the ride is sent from the watch to the Maxvarv app on your phone over Bluetooth, and is also saved as an activity in your own Garmin Connect account under Garmin's privacy policy. Maxvarv does not read any data from your Garmin account.
- Apple – Apple Health/HealthKit on your device and Apple Maps for map display in the iPhone app, under Apple's own privacy policy.
- Google (Google Ireland Ltd.) – Google Maps for map display in the Android app. When a map is shown, Google receives the area being displayed and your IP address, under Google's own privacy policy. No account details are sent to Google.
- YouTube, Instagram, TikTok and Facebook – Maxvarv sends no data to these services and loads nothing from them; no preview image is loaded. Only when you tap a link yourself does the service open, and then its own privacy policy applies.
6. Retention
- As long as you have an account.
- When you delete your account (More → Delete account), your profile, profile picture, rides, routes, health data, zones, consents, follows, likes, comments, blocks, reports, posts, photos, YouTube links, social media links and your comments and ratings on places, the tracks you follow and your club admin roles are deleted immediately and permanently. Track status and club messages you published as a club admin stay on the track, no longer linked to you.
- Places you added stay on the map when you remove your name from them or delete your account – no longer linked to you. Photos and comments you remove are hidden from everyone at once, kept for 90 days to review abuse, and then deleted. Reported content is kept until the report is handled.
- Notifications are deleted after 90 days or when you remove them.
- Chat messages are kept until one of you removes the message or deletes their account. Reported messages are kept for review.
- Security logs at our hosting provider are kept for a limited time according to the provider's routines.
- Apple Health and Health Connect data is not affected by deleting your Maxvarv account; manage it in the Health app or in Health Connect.
7. Your rights
You have the right to:
- access your data – export it yourself under More → Privacy & Consent → Export my data,
- rectify inaccurate data (e.g. in Edit Profile),
- erasure (delete your account in the app),
- restrict or object to certain processing,
- data portability (the export is a machine-readable file),
- withdraw consent at any time.
Contact hej@maxvarv.se. We reply within one month. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.
8. Security
Measures include encrypted transmission, database access rules limiting who can read what, private GPS routes by default, privacy zones, and health data stored only with consent. No service can guarantee absolute security; please protect your password and devices.
9. Children
Maxvarv is not intended for children under 13.
10. Changes
We will inform you in the app about significant changes. The current version is always available at https://maxvarv.se/en/privacy/ and in the app.