Legal
Privacy
Skad is a course planner. It holds what you draw and the address you sign in with, and not much else.
Analytics on the front door only
Google Analytics on the marketing pages. Nothing inside the app, on the map, or on a course page is tracked.
Location stays in your browser
It centres the map. It is never sent to us and never stored.
Export any time
Every route as one GPX file, from your account page, without asking.
Delete for good
One page, immediate, final. Routes and events go with the account.
What we collect
Your account. An email address and a password, plus a display name if you set one. The password is hashed by our authentication provider and is never readable by us or by anyone else.
What you draw. Routes: the name and description you give them, the activity, the coordinates of the line, and the waypoints you place on it. Events: the name, dates, briefing, races, and the stations, including the times, the crew names, the access notes, and the code you set for the crew page.
What the service needs to run. Which plan your account is on, when an event was paid for and until when, and ordinary server logs from our host (the request, the time, the IP address, the browser).
Traffic on the marketing pages. With your say-so, Google Analytics runs on the front door: the landing page, about, FAQ, pricing, and these legal pages. It tells us which of those pages were opened, roughly where from, and on what kind of device. It does not run inside the app: not on the map, not in Your Ground, not on an event, and not on any course or crew page. Nothing you draw is sent to it. No advertising, and no ad pixels anywhere.
How we use it
To run the service, and for nothing else. Your email signs you in and receives the confirmation and password-reset links; the rest is the course you are building and the pages it produces.
We do not sell your data, we do not share it for advertising, and we do not use what you draw to train anything.
Your location
The map can open where you are, which needs your browser to give it your position, and your browser asks you first. That position stays in the browser: it centres the map and is never sent to us and never stored. Turn it down and the map opens at its default view.
Who can see what, and when
Nothing is visible to anyone else until you share it. A route is private by default. Share it and its name, description, waypoints, and line open for anyone holding the link, along with the display name on your account. Nothing is listed or submitted to search engines; the link is the only way in, and turning sharing off closes it.
An event is a draft until you publish it, and publishing shares it the same way: by link, unlisted. The runner page then shows the course, the aid and water, the cutoffs, and the registration links. It never shows the crew details: the staff names, access roads, and volunteer posts live on the crew page behind your code, and the server strips them out of the public view rather than hiding them in the browser.
Take a course back to private, or delete it, and the public page stops resolving.
Who else sees anything
Supabase hosts the database and the sign-in system: your account and everything you draw sit there.
Vercel hosts and serves the site, and keeps the usual server logs.
Mapbox serves the map itself. Your browser talks to them directly for the map tiles, for place search, and for snapping a line to a trail, so they see your IP address and what you asked for. They do not see your account.
Open-Meteo provides the forecast on a course page. Our server asks them, not your browser, so your address never reaches them.
Stripe takes the payment when you buy an event. Card details go to Stripe and never touch Skad: we keep the reference to the payment and the date the event is covered until.
Google Analytics measures traffic on the marketing pages, as above. Your browser talks to Google for that, and Google's own privacy policy covers what they keep. It is not loaded on any page of the app itself.
Unsplash supplies the photographs on the landing page. They are fetched and resized by our server, so your browser never contacts Unsplash.
How long we keep it
Your routes and events stay until you delete them or delete your account. Server logs are kept for a short period by our host as part of running the service.
Your rights
Everything you draw is downloadable as one GPX file from your account page, at any time, without asking us.
The same page changes your email, changes your password, and deletes your account. Deleting is immediate and final: the account goes, and the routes and events go with it.
If you are in the UK or the EU you also have the right to ask what we hold, to have it corrected, and to complain to your data protection authority. Write to us first and we will sort it.
Contact
hello@skad.run. A person reads it.