Privacy Policy

This policy applies to Paths Labs Ltd, a company registered in England and Wales (Company No. 17175677). Paths is a mobile app for iPhone and Android; this website is where you learn about Paths and read our policies.

Paths is designed to be simple and private.

What we collect

• Movement data — GPS coordinates (latitude and longitude), timestamps, distance, and route geometry that you record, draw, upload, import from a route link (Google Maps, Komoot), or generate using the route tools
• Activity and step data — when you record a walk or hike, Paths reads your step count from your device's built-in motion sensor (pedometer) only while a recording is in progress. The step total is shown to you live and saved with that movement for your own reference. We never use this data for advertising, and we never share it with third parties
• Strava activity data — when you connect your Strava account, we import GPS coordinates, speed/velocity, altitude/elevation, grade, distance, and time data from activities you choose to import. We store the minimum data needed to render your visual and do not store raw Strava activity files
• Apple Health data — if you give permission, Paths reads workouts you choose to import, together with their heart rate, distance and route data. We read only what is needed to create the movement you asked for; we never read clinical or medical records, and Paths never writes anything back to Apple Health. Health data is used solely to create and display your movement, is never used for advertising, is never sold, and is never shared with third parties for their own purposes. See Apple Health below
• Titles, notes and descriptions — the text you add to a movement, including written Notes
• Photos — if you attach a photo to a movement, the image is stored securely and encrypted in private storage, kept with your account so we can display it to you and include it when you choose to share or gift that movement. Photos are private by default — never public, never sold, never used for advertising. Only you, and the people you share or gift a movement with, can see them. You can remove an attached photo at any time, which deletes it
• Account information — your email address, used for authentication. Passwords are never stored by Paths; authentication is handled by Supabase Auth using either a magic link sent to your email or a securely hashed credential. We do not have access to your password in any form
• Profile data — display name and profile photo, if you choose to add them
• Access data — your access status, used to manage what your account can do
• Usage data — interaction data (such as which features you use) collected via PostHog to help us understand and improve the product. This is linked to your account so we can understand how the product is used over time. We never use it for advertising and never sell it, and we do not track you across other apps or websites
• Crash and diagnostic data — when the app encounters an error, we collect technical diagnostic information (such as the error and device/app state at the time) via Sentry, so we can find and fix problems. This is used only to keep the app working reliably, never for advertising

How we use it

• Authenticate your account and maintain your session
• Generate and display your visual movement artwork
• Save your movements, photos, Notes and Series to your account
• Show live recording metrics — including step count for walks and hikes — and save them with the movement
• Create movements from workouts you choose to import from Apple Health or Strava
• Manage what your account can access
• Improve the product and user experience

Strava integration

If you connect your Strava account, we request read-only access to your activities (activity:read_all scope). We access only the specific activities you choose to import. We do not read your full activity history automatically, access private messages, or store information about followers or connections.

Speed, elevation, and GPS data from imported activities are used solely to generate your artwork and are stored only for as long as your movement remains saved in your account. You can disconnect Strava at any time from your Profile page, which removes your stored access credentials immediately. Disconnecting does not delete movements you have already saved.

Your use of Strava remains subject to Strava’s own privacy policy.

Apple Health

If you choose to import from Apple Health, Paths asks your permission to read four things: workouts, heart rate, distance and workout routes. You grant each of these in Apple’s own permission screen, and you can change or withdraw them at any time in the Health app under Sharing › Apps.

We read this data only when you open the import screen and only for the workouts you select. Paths does not read your health data in the background, and does not sync continuously. We never request or read clinical health records — lab results, medications, immunisations, conditions or any other medical record — and Paths has read-only access: it never writes, changes or deletes anything in Apple Health.

When you import a workout, the details needed to create that movement — its time, duration, distance, heart rate and route — are saved to your Paths account so your movement can be displayed and kept. Health data is used solely to create and display your movements. It is never used for advertising or marketing, never sold, never used to train any model, and never shared with third parties for their own purposes. It is not used for any kind of health, medical or fitness assessment, and Paths is not a medical device.

Deleting a movement deletes the health data imported with it. Deleting your account removes it along with everything else, as described under Your rights.

AI-generated content

Paths uses an AI service (Claude, provided by Anthropic) to suggest movement titles and notes. To do this, a sample of your route’s coordinates is sent to Anthropic’s API along with any context you choose to provide. This data is used solely to generate the suggestion and is not retained by Anthropic or used to train their models. You are not required to use AI suggestions — you can name your movement manually at any time.

Payments

Paths is currently free to use, and we do not charge you anything today. Paths never sees or stores card details: if paid features are introduced, payment would be processed entirely by the Apple App Store or Google Play, subject to their own privacy policies.

We use RevenueCat to keep track of whether an account has paid access. On iOS and Android this runs for every signed-in account, including free ones, so it receives your Paths user ID even if you never make a purchase. It never receives your payment details or your movement data. All we store is your access status, used to manage what your account can do.

Who we share data with

We do not sell your data, and we do not share it with third parties for their own purposes or for advertising. We use a small number of service providers to run Paths, who process data only on our instructions: Supabase (secure database, authentication and file storage), PostHog (product usage analytics), Sentry (crash and error diagnostics) and RevenueCat (purchase status). Health data imported from Apple Health is never shared with any of them beyond the secure storage of your own movements in Supabase. If you choose to connect Strava, we also access the specific activities you import (see above). When you choose to share or gift a movement, only the people you send it to can see that movement.

Data security

We use appropriate technical and organisational measures to protect your data. Data is encrypted in transit, and photos are held in private, encrypted storage accessible only to you and anyone you choose to share or gift a movement with.

Your rights

You have the right to access, correct, or delete your personal data. You can delete your account at any time from inside the app: open Profile and tap Delete account. Your account is deactivated immediately, and your movements, Series, photos and profile are permanently deleted after 30 days. Within those 30 days you can email support@paths.today to restore your account; after that, the deletion is permanent and cannot be undone. To access or correct your data, or if you cannot reach the app, email support@paths.today at any time.

Cookies

We use minimal cookies to keep the website functioning and understand basic usage. You can control cookies through your browser settings.

Data protection laws

We process personal data in accordance with applicable data protection laws, including the UK GDPR.

Contact

hello@paths.today

Paths Labs Ltd
Registered in England and Wales (Company No. 17175677)
Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom