Privacy Policy

1. Information We Collect

GradeX is designed with an offline-first, privacy-respecting approach. We collect only the minimum data necessary to provide core functionality.

a) Location Data

We collect GPS coordinates (latitude, longitude, altitude), speed, and bearing while you use navigation or record activities. Location data is processed on your device to provide:

• Real-time navigation and gradient display
• Activity recording (cycling, running, hiking, motorcycling, walking, driving)
• Elevation profiles using SRTM data
• Weather information along your route

b) Heart Rate Data

If you connect a Bluetooth Low Energy (BLE) heart rate sensor, we collect heart rate readings (BPM). This data is processed entirely on your device and stored locally as part of your activity recordings. Heart rate data is never transmitted to our servers.

c) Activity Recordings

When you record an activity, GPS track points with timestamps, elevation, and optional heart rate are stored locally on your device.

d) Audio Data

When you use the mesh intercom feature during group rides, microphone audio is captured and transmitted in real-time to connected peers only. Audio is never recorded, stored, or sent to our servers.

e) Analytics Data

We use Firebase Analytics (Google) to understand how the app is used in aggregate. Firebase Analytics may collect device identifiers, app usage events, session duration, crash reports, and general device information (OS version, device model). This data is anonymised and used solely to improve the app. It is subject to Google's Privacy Policy.

f) Advertising Data

Our advertising partner, Google AdMob, may automatically collect device advertising identifiers, IP address, and ad interaction data to serve and measure advertisements. This data is collected by Google's SDK and is subject to Google's Privacy Policy.

g) Map & Elevation Data Sources

Offline map tiles are derived from OpenStreetMap data (© OpenStreetMap contributors, ODbL). Elevation data is sourced from NASA SRTM (public domain). No personal data is embedded in or transmitted alongside these datasets.

2. How We Use Your Information

• Navigation & Mapping: GPS data is used on-device for real-time navigation, gradient calculation, and map display.
• Activity Tracking: Location and heart rate data are stored locally for your personal activity history and statistics.
• Group Rides: During group ride sessions, your position (latitude, longitude, bearing, speed) is shared with other riders in your session via peer-to-peer mesh or our secure relay server.
• Weather: Your route coordinates are sent to the Open-Meteo API to display weather conditions. Open-Meteo does not require user accounts or tracking.
• Analytics: Anonymised usage events help us identify crashes and improve the app. No personally identifiable information is included.
• Advertising: We display ads through Google AdMob to support free access to the app.

3. Data Storage & Security

• Local Storage: All personal data (activities, routes, heart rate) is stored locally on your device. We do not automatically sync your data to cloud services.
• Encrypted Credentials: Your username and backup code are stored using Android EncryptedSharedPreferences (AES-256-GCM encryption).
• Secure Communications: All network communications use HTTPS. No plaintext connections are permitted.
• Backup Files: When you manually create a backup, it is stored in a location you choose on your device and contains your activity data and credentials.

4. Data Sharing

We do not sell, rent, or trade your personal data. Your data is shared only in these limited circumstances:

• Group Ride Participants: During an active group ride session, your real-time position is shared with other riders in your session. This sharing stops when you leave.
• Mesh Intercom Peers: Audio is transmitted peer-to-peer only to devices in your mesh network. It does not pass through our servers.
• Weather Provider: Route coordinates are sent to Open-Meteo to fetch forecasts.
• Analytics Provider (Firebase / Google): Anonymised usage events. You can opt out via your device's Google Settings.
• Advertising Partner (Google AdMob): You can opt out of personalised ads in your device's Google Settings under "Ads".

5. Permissions

GradeX requests the following Android permissions, each for a specific purpose:

• Location (Fine & Coarse): Navigation, activity recording, and gradient calculation.
• Bluetooth: Connecting to BLE heart rate sensors and mesh networking.
• Camera: QR code scanning to join group ride sessions.
• Microphone: Real-time voice intercom during group rides.
• Nearby Devices / Wi-Fi: Peer-to-peer mesh networking for group rides.
• Notifications: Navigation and download progress notifications.
• Internet: Downloading maps, fetching weather, and group ride communication.

All permissions are requested at runtime with an explanation before use. The app functions with limited features if permissions are denied.

6. Data Retention

• Activity recordings are stored on your device until you manually delete them.
• Downloaded maps remain on your device until you remove them.
• Group ride position data is not stored on our servers after a session ends.
• Audio intercom data is never stored — it exists only as a real-time stream.
• Weather data is kept in memory only during your session and is not persisted.

7. Children's Privacy

GradeX is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

8. Your Rights

You have full control over your data:

• View: All your data is accessible directly within the app.
• Export: Use the Backup feature to export all your data.
• Delete: Delete individual activities, remove downloaded maps, or uninstall the app to remove all local data.
• Revoke Permissions: Revoke any permission at any time through your device's Settings app.

GDPR (EU / EEA Users)

If you are in the EU or EEA, you have the right to access, rectify, erase, restrict processing of, and port your personal data. You also have the right to lodge a complaint with your local data protection authority. For data processed by our servers (group ride sessions), contact us at [email protected].

CCPA (California Users)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to opt out of any sale of personal information. We do not sell personal information. Contact us at [email protected].

9. Open-Source Attributions

GradeX is built on the following open-source projects and data sources:

• OpenStreetMap — Map data © OpenStreetMap contributors, ODbL. openstreetmap.org/copyright
• MapLibre GL Android — BSD-2-Clause license.
• GraphHopper — Offline routing engine, Apache License 2.0.
• Open-Meteo — Weather data, CC-BY 4.0. open-meteo.com
• NASA SRTM — Elevation data, public domain.

Full license texts for all open-source dependencies are available upon request.

10. Data Accuracy Disclaimer

GPS accuracy depends on device hardware and signal conditions. Elevation data may not reflect recent terrain changes. Map data may be incomplete or contain errors. Weather information represents forecasts that may differ from actual conditions.

11. Limitation of Liability

The app is provided "as is" and "as available" without warranty of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, or accuracy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by the "Last updated" date at the top. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

[email protected]