sipatra

Privacy Policy

Last updated: September 26, 2026

Sipatra is an outdoor social network for hiking, cycling, camping and vanlife. This policy explains what personal data we collect, why we collect it, and the rights you have over it. It applies to the Sipatra mobile apps and the API at sipatra.com.

Data we collect

Account data. Your email address, username, display name, and the profile details you choose to add (bio, avatar, interests, gear, and optionally the country you say you are from — shown on your profile as a flag; it is your own declaration and is never derived from your location).

Birth month and year. Asked once when you sign up (or the first time you open the app after signing in with Google or Apple). We use it only to check that you are at least 16, the minimum age for Sipatra. It is never shown on your profile or to anyone else, is kept for as long as the account exists, and is deleted with it.

Content you create. Posts, photos, stories, comments, reviews and direct messages, including voice messages and the audio in videos you record. Direct messages are stored on our servers and are not end-to-end encrypted.

Location data. GPS tracks recorded during your activities, waypoints, and places you review. We treat location as sensitive data: recording requires your separate, explicit consent, which you can withdraw at any time. Raw GPS tracks are private by default. If you share an activity, Privacy Zones you define are applied on our servers before anything is shown to others, so masked areas never leave our infrastructure.

Health and fitness data. With your explicit consent — asked separately from location consent, off by default, and withdrawable at any time — Sipatra can read the workouts your watch saved to the health store on your phone (Apple Health on iOS): the workout itself, its route and its heart-rate samples. We read only what the watch’s own workout app wrote there; workouts other apps put in the health store are ignored. Sipatra can also write the activities you record with Sipatra back into the health store, so your own health app keeps them too.

Step counts. If you turn on step counting (off by default), Sipatra reads hourly step totals from your phone’s motion sensor and, with your permission, from the health store on your phone (Apple Health on iOS, Health Connect on Android) so that steps your watch counted are included. We read only steps recorded automatically by the phone or the watch; steps typed in by hand or written by other apps are ignored. Location, heart rate and other health data are not read for this feature. Step totals stay on your device until you join the Step League; turning the feature off deletes them.

Sensor data. If you pair Bluetooth sensors — a heart-rate strap, a cadence sensor, a power meter — their heart rate, cadence and power readings are recorded with the activity they belong to.

Derived physiological data. From that data, together with the athlete profile you may choose to fill in (maximum and resting heart rate, birth year, weight, FTP), we compute heart-rate zones, an effort score and estimated calories for your activities. The athlete profile is optional, it is used only for these calculations, and it is never shown to anyone else. Your detailed heart-rate, cadence and power series and your zone breakdown are visible only to you, even on an activity you share.

How you use the app. Which stories you have already seen, and the posts you react to or comment on. We use this to mark stories as viewed and to keep your feed from repeating itself. We do not use third-party analytics and we do not profile you for advertising.

Technical data. Sign-in sessions and device push tokens, used only to operate the service and keep your account secure.

We do not use cookies for tracking. The service consists of a mobile app and an API; the only cookies involved are the ones strictly required for the sign-in pages to work.

Why we process it

We process account and content data to provide the service you signed up for. We process location data solely on the basis of your explicit consent, to record and display your activities. We process health and fitness data — watch workouts, sensor readings, the athlete profile and the zones, effort score and calories derived from them — solely on the basis of your explicit health-data consent, which is asked separately from location consent and can be withdrawn separately. The derived figures serve that same purpose: showing you your own training. We process your birth month and year to meet the minimum-age requirement in our terms and the laws that apply to us; that is the only thing it is used for. We do not sell personal data and we do not use it for third-party advertising.

Where your data lives

Your data is stored on our own self-hosted servers in the European Union. The backend does not depend on third-party data platforms. This includes your health, sensor and physiological data: it is stored on the same servers and is never sent to a third-party health, fitness or analytics cloud. Writing your activities back into the health store happens entirely on your device and involves no server of ours or anyone else’s.

Third-party processors

We use a small number of external services strictly as delivery channels:

  • Google and Apple sign-in — optional, only if you choose to sign in with them; we receive your verified email address from the provider.
  • Firebase Cloud Messaging / Apple Push Notification service — deliver push notifications; payloads carry references, not your personal content or location.
  • Resend — sends transactional email such as verification and password-reset messages.

None of these services store your Sipatra content or GPS tracks.

Retention and deletion

We keep personal data only for as long as we need it to run Sipatra for you. Your account, profile, activities, GPS tracks, posts, photos and messages are kept for as long as your account exists, until you delete them or delete your account. Some data has a fixed, shorter retention period:

  • Posts and stories you delete: kept in your trash for 30 days so you can restore them, then permanently deleted together with their media. An expired story stays in your story archive for 30 days, visible only to you, then is permanently deleted with its media. A story you add to your highlights stays on your profile for the audience it had until you remove it; from then on it follows the same 30-day archive rule.
  • Messages you delete: permanently deleted after 30 days. A view-once photo or video is removed 7 days after it is opened.
  • Notifications: read notifications are deleted after 90 days; no notification is kept longer than 180 days.
  • Last shared location area (a coarse grid cell, never an exact point): deleted after 30 days.
  • Original video files: deleted 90 days after upload; the processed versions shown in the app stay with your post.
  • Hourly step counts (Step League only): deleted after about 90 days; daily totals are kept for the season plus 13 months.
  • Server logs: 30 days. They never contain GPS coordinates.
  • Database backups: 14 days. Data you delete may remain in an access-restricted backup until that backup expires; backups are used only to restore the service after a failure.
  • Security and moderation records: records of administrative actions and resolved reports are kept for 1 year, enforcement decisions for 2 years, so appeals and repeat violations can be handled. Content under an open report or appeal is kept, hidden from everyone, until the case is closed.

You can deactivate your account from the app; deactivation hides your content but keeps your data until you return or request deletion. You can delete your account from the app: after a 30-day grace period during which you may cancel, your profile is anonymised and your GPS tracks and media are permanently deleted. If you withdraw location consent, recording stops and previously recorded tracks are deleted.

If you withdraw health-data consent, importing stops and everything that consent allowed is taken back: the activities that came in from your watch or a connected account are deleted with all their points, and your athlete profile is cleared, so heart-rate zones, effort scores and calorie estimates drop out of your analysis. Activities you recorded with Sipatra and GPX files you imported yourself are not health data obtained under that consent and are not deleted; their sensor readings stay with them. Workouts Sipatra already wrote into your device’s health store stay there under your control, and you can remove them in your health app.

Your rights

Under the Turkish Personal Data Protection Law (KVKK) and the GDPR you have the right to access, correct, delete and export your data, and to object to processing. The app provides self-service data export, profile editing, consent withdrawal and account deletion. For anything else, contact us and we will respond within the statutory deadlines.

Contact

For privacy questions or requests, email [email protected].