Version 1.8 — 4 October 2026 · Français
ADVMAP is published by Sylvain Chanuc, sole trader (entrepreneur individuel) trading as SISILAB, 8 rue Paul Gauzy, 32000 Auch, France (SIRET 531 101 566 00036).
He is the data controller within the meaning of the General Data Protection Regulation (GDPR). For any question or request about your data: advmap@sisilab.app.
Your account: the email address passed on by Google or Apple when you sign in (if you use Apple's "Hide My Email", we only receive a relay address) — or, for the few accounts created by the ADVMAP team, the address chosen when they were created —, an internal identifier, your username, profile picture, bio, motorcycle details, language and theme.
What you publish: your GPX tracks — that is, the complete trace, point by point —, your photos, your titles and descriptions, your posts, comments, reviews and event attendance, and your trail reports: their type, their position, the track you were following if any, and their date.
Your connections in the app: the people you follow, the posts you like, and the list of people you have blocked.
Your downloads: which tracks you downloaded, and when. They are used to apply the monthly quotas and to show how many riders took a track in the last 30 days — a total, never names.
Your private messages: direct messages and event chat messages, kept on our servers so they can be delivered to their recipient.
Your reports: the reason you pick and the comment you write.
Your notifications: if you allow them, a technical identifier for your phone, needed to deliver them to it, and the types of notifications you chose to receive.
Technical data: your IP address and device information, sent automatically with every network connection, plus connection logs kept by our host.
We do not ask for your name, postal address, phone number or any payment details.
Running the service — your account, the map, the feed, messages, events: this is performance of the contract between us, namely the Terms of Use you accepted.
Moderating and protecting the service — handling reports, enabling blocking, suspending an account: our legitimate interest in keeping the place usable, and other users' interest in not being abused.
Showing your position on the map, following it during navigation — including with the screen off —, and sharing it live during an event: your consent, given when you allow location access and, for live sharing, when you switch it on explicitly. You can withdraw it at any time.
Sending you notifications: also your consent, given when you allow them after the app asks. You can withdraw it at any time in your phone's settings, or choose type by type what you receive in Settings > Notifications.
Answering your help requests and suggestions: our legitimate interest in providing support.
Responding to an authority that requires it: our legal obligation.
As of today, we do not sell any data and we earn no advertising revenue. Should that change, section 7 says on what conditions.
This is the most sensitive point in a track-sharing app, so let us be precise.
Your live position is used to place you on the map. It stays on your phone and is not written to any of our databases — with one exception: if you turn on position sharing during an event, your position is broadcast live to the other participants of that event. That sharing is ephemeral, written to no table, and stops as soon as you leave the screen — or, if you are navigating, at the end of the navigation, even if your screen has turned off in the meantime. Participants also see your distance along the trace and whether you have stopped; the group is alerted if you stay stopped for more than 5 minutes or fall more than 3 km behind. You can also send them a quick message picked from a short list ("Break", "Fuel", "Wait for me"…): it appears next to your username for 3 minutes for those sharing their position, without a notification, then disappears; it is never stored.
If you let ADVMAP record your ride during navigation, the recording stays on your phone: it is only sent if you choose to keep it, and then as a private track.
A trail report is placed where you are when you make it. Others see it without ever knowing who made it.
During a navigation you started, ADVMAP keeps following your position and making its voice announcements when the screen turns off or the app goes into the background. Your phone shows it — a blue indicator on iPhone, a persistent notification on Android — and everything stops at the end of the navigation. ADVMAP never asks for access to your location "always", only while using the app, and stores nothing more than with the screen on. Voice announcements are produced by your phone, without a microphone.
Your GPX tracks contain precise coordinates by nature. When you publish a track publicly, the trace is visible to everyone, including its starting point — which is often where you actually set off from. Bear that in mind before publishing a track that starts outside your front door.
The file other people download is a cleaned copy of yours: without the times you passed each point, without any author details it may contain, and without its named points ("Home", "Bivouac"…), unless you choose to show them. Likewise, your photos are re-saved before upload: the hidden information they contain — where and when they were taken, the camera model — is removed. A photo that cannot be cleaned is not uploaded.
When you import a track, the coordinates of its starting point are sent to an outside geocoding service to find the country, region and town shown on the track page. The same applies when you pick a place for a post, an event or "My area".
When terrain analysis runs on a track, the complete trace is sent to outside mapping services to work out which sections are paved, and to find points of attention (fords, barriers…) and useful places (fuel stations, campsites…) along the trace. The same happens when you import a track with no elevation data: its trace is sent to calculate it. Section 6 says to whom.
Finally, if you tap "Directions to the start" or "Rejoin the route", the coordinates of the target point are passed to the navigation app you select — Google Maps, Waze or Maps — which then applies its own privacy rules.
What you publish publicly — public tracks, posts, comments, reviews, profile — is visible to other users, and your profile may appear in search if you allowed it in the settings.
Your private messages are read by nobody but their recipient in the normal running of the service.
The list of people you block is visible to you alone. The blocked person is not told.
The number of riders who took a track in the last 30 days is shown as a total, never with names.
When you publish a public track or event, the people who follow you may be notified, with its title. Never for a private event, and never between blocked accounts.
Trail reports are only visible to signed-in users, for 30 days, on tracks passing nearby: never on the general map, never with your username, and never between blocked accounts.
One exception, which we would rather write down plainly: when content is reported, an administrator may view it in order to decide whether it should be removed, including where that content is not public. For a message, they see only the reported message — never the rest of the conversation. For a trail report, they see its author's username. That is the price of moderation that actually works.
Outside those cases — handling a report, answering a help request you send us, or complying with a legal obligation — we will not go looking at your data.
Running ADVMAP means calling services we do not host ourselves. Here they are, and what each one receives.
Supabase — database, authentication, file storage and live messaging: receives all of your account and content data.
Google and Apple — signing in to your account: receive the sign-in request and pass us your email address. If you allow notifications, they are also the ones who deliver them to your phone.
Expo (EAS) — delivering app updates and sending notifications: receives your IP address and device information when an update is downloaded. For a notification, it receives your phone's technical identifier and the text displayed — the username of the person concerned, the action, for example "sent you a message", and, where relevant, the title of the track or event concerned —, then hands it to Apple or Google. Never the content of a message or a comment.
CARTO, Esri, IGN and OpenTopoMap — base maps (street, satellite, French mapping, topographic): receive your IP address and the map area you are looking at. When you download an area for offline use, it is supplied by IGN in France, by the official Spanish and Austrian maps in those two countries, and by Esri or OpenTopoMap elsewhere or if IGN does not respond: they therefore receive the downloaded area.
The official maps of neighbouring countries — swisstopo (Switzerland), Spain's National Geographic Institute, BKG (Germany), basemap.at (Austria) and Kartverket (Norway) — replace the topographic map in their country: each receives your IP address and the map area you are looking at, never any data from your account.
Amazon Web Services — elevation data for climb calculations: receives your IP address and the map area displayed.
Photon (Komoot) — place search and reverse geocoding: receives what you type into the search box, and the precise coordinates of the points to identify.
Overpass and Valhalla (OpenStreetMap projects) — terrain analysis, elevation for tracks that have none, points of attention and useful places: receive the complete trace of the track concerned.
RainViewer — weather layer: receives the map area displayed.
OpenMapTiles and unpkg — fonts and the mapping library: receive your IP address alone.
cdnjs (Cloudflare) — library for displaying PDF roadbooks: receives your IP address alone. The PDF itself stays on your phone.
RevenueCat — Premium subscription management: will receive your internal identifier once subscriptions open. They are not open today and no data is sent to it.
None of these services receives your private messages, apart from Supabase, which hosts them.
As of today, ADVMAP contains no analytics tool, no advertising network and no third-party tracker. This is not a statement of intent: there are none in the version you are using, and that can be verified. The next section says what happens if that changes.
As of today, ADVMAP shows no advertising and contains no ad network.
That may change: the app has to pay for itself, and advertising is one of the options being considered alongside the Premium subscription. Better to say so now than to let you discover it one morning.
If that day comes, here are the ground rules.
We will tell you in the app before the first advert appears, and this page will be updated, with a new date and the names of the ad networks involved.
Advertising that is merely displayed — the same for everyone, without tracking what you do — relies on no data about you and does not require your consent.
Targeted advertising, on the other hand — based on tracking your activity, on an advertising identifier, or on a profile built from your data — will only be switched on with your explicit consent. You will be asked beforehand, you will be able to refuse without losing access to the app, and to withdraw it afterwards whenever you want. That is what the law requires, and we have no intention of getting around it.
In every case, your tracks, your photos and your private messages will not be passed to an advertiser, and your data will not be sold.
Some of these services are established outside the European Union: Supabase in Singapore, and in the United States Expo, CARTO, Esri, Amazon Web Services, unpkg, Cloudflare and RevenueCat. Google and Apple deal with European users through their Irish subsidiaries, but may transfer data outside the Union. These transfers rely on the safeguards provided for in Chapter V of the GDPR: mainly the European Commission's standard contractual clauses and, for the US providers that adhere to it, the EU–US Data Privacy Framework.
The OpenStreetMap-world services we use — Photon, Overpass, Valhalla and OpenTopoMap — are hosted in Europe.
The official maps of neighbouring countries come from European public bodies: those of the European Union, of Norway, a member of the European Economic Area, and of Switzerland, which the European Commission recognises as ensuring adequate data protection.
Your data and your files are physically hosted in the European Union, in France: Supabase stores them in the Europe (Paris) region. The Supabase company is Singaporean, but your data itself never leaves French territory.
For as long as your account exists.
You can delete a track, a post, an event or a comment at any time: deletion is immediate, and also erases the files attached to it — GPX file, photos.
Your download history is erased automatically after 60 days. Your trail reports stay visible for 30 days, then are permanently erased 7 days later; you can delete them sooner, in Settings > Your data > "My reports".
Deleting your account (Settings > Your data) erases your profile and profile picture, your tracks and their GPX files, your photos, your posts, your comments, your reviews, the events you created, the people you follow, your likes, your block list, your download history, your trail reports and your messages. It is immediate and final: we cannot restore anything afterwards. If erasing your files fails, your account is not deleted — nothing is left half-erased, and you can try again. Our host's technical backups may keep a copy for a few days before being overwritten in turn.
Your private conversations disappear for both people: the messages you sent as well as those you received. The other way round, if someone you talk to deletes their account, your conversation disappears on your side too. Only what was copied or screenshotted escapes deletion.
The GDPR gives you the right to access your data, have it corrected, have it erased, receive it in a readable format, object to certain processing and ask for it to be restricted.
Two of those rights are self-service in the app, with no need to write to us: exporting your data and deleting your account, in Settings > Your data.
For everything else, write to advmap@sisilab.app. We reply within one month.
If you believe we are not respecting your rights, you can complain to the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr). If you live in another EU country, you can complain to your own country's data protection authority.
Traffic between the app and our servers is encrypted. Access to your data is controlled at database level by rules that stop a user reading what is not theirs, and track files are kept in private storage.
No system is infallible. In the event of a data breach likely to create a high risk for you, we will inform you and notify the CNIL, as the law requires.
ADVMAP is for people aged 18 or over. We do not knowingly collect data about minors. If we learn that an account was created by someone under 18, it is deleted.
For any question about this policy: advmap@sisilab.app.
This text may change. The version in force is the one shown here and on advmap.sisilab.app, with its date. If a change genuinely alters what we do with your data, we will flag it in the app rather than publish it quietly.