Privacy Policy

Effective date: March 12, 2026

Introduction

Terris AS ("we", "us", or "our") operates Tindelog (tindelog.com). This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Norwegian data protection legislation.

By using Tindelog, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the service.

Data We Collect

Account Information

When you create an account, we collect:

Email address (required for authentication)
Username (optional)
First name and last name (optional)
Profile photo (optional, stored as multiple size variants)
Privacy preference (Public, Users, Friends, or Private)

Authentication and Session Data

To authenticate you securely, we process:

Magic link tokens (automatically expire after 15 minutes)
Password hash (bcrypt, optional alternative to magic links)
Session data stored in our database: user ID, role, IP address, User-Agent string, and last active timestamp
A session cookie (httpOnly, sameSite=strict, secure) with a 30-day rolling expiry

GPS and Location Data

When you upload activities, we process the following location data:

Activity tracks stored as GeoJSON, simplified GeoJSON, PostGIS geometry, and Google polyline encoding
Bounding boxes for your activity routes
Timezone information associated with activities
Original GPX files stored in cloud storage

Photos

When you upload photos, we process:

Image files stored in multiple size variants (thumbnail, small, medium, large)
EXIF metadata extracted from photos, including GPS coordinates if present
You can choose to strip metadata from photos before storage
A perceptual hash generated for duplicate detection

Third-Party Integration Data

When you connect external services, we store:

Strava: OAuth tokens (encrypted with AES-256-GCM), provider user ID, mountaineer profile information, activity type filter preferences, and synced activity data including GPS tracks
Garmin (planned): Same data pattern as Strava

Social Data

When you interact with other users, we store:

Friendship relationships (requester, recipient, status)
Privacy levels you set on your profile, photos, and activities

Temporary Processing Data

Our background job system temporarily processes data for tasks such as activity imports, list refreshes, and search indexing. This data is automatically deleted upon job completion.

How We Use Your Data

Provide and maintain your account and the core service
Authenticate your identity and maintain session security
Process and display your outdoor activities and ascent records
Render activity tracks and feature locations on interactive maps
Enable social features such as friend connections, community, and activity sharing according to your privacy preferences
Synchronize data with connected third-party services at your request
Monitor and protect against unauthorized access, fraud, and abuse
Improve service reliability through error tracking and performance monitoring

Legal Basis for Processing

Under GDPR Article 6, we process your personal data based on the following legal grounds:

Performance of a Contract (Article 6(1)(b))

Processing necessary to provide the service you signed up for: account creation, activity tracking, ascent logging, list management, and all core features of Tindelog.

Consent (Article 6(1)(a))

Processing based on your explicit, freely given consent: connecting third-party integrations (Strava, Garmin), and optional analytics or diagnostics.

Legitimate Interest (Article 6(1)(f))

Processing necessary for our legitimate interests, balanced against your rights: security logging, fraud prevention, service monitoring, and abuse detection.

Third-Party Services

We share data with the following third-party services only as necessary to operate Tindelog:

Service	Purpose	Location
Postmark	Email delivery (magic link authentication emails). Receives your email address.	United States
Azure Blob Storage	Cloud file storage for photos and GPX files.	Europe (West)
Sentry (optional)	Error tracking and monitoring. May receive user ID, email address, IP address, and User-Agent when errors occur.	United States
MapBox	Map tile provider. Receives viewport interactions and map tile requests from your browser directly.	United States
OpenTelemetry / Jaeger (self-hosted)	Performance tracing for service reliability. Hosted on our own infrastructure.	Europe (self-hosted)
Strava	Activity synchronization via OAuth. Data exchanged includes activity summaries, GPS tracks, and mountaineer profile information. Optional write-back of summit information to your Strava activities.	United States
Garmin (planned)	Activity synchronization. Same data exchange pattern as Strava.	United States

For transfers outside the EU/EEA, we rely on the EU-US Data Privacy Framework and Standard Contractual Clauses as appropriate.

Data Security

We implement the following technical and organizational measures to protect your data:

OAuth tokens encrypted at rest with AES-256-GCM
Passwords hashed with bcrypt (never stored in plain text)
Session cookies configured with httpOnly, sameSite=strict, and secure flags. Sessions have a 24-hour inactivity timeout and a 90-day absolute timeout.
Sensitive fields (passwords, tokens, codes, API keys) automatically redacted from all request logs
HTTPS enforced in production for all connections
Cross-Origin Resource Sharing (CORS) restricted to the frontend domain
Security headers enforced via Helmet (Content Security Policy, HTTP Strict Transport Security, X-Frame-Options, and others)

Your Rights

Under GDPR Articles 15-22, you have the following rights regarding your personal data:

Right of Access (Article 15): Request a copy of the personal data we hold about you.
Right to Rectification (Article 16): Request correction of inaccurate or incomplete data. You can update most data directly in your profile settings.
Right to Erasure (Article 17): Request deletion of your personal data. You can delete your account from your profile settings, which permanently removes your profile, activities, and ascent records.
Right to Restriction of Processing (Article 18): Request that we limit processing of your data in certain circumstances.
Right to Data Portability (Article 20): Receive your data in a structured, commonly used format. You can export your activities as GPX, KML, or CSV files.
Right to Object (Article 21): Object to processing based on legitimate interests.
Right to Withdraw Consent: You can withdraw consent at any time (for example, by disconnecting third-party integrations) without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by GDPR.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

Data Retention

We retain your data only as long as necessary for the purposes described in this policy:

Sessions: 30-day rolling expiry, 24-hour inactivity timeout
Magic link tokens: 15 minutes
Activities and photos: Retained until you delete them or delete your account
Strava data: Deleted within 48 hours of disconnecting your Strava account
Background job data: Temporary, automatically deleted upon job completion

When you delete your account, all personal data is permanently removed from our systems. Some anonymized, aggregated data may be retained for statistical purposes.

Children's Privacy

Tindelog is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us at [email protected] and we will take steps to remove that data.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on this page and updating the effective date. We encourage you to review this page periodically.

Your continued use of Tindelog after changes to this Privacy Policy constitutes acceptance of the updated terms.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

Terris AS

[email protected]

You may also contact the Norwegian Data Protection Authority (Datatilsynet) if you have concerns about how we handle your data.