Privacy policy
This page explains what data gpxpath.com processes, why, with whom, and how to exercise your rights. Last updated: 28 October 2026.
Data controller
GPX Path, published by Charles Neveu, sole proprietor (SIREN 923 555 346), rue de Chabrol, 75010 Paris, France. Contact: contact@gpxpath.com.
Your files stay on your device
Files you open in the tools (viewer, converters, editor) are read by your browser. They are not sent to any server and nothing is kept once you close the page. The site asks for no account and no password.
To show a map or work out a route, your browser calls third-party services (see “Third-party services”): they receive the area on screen or the coordinates of the points involved, never the content of your file.
Mac app waitlist
Data: your email address, the date you signed up, where on the site you did it (home page, Mac page or footer), the site language and proof of your consent (the ticked box, then your confirmation through the link we email you). Nothing else: no name, no phone number. When you open our emails or click their links, Klaviyo may record it to measure delivery.
Purpose: to let you know when GPX Path for Mac is released, send you the launch price reserved for the waitlist (€14.99 for the first year instead of €24.99 a year) and, now and then, news about the app. Your address is never sold or rented.
Legal basis: your consent (Article 6(1)(a) GDPR), given by ticking the box on the form and confirmed by email. You can withdraw it at any time, without giving a reason.
Retention: for as long as you stay subscribed, and no longer than 3 years after your last interaction with our emails (open or click). If you unsubscribe, your address is removed from the list; it may be kept on a suppression list, solely so that we never email you again.
Downloading a track with your email address
On track pages, your email address unlocks the GPX file straight away. Two cases:
Box “I also want to receive…” ticked: your address joins the “GPX downloads” list (new tracks and GPX Path offers), after confirmation by email. Legal basis: your consent, which you can withdraw at any time through the unsubscribe link. Retention: as for the waitlist above.
Box not ticked: you join no list and receive no marketing email. Only a “GPX downloaded” event is recorded with your address: the track, its region and the site language. Purpose: knowing which tracks are downloaded. Legal basis: GPX Path’s legitimate interest in knowing how its tracks are used. Retention: 3 years after your last download.
Who receives email addresses
Addresses are hosted by Klaviyo, Inc., an email service provider acting as our processor and on our instructions (data processing agreement). Klaviyo is based in the United States and takes part in the EU-US Data Privacy Framework, which covers the transfer of your data outside the European Union. There are no other recipients.
Third-party services
Your browser calls the following services directly. Like any request on the internet, each receives your IP address and your browser’s technical details (type, language, referring page); the list says what else it receives and why.
- Cloudflare (hosting)
Serves the site’s pages, images and files. Receives your IP address and the page requested, to deliver the site and protect it from abuse. Cloudflare, Inc., United States, a Data Privacy Framework participant.
- OpenTopoMap (topographic base map)
Provides the images of the default map in the tools and the editor. Receives the area on screen (map tile coordinates). A volunteer service based in Germany, with no published privacy policy.
- IGN, Géoplateforme (maps and elevation)
Provides the IGN map, aerial photos and IGN layers when you pick them, and elevation in France for straight lines and files imported without elevation. Receives the area on screen and, for elevation, the coordinates of the points involved. French national mapping agency (IGN), France.
- OpenStreetMap (base map)
Provides the “OpenStreetMap” base map in the editor and the map in the Mac app demo. Receives the area on screen. OpenStreetMap Foundation, data stored in the United Kingdom and the Netherlands.
- BRouter, brouter.de (route calculation)
Works out the line between your points in the editor. Receives the coordinates of the points of each section and the mode you chose. According to its policy, this information and your IP address are kept for 2 weeks, then 10 more days in the host’s backups. Server funded by the FOSSGIS association, Germany.
- Terrain Tiles, AWS Open Data (elevation outside France)
Provides elevation outside France for straight lines and files imported without elevation. Receives the area involved (elevation tile coordinates), never your exact points. A Mapzen dataset hosted by Amazon Web Services in the United States, a Data Privacy Framework participant.
- Photon, komoot (place search)
Suggests places when you type in a search field (home page, editor). Receives the text you type, from 3 characters, and the site language. komoot GmbH, Germany.
- Klaviyo (emails)
Receives your email address when you give it in a form (waitlist, track download), with the information described above. Klaviyo, Inc., United States, a Data Privacy Framework participant.
- YouTube (GPX guide videos)
Only when you click a video on the “How to use a GPX file” page. Before the click, the page only shows a thumbnail served by gpxpath.com: no request to YouTube, no cookie. On click, your browser loads the player in privacy-enhanced mode (youtube-nocookie.com), which receives the page address, your IP address and browser details; according to Google, this mode does not use the view to personalise advertising outside our site. Google LLC, United States, a Data Privacy Framework participant.
- Google Analytics 4 (audience measurement)
Only after you agree in the banner. Receives the page address, your IP address (which Google does not keep for visitors in the European Union), browser details and the actions listed under “Cookies and audience measurement”. Google Ireland Limited; Google LLC, United States, a Data Privacy Framework participant.
Google privacy policy · How Google uses data from partner sites
Your rights
You can ask to access, correct, erase or port your data, restrict its processing or object to it, by writing to contact@gpxpath.com. We reply within one month. If you believe your rights have not been respected, you can lodge a complaint with your data protection authority (in France, the CNIL).
Every email includes an unsubscribe link that takes effect immediately. Map and data credits are in the legal notice.