Privacy notice
Last updated 1 Jan 1980
Who is responsible
Andy Blackshaw, a sole trader, Flat 49 Hale Point, 45 Ilford Hill, Ilford IG1 2ZL, is the data controller for Fotowalk. Email: hello@fotowalk.co.uk. ICO registration: applied for.
The short version
- We collect what we need to run your account and show your walks, and nothing for advertising.
- Location data inside your photos is removed on your own device before the photo is uploaded.
- When you record a walk, the raw trace of where you went is private to you and never published.
- While you follow a walk, your position is used on your phone to show your place and notice detours. Only a label (full, part or variation) is kept; nothing of your path is saved.
- The list of walks you have walked, and when, is private unless you choose to show it, and even then visitors see only the month and year of your latest date, never how often. You can remove any date.
- When you delete something, it is gone from the site at once and from our systems within 30 days.
What we store, and why
| What | Where it comes from | Why | Lawful basis |
|---|---|---|---|
| Email address and password (stored only as a secure hash) or your Google sign-in | You, or Google if you choose "Continue with Google" | To run your account | Contract |
| Display name, handle, bio, website link, profile photo | You (your name may come from Google, and you can change it) | Shown on your profile and as the credit on your photos | Contract |
| Your camera and lens list | You | Shown on your profile and offered when you add photos | Contract |
| Walks: route line, stops, names, tips | You | Published as your walk | Contract |
| Photos, resized, with all metadata removed | You | Shown on walks | Contract |
| Photo details: camera, lens and settings line, month and time of day taken | Read from the photo on your device, or chosen by you | Shown under the photo | Contract |
| The spot each photo and stop is pinned to | You place it (we may suggest one from the photo's own data, read on your device) | To show it on the map | Contract |
| Your email address, used for notices | Your account | To tell you when someone adds photos or a tip to your walk, at most once an hour per walk, sent through Resend. Turn these off on your profile | Legitimate interests |
| Dates you walked a walk ("I walked this"); you may log the same walk on more than one date, and remove any date at any time. A walk you follow and finish in walk mode is logged with a label, "full", "part" or "variation", worked out on your phone | You | Your Completed walks list, private by default, where you see every date; if you make the list public, visitors see only the month and year of your latest date for each walk, with no count and no other dates. "Last walked" and, from 10, the number of times the walk has been logged show on the walk page, which names nobody. The label is shown only to you, never to visitors | Contract |
| Recorded walks: your device's location, with times and accuracy, while you record | Your device, only between Start and Finish | To draw your walk's line; the raw trace is kept in your account, seen only by you, for 30 days after you finish | Contract |
| Walks you save | You | Your Saved walks list, which only you can see; the walk's author sees how many people saved it, never who | Contract |
| The handle in a shared link you arrived by ("?via=") | The link | Kept with your account if you sign up straight from that link, so we know which shares bring people. Nothing is stored on your device for it; the person who shared is not told and nobody is rewarded. Included in your export | Legitimate interests |
| People you block | You | So neither of you sees the other's walks, photos or tips; they are not told. Kept until you unblock them or delete your account, and included in your export | Contract |
| Reports you send, and an email address if you give one | You | To deal with the report and reply | Legal obligation (Online Safety Act) and legitimate interests |
| Screening scores and moderation decisions | Our screening tool and our moderator | To keep the service safe and keep records | Legal obligation and legitimate interests |
| Your IP address, briefly | Your browser | To limit repeated reports and sign-in attempts; not stored with your account | Legitimate interests |
About locations
You choose how exactly each stop is shown: Exact, Approximate or Hidden.
- We store the exact point you place, so you can edit it later. It is kept in a part of the database the public cannot read.
- For Approximate stops, the public sees only the centre of a fixed 250 m square, and the route nearby is blurred to match. For Hidden stops, they see neither.
- A photo someone else adds to your stop takes your stop's setting.
- The GPS location, camera serial number and other metadata inside your original photo are read in your browser, if at all, and removed before upload. The original never leaves your device.
- "Near me" asks for your device's location only when you tap it, uses it in your browser to sort walks, and never sends it to us or stores it.
About recorded walks
When you record a walk in the app, we collect your device's location, with the time of each point (the raw trace), only while you are recording. Your phone shows that location is in use for as long as it is.
- The raw trace is private to you. When you finish, it is saved to your account, where only you can see it: not other walkers, not the public, not our moderators. If that save fails, it waits on your device and is sent the next time you open the recorder.
- It is never published. The line others see is the walk's route, drawn from it without any times, never the trace itself.
- A recorded line starts wherever you pressed Start. If you start at your front door, so does the line, so check both ends before you publish.
- If there is a gap in a recording, the points at either end of the gap are sent to OpenRouteService to draw the missing stretch along paths. Nothing else goes with them.
- It is included in your export.
- It is deleted 30 days after you finish recording, or sooner when you delete the walk or your account.
Following a walk. When you follow someone's walk on your phone ("Start this walk"), your phone uses its location to show where you are on the map and which stop is next, and to notice detours. Your position stays on your phone: it is not sent to us or to anyone, and nobody can see where you are or that you are walking. Nothing of your path is saved: the positions are used on your phone when you finish and then deleted, and are deleted at once if you discard.
- When you finish, your phone works out a label for the walk: "variation" if you left the line for one long stretch, "part" if you stopped before the last stop or skipped a section, otherwise "full". Only the label is stored with the date you walked, never the distances behind it. Only you see it on your Walked list; visitors see the walk's name and month as before.
- While you follow, your phone may keep a copy of the walk's page and photos so it still works with no signal. It is removed when you finish.
What we do not do
No advertising, no selling or sharing data for marketing, no analytics trackers, no profiling. We use only the cookies needed to keep you signed in.
Who else handles your data
We use these services to run Fotowalk. Each handles data only as needed for that job.
- Supabase: database, sign-in and photo storage.
- Resend: sends our emails (sign-in messages and notices about additions to your walks). It sees your email address and the message.
- Netlify: hosts the website.
- Google: only when you choose it. If you pick "Continue with Google", Google handles your sign-in. If you tap "See Street View" or a plus code on a desktop, Google Maps opens and sees your request as it would any visit. Nothing else on Fotowalk contacts Google from your browser: our fonts are copied into the site when it is built and served from our own domain.
- TypeSafe (Jev): receives the text of walks, tips, profiles and reports for screening. It does not receive photos.
- OpenRouteService, Photon (Komoot), OpenFreeMap, Esri: route and place lookups while you edit, the ends of any gap in a recorded walk, and map tiles while you view. Map providers see your IP address and the map area. No account details are sent.
Where any of these process data outside the UK, we rely on UK adequacy regulations or standard contract clauses.
How long we keep it
- Things you delete (a photo, tip, walk or your account) leave the site at once and are removed from our systems within 30 days.
- Recorded walks' raw traces are deleted 30 days after you finish recording, or at once when you delete the walk or your account. The walk itself, and its line without times, stay until you delete them.
- Contributions to a walk its author deletes stay in your export for 30 days, then are deleted.
- Reports, complaints and moderation records are kept for 12 months, then deleted, so we can review our safety measures. Where a report is about you, the reporter's details are never shown to you.
- Account details are kept while your account is open.
Your rights
You can ask us to:
- give you a copy of your data (most of it is in your export already);
- correct it;
- delete it;
- restrict or object to how we use it;
- move it to another service (your export, in standard formats).
Email hello@fotowalk.co.uk. We reply within one month. It is free.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
You must be 16 or over to have an account. Anyone of any age can read walks without an account, and we collect nothing about readers beyond what is listed above. If you think a child has given us data, email us and we will delete it.
Changes
We will post any change here and, if it changes how we use your photos or locations, tell you before it takes effect.