Trophio Privacy Policy
Effective 12 November 2026 · Version 1.2
- Your activities, map and trophies are stored on your phone. You choose who else can see them: everyone, your friends & groups, or only you.
- Your exact GPS routes stay private unless you turn on Show routes on activities.
- We never sell your data, show ads or track you across other apps.
- Data from Apple Health is used only to give you Trophio's features, never for advertising.
- You can delete single activities, or your whole account and its online data, inside the app (Profile → Settings).
1. Who we are
Trophio is an independent app from Estonia (European Union), developed and run by Mikk Eeskivi (“we”, “us”). We are responsible for your personal data as the controller under the EU General Data Protection Regulation (GDPR).
Questions or requests about your data: mikk.eeskivi@gmail.com
2. What data we collect and why
Location
With your permission, Trophio uses your phone's location to record activities, clear the fog on your exploration map, unlock counties and regions, and find interesting places near you. While you record an activity, Trophio can keep recording with the screen locked. Trophio does not track your location when you are not using the app or recording.
Recorded routes are saved on your phone. What goes online is described in section 3.
Apple Health
If you allow it, Trophio reads your workouts and their GPS routes from Apple Health (for example from Apple Watch, Garmin or Polar) and turns them into Trophio activities. Trophio only reads; it never writes to Apple Health.
Workout data can count as health data, a special category under the GDPR, so we only read it with your explicit permission, which you give in Apple's Health permission screen and can change at any time in the iPhone's Settings → Health → Data Access.
Data from Apple Health is never used for advertising or marketing, never sold, and never shared with third parties except the hosting provider that stores your backup and leaderboard results for us (section 4).
Strava
If you connect Strava, Trophio reads your Strava activities (type, distance, time and route) to bring them into the app. Your Strava sign-in is kept securely in your phone's Keychain. The secret that connects Trophio to Strava is held on our server, not in the app. You can disconnect Strava at any time in Profile → Devices, which also revokes Trophio's access.
Activities imported from Strava count for your own map, trophies and XP, but they are not shown to other players on leaderboards.
Your account
Trophio creates an anonymous account automatically so your results can appear on leaderboards. If you choose Sign in with Apple, we receive only an anonymous identifier from Apple. We do not request your name or email address.
Your profile
Your username, level, XP and profile colour are visible to all players, so leaderboards and friend search work. Your profile photo, bio, home region, favourite activity and showcased trophies are visible to the people you choose in Profile → Settings → Who can see. Only add what you are comfortable sharing.
Friends, groups and comments
You can add friends with their friend code or username, create groups and invite friends to them, and comment on activities. We store your friend list, friend requests, group names and memberships, and your comments. Comments are visible to everyone who can see the activity they were written on. You can delete your own comments, and comments on your own activities, at any time.
Body weight, year of birth and sex
If you enter your body weight, it is used only to estimate calories. If you enter your year of birth and sex, they are used only to adjust running time grades for your age group. All three stay on your phone: they are never uploaded, not even in your backup, and never shown to anyone.
Backups
If you sign in with Apple, Trophio stores a private, compressed backup of your progress (activities including routes, explored map, trophies and visited places) on our server, so you can restore it on a new phone. Only your account can read your backup.
3. What other players can see
In Profile → Settings → Who can see you choose, for each of the following, whether everyone, your friends & groups (your friends and members of groups you have joined) or only you can see it:
- Profile: photo, bio, home region, favourite activity and showcased trophies (default: everyone)
- Activity log: your activities (type, distance, time, county/region, date) and their comments (default: friends & groups)
- Trophies: your trophies and when you earned them (default: everyone)
- Where you've been: your explored map, as map squares of about 150 m (default: friends & groups)
| Always visible to all players | Never shared |
|---|---|
| Username, level, XP and friend code If Appear on leaderboards is on: best times and longest activities, with the county/region and date |
Anything imported from Strava (it counts only for you) Your backup Your body weight, year of birth and sex Your Strava and Apple Health sign-ins |
Exact GPS routes are only shown if you turn on Show routes on activities, and then only to people who can see your activity log. With Hide start & end of routes (on by default), about 200 m at each end of every route, and the matching squares of your explored map, are left out so your home is not revealed.
4. Services we use
| Service | What for | Data involved |
|---|---|---|
| Supabase EU (Ireland) | Accounts, leaderboards, backups, shared map-places cache | Account identifier, the profile, results, explored map, friends, groups and comments described in sections 2–3, your private backup, and map areas (no personal data in the places cache) |
| Mapbox USA | Showing the map | Map requests for the area you view, your device's IP address and technical device information. Mapbox also collects usage data (which can include location while the map is open) unless you turn it off with the ⓘ button on the map → Mapbox Telemetry. |
| OpenStreetMap / Overpass | Finding waterfalls, viewpoints, castles and other places | The map area being searched (not who is searching) |
| Apple | Sign in with Apple, Apple Health, and Apple Maps place search as a fallback | As described above. Apple handles this data under its own privacy policy. |
| Strava USA | Importing your activities, only if you connect it | Your Strava sign-in and activities |
When data is transferred outside the EU (for example to Mapbox or Strava in the USA), it is protected by the safeguards these companies provide, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
Trophio contains no advertising, no analytics or tracking tools, and we do not sell personal data.
5. Legal bases (GDPR)
- Consent (Art. 6(1)(a)): location, Strava, sharing exact routes and what you choose to show others. You can withdraw consent at any time in the app or in your iPhone's Settings.
- Explicit consent (Art. 9(2)(a)): reading workouts from Apple Health.
- Contract (Art. 6(1)(b)): providing the features you use, such as recording, trophies, backups and leaderboards.
- Legitimate interest (Art. 6(1)(f)): fair-play checks and keeping the service secure.
Automated fair-play checks. Trophio automatically flags activities with unrealistic speeds (for example recorded in a car). A flagged activity is saved but earns no rewards and doesn't appear on leaderboards. This has no legal or similarly significant effect on you; if you think an activity was flagged by mistake, contact us.
6. How long we keep data
- Data on your phone stays until you delete it or remove the app.
- Online results and your backup are kept while you have an account. Deleting an activity in the app removes it from the leaderboards too.
- When you delete your account (Profile → Settings → Delete account), your profile, results, trophies, explored map, friends, group memberships, groups you own, comments, photo and backup are deleted from our server straight away.
- Removing the app without deleting your account leaves your online results and backup in place, so you can restore them later. To have them deleted, delete your account first or contact us.
- Cached map places are kept for up to 30 days.
7. Your rights
You have the right to access, correct, delete and export (receive a copy of) your personal data, to object to or restrict its processing, and to withdraw consent at any time. You can delete your data yourself in the app; for anything else, contact us at the address in section 1 and we will reply within one month. You can also lodge a complaint with a data protection authority. In Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).
8. Security
Data is sent over encrypted connections (HTTPS) and stored encrypted on our hosting provider's servers in the EU. Database rules ensure each player can only change their own data, and backups can only be read by their owner. Sign-in tokens are stored in your phone's secure Keychain or app storage.
9. Children
Trophio is not intended for children under 13. If you believe a child under 13 has given us personal data, please contact us and we will delete it.
10. Changes
If we change this policy, we will update the date at the top and, for important changes, let you know in the app.
11. Contact
Trophio · Mikk Eeskivi, Estonia · mikk.eeskivi@gmail.com