Last updated: July 3, 2026
This Privacy Policy explains how Flatpath (“Flatpath,” “we,” “us,” or “our”) collects, uses, and shares information when you use the Flatpath mobile application and related services (the “Service”). By using the Service, you agree to this Policy.
When you create an account, we collect your email address and, where provided, your name. You can sign up with email and password, Sign in with Apple, or Sign in with Google. If you use Sign in with Apple, Apple may provide a private relay email address instead of your real one. Authentication is handled by Google Firebase Authentication.
With your permission, we access your device’s precise location to find flat routes near you and to provide turn-by-turn navigation along a selected route. We request location access only while the app is in use (foreground). We do not track your location in the background, and we do not sell your location data. You can grant or revoke location access at any time in your device Settings; without it, you can still search by typing an address.
When you search for routes, we process the starting location (an address you enter, a point you tap on the map, or your current location) and your chosen distance to generate routes. We store a per-day search count associated with your account to enforce free-tier limits. Your saved routes, route history, and recent searches are stored locally on your device and are not uploaded to our servers.
Premium subscriptions are sold through the Apple App Store and managed via RevenueCat. We receive your subscription status (for example, whether you have an active subscription or trial). We do not receive or store your payment card details — those are handled by Apple.
Our providers may collect limited technical information necessary to deliver the Service, such as device and app identifiers, IP address, and diagnostic data (for example, to render maps or process purchases).
Where the GDPR or UK GDPR applies, we process personal data on the following bases: performance of our contract with you (providing the Service and your account); your consent (device location access, which you can withdraw at any time); our legitimate interests (securing and improving the Service); and compliance with legal obligations.
We do not sell your personal information. We share information with the service providers below strictly to operate the Service:
| Provider | Purpose |
|---|---|
| Google Firebase (Authentication, Firestore) & Google Cloud | Account sign-in, storing your account record, and hosting our backend |
| Mapbox | Map display and geocoding (turning addresses/coordinates into places) |
| openrouteservice | Generating walking routes from a starting point |
| RevenueCat & Apple | Processing and managing subscriptions and purchases |
| Google Sign-In / Sign in with Apple | Optional third-party sign-in you choose to use |
| Resend | Sending transactional emails (e.g., verification) |
These providers process data under their own privacy policies. We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a business transfer.
We keep your account information for as long as your account is active. When you delete your account (see Section 7), we delete your account record and authentication credentials from our systems. Data held by third-party providers (for example, Apple’s record of your purchases) is retained under their own policies. Route history and saved routes stored on your device are removed when you delete your account within the app or delete the app.
Your precise location is used only while the app is open and only to (a) center the map and find routes near you, and (b) follow your position during navigation. To generate routes, a starting coordinate is sent to Mapbox and openrouteservice. We do not build advertising profiles from your location and we do not share it for advertising.
To exercise any of these rights, email us at support@flat-path.com.
Flatpath is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.
We use industry-standard measures such as encrypted connections (HTTPS) and reputable infrastructure providers to protect your information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
We and our providers may process your information in countries other than where you live, including the United States. Where required, we rely on appropriate safeguards for such transfers.
We may update this Policy from time to time. We will change the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance.
Questions about this Policy or your data? Email support@flat-path.com.
This document is provided as a starting point and is not legal advice. Please have it reviewed by a qualified professional for your jurisdiction, and fill in the governing-law and legal-entity details before publishing.