How EnduroMate handles your data. Last updated: 26 September 2026.
EnduroMate ("we", "us") is a navigation and safety app for off-road riders, operated from Thessaloniki, Greece. This policy explains what data the app collects, why, how it's stored, and the choices you have. We are the data controller for the purposes of the EU GDPR.
The data controller responsible for your personal data under the EU GDPR is:
ARCHITEKTONIKI EFARMOGON DIKTYOU L.P.
28 October 7, Thessaloniki, 55236, Greece
ΓΕΜΗ 173024306000 · VAT EL802252526
support@enduromate.eu
EnduroMate works without an account. Recording rides, viewing routes, offline maps, navigation cues and Emergency SOS all function with everything kept only on your device. You only share data with our servers if you choose to create an account and enable cloud sync.
With your permission, the app collects precise GPS location to record your route, show your position on the map, provide turn/hazard cues, and include your location in an Emergency SOS message. Location is collected in the background (via a foreground service with a persistent notification) only while you are actively recording or navigating. Recorded tracks are stored on your device; they are uploaded to your account only if you enable cloud sync.
If you create an account, we process your email address and your phone number. Both must be verified — we send a confirmation link to your email address and a one-time code by SMS to your phone — and both are then stored on our servers against your account. Verification is what unlocks the cloud features (sync, route sharing, teams and live follow-me): it protects them from abuse, because a verified phone makes throwaway accounts costly to create. Your phone number is never used for marketing. If you sign in with Google we also receive the name and profile photo that account releases. If you sign in with Apple we receive your name (the first time only) and an email address — your own, or a private relay address from Apple if you choose “Hide My Email”. Authentication and SMS verification are handled by Google Firebase Authentication.
When cloud sync is on, your routes (GPS geometry, elevation, distance/speed statistics) and any navigation cues you add are stored in your account so they sync across your devices. Geometry is compressed and stored as an encrypted object; summaries and cues are stored in our database.
You can choose to share a route as a public link. When you do, a snapshot of that route (its GPS path up to the moment you shared it, plus its name, date and statistics) is published to a web page that anyone who has the link can open — no account or app required. The link is unguessable, but it is not otherwise access-controlled: treat it like a secret, and only send it to people you trust. Each shared link stops working automatically after 24 hours, and you can stop sharing at any time from the route screen, which removes the public page immediately. Sharing is always opt-in — nothing is made public unless you tap Share.
If you create or join a team, we store the team name, who its members are, and the display name you choose for yourself in that team — which the other members can see. To invite someone, a team admin types their email address or phone number, and we store that contact detail so the invitation can be matched to the right person when they sign in. This means we may hold a contact detail for someone who does not yet have an EnduroMate account, given to us by the person inviting them; it is used for nothing but delivering that invitation. A pending invitation is removed once it is accepted or declined, and everything belonging to a team is removed when the team is deleted.
You can choose to broadcast your position live while you ride. When you start a broadcast, your current location — updated as you move — is published to a web page that anyone who has the link can open, with no account or app required. The page also shows a broadcast name so watchers know whose ride they are following. You choose it in the app under Profile → Live follow me; leave it empty and a generic label is shown instead. Your phone number and email address are never published. Broadcasting is always opt-in, runs only while you keep it running, and the session and the positions stored for it expire automatically. As with a shared route, the link is unguessable but is not otherwise access-controlled — only send it to people you trust.
For the SOS feature you may save an emergency contact (a name and a phone number) and a rider name. This information is stored only on your device and is never uploaded to our servers. When you trigger SOS, the app uses your device to send an SMS containing a link to your current location (and, if you enable it, your battery level and basic telemetry) to that contact, and — after a countdown — to place a phone call to them. These messages and calls go directly from your phone to your contact; we do not see or receive them.
If your phone has an internet connection when you trigger SOS, the alert SMS may also include a public link to the route you have travelled so far, so your contacts can see the path you took, not just your last position. This link follows the same rules as a shared route above: it is unguessable and expires after 24 hours.
The app requests the SMS and Phone permissions solely for this Emergency SOS feature. They are not used for any other purpose, and not for advertising or analytics.
Map imagery comes from OpenStreetMap. When maps load or you download offline map packs, your device's IP address is visible to the OpenStreetMap tile servers, as with any web request.
The app includes Firebase Crashlytics. When the app crashes, or hits an error we watch for (a failed sync, for example), it sends us a report containing diagnostic information: what the error was, where in the app it happened, and basic device and app-version details. We use these reports only to find and fix faults — never for advertising, and never to study how you use the app. Crash reporting is always on: it is how problems reach us and get fixed.
Synced account data is processed by Google Cloud / Firebase on our behalf and stored in the European Union (Firestore and Cloud Storage in the europe-west1 region; the backend runs on Google Cloud Run). Data is encrypted in transit (HTTPS) and at rest by the underlying Google Cloud services. On-device data is protected by Android's app sandbox, and cloud backup / device-transfer of the app's data is disabled.
Synced data is retained until you delete it or delete your account. On-device data remains until you remove it in the app or uninstall EnduroMate. Publicly shared route snapshots are deleted automatically within 24 hours (sooner if you stop sharing), and are removed along with everything else if you delete your account.
You can permanently delete your account and all synced data at any time from Profile → Delete account in the app, or by request. See Delete your account & data for full details.
Under the GDPR you have the right to access, correct, export, restrict, or delete your personal data, and to object to processing. The simplest route for access and deletion is the in-app account-deletion flow above; for anything else, get in touch through our contact form and we'll respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
EnduroMate is intended for adult off-road riders and is not directed to children under 18. We do not knowingly collect data from children.
This Privacy Policy is drafted in English and Greek. Any translation into another language is provided for convenience only; in case of discrepancy, the English version prevails. This does not limit your rights under data-protection law.
We may update this policy as the app evolves. Material changes will be reflected here with a new "last updated" date.
EnduroMate