How EnduroMate handles your data. Last updated: 9 June 2026.
EnduroMate ("we", "us") is a navigation and safety app for off-road riders, operated from Thessaloniki, Greece. This policy explains what data the app collects, why, how it's stored, and the choices you have. We are the data controller for the purposes of the EU GDPR.
EnduroMate works without an account. Recording rides, viewing routes, offline maps, navigation cues and Emergency SOS all function with everything kept only on your device. You only share data with our servers if you choose to create an account and enable cloud sync.
With your permission, the app collects precise GPS location to record your route, show your position on the map, provide turn/hazard cues, and include your location in an Emergency SOS message. Location is collected in the background (via a foreground service with a persistent notification) only while you are actively recording or navigating. Recorded tracks are stored on your device; they are uploaded to your account only if you enable cloud sync.
If you create an account, we process your email address (email/password sign-in) or the name, email and profile photo released by Google or Facebook sign-in. Authentication is handled by Google Firebase Authentication.
When cloud sync is on, your routes (GPS geometry, elevation, distance/speed statistics) and any navigation cues you add are stored in your account so they sync across your devices. Geometry is compressed and stored as an encrypted object; summaries and cues are stored in our database.
You can choose to share a route as a public link. When you do, a snapshot of that route (its GPS path up to the moment you shared it, plus its name, date and statistics) is published to a web page that anyone who has the link can open — no account or app required. The link is unguessable, but it is not otherwise access-controlled: treat it like a secret, and only send it to people you trust. Each shared link stops working automatically after 24 hours, and you can stop sharing at any time from the route screen, which removes the public page immediately. Sharing is always opt-in — nothing is made public unless you tap Share.
For the SOS feature you may save emergency contacts (name and phone number), a rider name, and an alert audio file. This information is stored only on your device and is never uploaded to our servers. When you trigger SOS, the app uses your device to send an SMS containing a link to your current location (and, if you enable it, your battery level and basic telemetry) to the contacts you chose, and — after a countdown — to place a phone call to your first contact. These messages and calls go directly from your phone to your contacts; we do not see or receive them.
If your phone has an internet connection when you trigger SOS, the alert SMS may also include a public link to the route you have travelled so far, so your contacts can see the path you took, not just your last position. This link follows the same rules as a shared route above: it is unguessable and expires after 24 hours.
The app requests the SMS and Phone permissions solely for this Emergency SOS feature. They are not used for any other purpose, and not for advertising or analytics.
Map imagery comes from OpenStreetMap. When maps load or you download offline map packs, your device's IP address is visible to the OpenStreetMap tile servers, as with any web request.
Synced account data is processed by Google Cloud / Firebase on our behalf and stored in the
European Union (Firestore and Cloud Storage in the europe-west1 region; the backend
runs on Google Cloud Run). Data is encrypted in transit (HTTPS) and at rest by the underlying
Google Cloud services. On-device data is protected by Android's app sandbox, and cloud backup /
device-transfer of the app's data is disabled.
Synced data is retained until you delete it or delete your account. On-device data remains until you remove it in the app or uninstall EnduroMate. Publicly shared route snapshots are deleted automatically within 24 hours (sooner if you stop sharing), and are removed along with everything else if you delete your account.
You can permanently delete your account and all synced data at any time from Profile → Delete account in the app, or by request. See Delete your account & data for full details.
Under the GDPR you have the right to access, correct, export, restrict, or delete your personal data, and to object to processing. The simplest route for access and deletion is the in-app account-deletion flow above; for anything else, get in touch through our contact form and we'll respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
EnduroMate is intended for adult off-road riders and is not directed to children under 16. We do not knowingly collect data from children.
We may update this policy as the app evolves. Material changes will be reflected here with a new "last updated" date.
EnduroMate