Privacy Policy
Junlab (“we”, “us”) operates Trazo (https://trazo.runvia.app, the “Service”), a running and cycling route planner. This policy explains what personal data we process, why, how long we keep it, who we share it with, and how you can exercise your rights. We comply with the Personal Information Protection Act of the Republic of Korea and, where applicable, the EU/UK General Data Protection Regulation (GDPR).
Effective date: November 9, 2026 (previous version: October 20, 2026). The Korean version is available at /privacy/; if the two versions differ, the Korean version prevails to the extent permitted by law.
1. Data we process and why
Planning routes, routing, exporting files and browsing shared or community courses work without an account. If you do not sign in, we only process the automatically generated data listed below.
| Category | Data | Purpose |
|---|---|---|
| Google sign-in (optional) | Google account identifier (Firebase UID). Your email, name and profile photo are kept by Google (Firebase Authentication); our servers do not store them and only display them in your account menu. | Identifying your account, saving your courses |
| Content you create | Nickname, course titles, descriptions, routes and waypoint coordinates, sport, visibility, folder names, comments, likes and saved-course records, creation and update times | Saving and sharing courses, community features |
| AI assistant connection (optional) | Name and redirect address of the AI service you connect (client information), access and refresh tokens (stored only as hashes), connection and refresh times | Letting an AI assistant you connect (such as ChatGPT or Claude) read your courses; managing connections |
| Garmin Connect integration (optional, when offered) | See section 6 | Importing Garmin activities; sending Trazo courses to Garmin devices |
| Automatically generated data | IP address, browser and device information (User-Agent), access time, requested URL, error logs | Operating and securing the Service, troubleshooting |
| Analytics | See section 8 | Understanding usage and improving the Service |
When you press “my location”, your browser provides your current position only to move the map; it is not sent to or stored on our servers. Points sent for routing are used only to compute the route and are not kept unless you save the course. Display settings are stored only in your browser (localStorage).
To show area names for courses (for example, “Yeouido-dong, Yeongdeungpo-gu, Seoul”), we send the coordinates of a few points along a course to the Kakao Local API. No information that identifies you is sent with them.
Legal bases (GDPR). Performance of the service you request (account, courses, connections you set up), our legitimate interests (security, cookie-free analytics, operating the Service), and your consent (Google Analytics, AI assistant and Garmin connections, which you can withdraw at any time).
2. Retention
- Account data and content you create: until you ask us to delete it. Courses you delete in the app are hidden immediately; to erase them from our servers completely, contact us.
- AI assistant connection data: until you disconnect in the Connection Center or ask us to delete your data. Access tokens expire after 1 hour and refresh tokens after 60 days of non-use.
- Garmin Connect integration data: until you disconnect or ask us to delete it. When you disconnect, we delete your Garmin tokens immediately; imported activities are deleted when you choose to delete them or ask us to.
- Server access logs: deleted once no longer needed for operations and security, according to our log rotation.
- runvia analytics raw records: 720 days.
- Google Analytics data: 2 months.
Where another law requires us to keep data for longer, we keep it for that period only.
3. Deletion
When the retention period ends or the purpose is fulfilled, we delete personal data without delay. Electronic files are deleted in a way that cannot be recovered.
4. Sharing with third parties
We do not sell your personal data and do not share it with third parties, except:
- AI assistants you connect. If you connect Trazo to an AI service such as ChatGPT (OpenAI) or Claude (Anthropic) and approve access, that service can read, at your request, your courses (including private and link-shared ones), folder names and public course information. We never provide your email address or your like and comment history. Data sent to the AI service is processed under that service’s privacy policy. You can disconnect at any time in the Connection Center.
- Garmin Connect, if you connect it. We send the courses you choose to your Garmin Connect account.
- Legal requirements. When required by law, for example at the request of investigative authorities.
Courses you set to “link sharing” or “public”, together with your nickname, and comments on public courses, are visible to others within the scope you choose.
5. Service providers and international transfers
We use the following providers to run the Service. Your data may be transferred outside your country when you access the Service or use the relevant feature.
| Provider (country) | Data | Purpose | Retention |
|---|---|---|---|
| Google LLC (USA) Firebase Authentication | Google account identifier, email, name, profile photo, sign-in records | Google sign-in | Until account deletion |
| Google LLC (USA) Google Analytics | Cookie identifier, pages visited, device and browser information, approximate location derived from IP | Analytics | 2 months |
| Cloudflare, Inc. (USA) | IP address, request information | HTTPS delivery and security | Per Cloudflare’s policy |
| Kakao Corp. (South Korea) | IP address, map requests, coordinates of points along courses (without identifying information) | Maps, area names for coordinates, place search | Per Kakao’s policy |
| Garmin Ltd. and affiliates (Switzerland, USA) Garmin Connect (when offered) | Garmin user identifier, integration tokens, courses you send, activities you agree to import | Course and activity integration with your Garmin account and devices | Until you disconnect |
6. Garmin Connect integration
Trazo may offer integration with Garmin Connect through the Garmin Connect Developer Program. The integration happens only if you choose to connect, and we process only the data you authorize on Garmin’s sign-in and consent screen (OAuth).
| Data | Details | Purpose |
|---|---|---|
| Connection data | Garmin user identifier, access and refresh tokens, granted permissions, connection time | Maintaining and ending the connection |
| Activities | Sport type, start time and time zone, duration, distance, speed or pace, GPS track, elevation, laps, and—if recorded by your device—heart rate, cadence and power, device name | Showing your activities and routes in Trazo, turning an activity track into a course, comparing planned courses with actual activities |
| Courses | Name, route, elevation and course points of the Trazo courses you choose to send | Sending courses to Garmin Connect and compatible devices |
- We use data received from Garmin only for the purposes above. We do not sell it or use it for advertising.
- Imported activities are private by default and are never shown to other people unless you choose to share them.
- You can disconnect at any time in Trazo or in the connected apps settings of Garmin Connect. When you disconnect, we delete your Garmin tokens immediately and stop receiving new data; imported activities are deleted without delay when you ask us to.
- Data processed by Garmin is governed by the Garmin Privacy Policy.
7. Your rights
You may request access to, correction, deletion, restriction or portability of your personal data, object to processing, or withdraw consent at any time. You can edit or delete your nickname and courses directly in the app; to delete your account and all data, email us at the address below. We respond within 10 days of receiving your request (and in any case within the period required by applicable law). You also have the right to lodge a complaint with your local data protection authority.
The Service is not directed to children under 14. If we learn that we hold personal data of a child under 14, we delete it without delay.
8. Analytics and how to opt out
We use the two analytics tools below to understand usage and improve the Service. We do not use them for advertising or personalized ads.
runvia analytics (no cookies)
A self-hosted analytics tool (runvia.app). It records pages visited, referrer, menus and buttons used, time on page, country, device and browser, screen size, JavaScript errors and the preceding interactions. It sets no cookies and distinguishes visitors only per day using a hash of the date, IP address and browser.
Google Analytics 4 (uses cookies)
Google Analytics stores cookies starting with _ga and collects pages visited, visit time and duration, referrer, device and browser information, and approximate location derived from your IP address. We remove shared-course link tokens and course titles before sending data, and we do not use Google signals or advertising features. Visitors whose browser time zone is in Europe see a consent banner, and Google Analytics does not load until they accept.
Google Analytics setting — Checking this browser’s setting…
If you decline, Google Analytics is not loaded in this browser and existing GA cookies are removed. A Global Privacy Control (GPC) signal is also treated as declining. You can also block cookies in your browser or install the Google Analytics Opt-out Browser Add-on.
9. Security
All traffic is encrypted with HTTPS. Signed-in requests are processed only after we verify the signature and expiry of the Google sign-in token. AI assistant connection tokens are stored only as hashes and grant read-only access. The database cannot be reached directly from outside, and access to personal data is limited to the operator.
10. Contact
- Data protection officer: Junlab Privacy Officer
- Email: [email protected]
11. Changes to this policy
If we change this policy, we will announce the change on this page before it takes effect.