Privacy Policy

Last updated: October 12, 2026 · SP Karlsen Invest

Unlock Earth connects to your Strava account, checks your GPS activities against municipality (or equivalent local administrative area) boundaries, and permanently records which municipalities you've covered enough distance in to "unlock."

Information we collect

From Strava, when you connect your account:

• Your Strava athlete ID, first name, last name, and profile picture.
• An access token and refresh token, used to fetch your activity data on your behalf. We request read and activity:read_all scope — we do not request permission to edit, delete, or upload anything to your Strava account.
• Your activity data: activity type (run, ride, walk, hike, etc.), date, distance, and the GPS route for each qualifying activity.

Generated by the app:

• Which municipalities you've unlocked, when, and which activity unlocked them.
• Achievement progress, computed from the above.
• If you're the first person to unlock a given municipality, that fact is visible to other users (a "World First" credit) — no other unlock or activity data is shared between users.

We do not collect your email address, password, real name beyond what Strava provides, payment information, or precise real-time location outside of GPS traces already recorded by your own Strava activities.

How we use this information

• To determine which municipalities your activities qualify you to unlock.
• To show you your own collection, progress, and achievements.
• To keep your Strava activity history in sync automatically, including while the app is closed, via scheduled background jobs.

We do not use your Strava or unlock data for advertising, and we do not sell your data to anyone.

Advertising

The app shows ads served by Google AdMob, as a banner and as an occasional clearly labelled "Ad" in your list of unlocked places. We do not request tracking permission and do not enable personalized advertising, so ads you see are non-personalized (contextual) rather than targeted using an advertising identifier or your activity across other apps. AdMob may still process technical information (such as a device or app identifier and general, non-precise location such as country) to serve and measure ads, under Google's own privacy policy: policies.google.com/privacy. Your Strava activity, GPS routes, and unlocks are never shared with AdMob or used to target ads.

Crash and performance reports

To find and fix bugs we use Sentry. When the app crashes, freezes or hits an error, it sends a report containing technical information: the app version, your device model and operating system version, a description of what went wrong (stack trace), and your Unlock Earth account identifier so we can tell how many people are affected. These reports do not contain your GPS routes, Strava tokens or the contents of your activities.

Push notifications

If you allow notifications, the app stores a push notification token for your device so we can send you messages such as a new unlock, a finished sync, or an announcement. Notifications are delivered through Expo's push notification service and, on Android, Google's Firebase Cloud Messaging. The token is used only to send you notifications and is deleted with your account. You can turn notifications off at any time in your device's settings.

Who we share this with

We do not share your personal data with third parties, except:

• Strava, to authenticate and fetch your activity data — inherent to how the app works, since you're connecting your own Strava account.
• Our infrastructure providers (currently Supabase, for database and backend hosting), who process data on our behalf under their own data processing terms.
• Google AdMob, to serve non-personalized ads, as described above.
• Sentry, which receives crash and error reports as described above.
• Expo and, on Android, Google Firebase Cloud Messaging, which deliver push notifications to your device.

We do not sell data to data brokers, advertisers, or anyone else.

Where your data is stored

Your data is stored in a Supabase-hosted database in the EU (Paris, eu-west-3 region).

How long we keep your data

Your unlocked municipalities, activities, and GPS routes are kept so your collection remains available to you. If you delete an activity on Strava, we remove the data derived from it, including the unlock it earned, automatically. If you disconnect your Strava account, we stop syncing new data but keep your existing unlocks. If you delete your account, everything is permanently removed.

Your rights

• Disconnect Strava at any time from Strava's own app settings — we detect this automatically and stop syncing.
• Delete your account at any time from Profile → Delete account inside the app. This permanently and immediately deletes your account and all associated data — every activity, GPS route, unlock, and achievement. This cannot be undone.
• If you are in the EU/UK, you have rights under GDPR to access, correct, or export your data. Contact us for any request not already covered by the in-app deletion feature.

Children

This app is not directed at children under 16.

Changes to this policy

If this policy changes in a way that affects how your data is used, we'll make that clear in the app before the change takes effect.

Contact

Questions about this policy or your data: karlsen@highorder.no