Compath
Get the app

Version française

Privacy Policy

Compath and PL8 by Compath

Last updated: November 2026

1. Data controller

The Compath (outdoor routes and activities) and PL8 by Compath (gym workout tracking) apps are a personal project. They share the same account: an account created in one also works in the other. Unless stated otherwise, this policy applies to both apps; what is specific to PL8 by Compath is described in section 9. For any question about your personal data, you can contact us at: contact@compath.store.

2. Data we collect

We collect the following data:

  • Account data: name, email address, password (hashed)
  • Location data: GPS tracks recorded during your activities, real-time position while location sharing is on
  • Activity data: completed routes, duration, distance, elevation gain
  • Photos: images you choose to add to routes
  • Preferences: language, theme, map display settings
  • Apple Health workouts (iOS, optional): with your explicit permission, activity type, date, duration, distance and GPS track of the workouts you choose to import (see section 6)
  • PL8 by Compath workouts: strength training sessions (exercises, sets, reps, weights, durations, notes), routines and folders (see section 9)
  • COROS, Suunto or Garmin connection (optional): if you connect your watch, an account identifier at the manufacturer and technical access tokens that allow Compath to send routes to that account, and, for Garmin and COROS only if you import them, the activities you record with your watch (see section 7)

3. Purposes of processing

Your data is used to:

  • Create and manage your user account
  • Record and display your sports activities
  • Suggest routes near you
  • Allow real-time location sharing with the people you choose
  • Display time rankings on routes
  • Send a route to your connected watch, at your request
  • Import, if you enable it, the activities recorded with your Garmin watch
  • Back up your PL8 by Compath sessions and routines and restore them on a new phone

4. Legal basis

The processing of your data is based on your consent (account creation, location sharing) and on the performance of the service (recording activities, displaying routes).

5. Data sharing

Your data is neither sold nor shared with third parties for commercial purposes. Our only processors are:

  • OVH (hosting of the database and web application, EU)
  • Resend (sending transactional emails)
  • Google Firebase (sending push notifications to your phone)
  • Google Gemini (writing descriptions of public routes, see section 8)
  • COROS (only if you connect your COROS account, for the routes you choose to send and the activities you choose to import, see section 7)
  • Suunto (only if you connect your Suunto account, and only for the routes you choose to send, see section 7)
  • Garmin (only if you connect your Garmin account, for the routes you choose to send and the activities you choose to import, see section 7)

Data coming from your watch (COROS, Suunto, Garmin) is processed only by OVH, our hosting provider. It is not passed on to any other provider, nor to any artificial intelligence service.

Reports (Suricate ® system): when you report a problem encountered on a route (damaged trail, waymarking, etc.), your report is passed on to the Suricate system.

Under the partnership with Suricate, your report is passed on to the network of Suricate administrators so that they can handle it and work towards a resolution. The information concerning you is intended for the Pôle ressources national transition écologique et sports de nature, owner of Suricate, which undertakes not to disclose this information to third parties. You have a right of access, modification, rectification and deletion of the data concerning you (art. 34 of the French « Informatique et Libertés » law). To exercise it, contact the Pôle ressources national transition écologique et sports de nature, CREPS Rhône-Alpes, BP38, 07150 Vallon Pont d'Arc, France. For more information about the Suricate system, visit sentinelles.sportsdenature.fr.

6. Apple Health (HealthKit)

On iOS, Compath can read workouts recorded in Apple Health (HealthKit) so that you can import them as activities in the app.

  • Data read: activity type (running, hiking, cycling, etc.), date and duration, total distance and GPS track of the route. No other Apple Health data is read (heart rate, sleep, medical data, etc.).
  • Consent: access is requested through the standard iOS dialog the first time you open the import screen. You can grant or deny each permission individually. The app remains fully functional if you decline.
  • Storage: only the workouts you select and confirm are imported. The imported data is then stored on our servers as activities linked to your account, in the same way as activities recorded directly in Compath.
  • Use: imported Apple Health data is used exclusively for the import feature. It is never used for advertising, tracking or behavioural analysis, and is never shared with third parties.
  • Revocation: you can revoke access at any time from iOS Settings → Health → Data Access & Devices → Compath. Activities already imported remain in your account; you can delete them one by one from your profile.

7. Connected watches (COROS, Suunto, Garmin)

Compath lets you send a route directly to your COROS, Suunto or Garmin account, so you can then find it on your watch. With Garmin and COROS, you can also import into Compath the activities recorded with your watch. These features are optional and are only enabled if you explicitly connect your account.

  • Consent: the connection uses the OAuth 2.0 protocol. You are redirected to COROS, Suunto or Garmin, you sign in with them and you authorise Compath. Compath never sees your password. The app remains fully functional if you do not connect a watch.
  • Data received: an account identifier (COROS ID, Suunto username, Garmin ID) and technical access tokens (access token and refresh token). With Suunto, Compath retrieves neither your workouts, nor your physiological data, nor your health data.
  • Garmin activities: if you enable import, Compath receives the activities you record with your Garmin watch and keeps only the activity type, date, duration, distance, elevation gain and GPS track. They are linked to your account and appear in your history, like activities recorded in Compath, so that you can view them and find them on the map. No other Garmin data is read (heart rate, sleep, health data, etc.). Activities you have not yet imported are kept pending for at most 30 days, then deleted.
  • COROS activities: when you open the COROS import screen, Compath looks up the list of your recent activities at COROS, without storing it. For those you choose to import, it downloads the original FIT file, extracts the GPS track, altitude, times and activity type, then discards the file. The other data in the file (heart rate, power, etc.) is not kept. Compath does not access any other COROS data (sleep, health, training plans).
  • Data sent: only the GPX file of the route you explicitly ask to send (track, altitude, route name, link to its Compath page). Nothing is sent automatically: every transfer results from an action on your part.
  • Storage: tokens are stored encrypted on our servers in the European Union and are never passed to the mobile app or to a third party. They are used solely to carry out the transfers you request.
  • Use: the connection is used exclusively to send routes and, for Garmin and COROS, to import the activities you have chosen to import. It is not used for advertising, tracking or behavioural analysis.
  • No sale, no sharing: data from your watch is never sold, rented or shared with a third party. It is not passed on to any artificial intelligence service and is never used to train, evaluate or improve an AI model.
  • Revocation:you can disconnect your account at any time from the Compath settings, or from your COROS, Suunto or Garmin account. Disconnecting withdraws your consent: it immediately and permanently deletes the tokens stored with us and stops any import. Routes already sent remain in your account and are managed from the manufacturer's app.
  • Access, correction, deletion, export: imported Garmin and COROS activities can be viewed, edited and deleted one by one from your profile. Deleting your account erases all imported activities. You can request the export (in GPX format) or the deletion of all this data at contact@compath.store.

Once the route has been transferred, its processing is governed by the manufacturer's privacy policy, available at coros.com, suunto.com and garmin.com.

8. Artificial intelligence

Compath uses Google Gemini to write the description of public routes: the model receives the track, the elevation profile, the places crossed and the photos published on the route. This text is visible to everyone on the route page.

  • Watch data excluded: no data received from COROS, Suunto or Garmin is passed on to Gemini or to any other AI system.
  • No training: your data is not used to train any AI model at Compath.

9. PL8 by Compath

PL8 by Compath is a gym workout tracking app. It works offline: your data is first saved on your phone, then backed up to our servers so that you can get it back.

  • Data recorded: your sessions (date, duration, exercises, sets, reps, weights, notes), your routines and their folders, and your display preferences (theme, language). PL8 by Compath does not use your location, Apple Health or your contacts.
  • Import: if you import the history from another app (CSV file), the file is read on your phone; only the resulting sessions and routines are backed up.
  • Routine sharing: when you share a routine, a copy (routine name, exercises, sets and your account name) is published at an address under compath.store/pl8/. Anyone with the link can view it. Nothing is shared without an action on your part.
  • Use: this data is used only to run the app and back up your history. It is not used for advertising or tracking, and is never sold or shared with third parties.

10. Retention period

Your data is kept as long as your account is active. If you delete your account, your personal data is deleted and your routes are anonymised (the route remains available to other users but is no longer linked to your identity). Your PL8 by Compath sessions, routines and shared routines are deleted, and the sharing links stop working.

11. Your rights

Under the GDPR, you have the following rights:

  • Right of access: view your data from your profile
  • Right to rectification: edit your information in the settings
  • Right to erasure: delete your account from the app or via this page
  • Right to data portability: export your routes in GPX format
  • Right to object: you can stop using the service at any time
  • Withdrawal of consent: disconnect a watch (section 7), deny access to Apple Health (section 6) or stop location sharing, at any time and without giving a reason

12. Security

Passwords are hashed with bcrypt. Communications are encrypted via HTTPS. Access to data is protected by JWT authentication.

13. Cookies

The app only uses technical cookies required for it to work (authentication, theme preference). No advertising or tracking cookies are used.

14. Contact

To exercise your rights or for any question, contact us at:contact@compath.store