ActivityMerge
DeutschEnglish

Privacy policy

This notice explains how ActivityMerge handles personal data under the GDPR.

Controller

Manuel Vogl
Achleit 172, 6320 Angerberg, Österreich
manuelvogl@mail.grokbot.com
Austria. Private person.

Activity files

Activity files are processed only in the browser and are never uploaded. FIT, GPX, and TCX files are read and merged on your device. The operator does not receive the file, the route, heart rate, power, or any other channel in it. The tool does not write the activity to local storage or session storage.

Cookies

Analytics cookies are optional. The banner offers Accept, Reject, and Settings. The choice is stored in local storage on this device, under the key for that choice only, so the banner can stay closed and so Cookie settings in the footer can open it again. Activity files are not written there.

Google Analytics 4

If you accept analytics, and this build was made with a measurement ID, the site loads Google Analytics 4. The script is gtag.js. It is not loaded when you reject analytics. A build without a measurement ID contains no Google Analytics code.

Manuel Vogl is the controller for this measurement: he decides that it happens and for what purpose. Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, provides Google Analytics 4 and processes the measurement data for the controller.

Purpose: which pages are visited, plus the technical details Google Analytics collects with that, such as the browser, the device, and an approximate region. Activity files, routes, heart rate, power, and the other contents of a FIT file are not sent.

Legal basis: your consent, Article 6(1)(a) GDPR.

IP addresses: Google Analytics 4 does not store IP addresses.

Cookies: after consent, Google may store _ga and _ga_* on your device. Each lasts up to 2 years. They distinguish returning browsers. If you reject analytics, this site does not ask Google to set them.

Transfer to the United States: Google may transfer the measurement data to the United States. Google participates in the EU-US Data Privacy Framework.

Withdrawal: use Cookie settings in the footer, then choose Reject. That withdraws consent for later visits, and the tag is not loaded again until you accept. You can also delete _ga and _ga_* in the browser.

Google’s privacy policy: https://policies.google.com/privacy.

Hosting and content delivery

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, is the processor for hosting and the content delivery network (Cloudflare Pages). It may process the IP address, the time, the requested URL, and the browser string in order to deliver the pages and to keep the service secure. The legal basis is legitimate interest (Article 6(1)(f) GDPR).

Cloudflare Web Analytics, if used, is provided by the same processor. Cloudflare Web Analytics is cookieless and does not build an advertising profile. The current pages do not load that beacon.

Transfers to the United States may occur. Cloudflare participates in the EU-US Data Privacy Framework and uses the European Commission’s standard contractual clauses. Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/.

The content security policy allows scripts and connections only for this site and for www.googletagmanager.com, www.google-analytics.com, and region1.google-analytics.com. The merge does not use those connections.

Storage period

Activity files are processed only in the browser and are never uploaded, so the operator does not store them. They stay in the tab’s memory until you leave the page.

The analytics choice stays in local storage on your device until you change it in Cookie settings or clear the site data.

After consent, the Google Analytics cookies _ga and _ga_* last up to 2 years. Event data in Google Analytics is kept for the retention period of the property. Google offers 2 months or 14 months.

Emails you send to manuelvogl@mail.grokbot.com are kept only as long as needed to answer them.

Cloudflare keeps connection logs for the period described in its privacy policy, for hosting and security.

Your rights

You can ask Manuel Vogl for access, correction, erasure, restriction, and a portable copy of personal data he actually holds. You can object to processing based on legitimate interest. You can withdraw consent at any time, with effect for the future, via Cookie settings in the footer. Withdrawal does not affect processing that happened before it.

You have the right to complain to the Austrian data protection authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, [email protected],https://dsb.gv.at/.

How to check this

  1. Open the browser developer tools and choose the network panel.
  2. Drop two FIT files and download the merged file.
  3. The activity file is not among the requests. Before you accept analytics, the requests are for this site’s own pages, scripts, and fonts.
  4. After you accept analytics, the page may also contact www.googletagmanager.com, www.google-analytics.com, and region1.google-analytics.com. A build without a measurement ID never loads that script.
  5. The content security policy allows connections only to those three hosts. It does not allow an upload of the activity file.