Privacy

Who we are

Jot Trot is run by Bart Etcheverry in London, UK, who decides how your information is used (the “controller” under UK data protection law). Contact us at hello@jottrot.co.uk about anything on this page.

Jot Trot never handles donations. Giving happens on the charity’s own page, under that site’s privacy policy.

If you’re a runner with an account

• Your email address, to sign you in with a one-time link. We don’t send marketing email.
• Your artworks: titles, the brief you write (which can include your name, the name of the friend who asked, the charity, what it does and its links), the route you draw, and your privacy choices. If you set an area, we store its centre rounded to about 100 metres, never an exact address.
• Your run files. The original GPX or FIT file you upload is kept privately in storage, along with the track we read from it: positions and times, split wherever you paused. A file from your watch can also hold things like heart rate; we don’t read or use them, but they stay inside the original file until you delete it.
• If you connect Strava: your Strava athlete number, the permission you granted, and access tokens, which we store encrypted. We fetch your recent runs only when you open the list. A run you bring in from Strava is shown only to you, is never published, and is deleted after 7 days, as Strava requires. Disconnecting Strava deletes all of it and cancels our access.

We use this to provide the service you asked for (the legal basis is our contract with you). Connecting Strava is your choice, and you can undo it at any time.

What gets published, and who can see it

Nothing is public until you press Publish. Before that you choose what to hide: the first and last stretch of your run, and a zone around home. Points you hide are deleted from what’s published, not covered up.

A published reveal contains the title and text you chose, the drawing made from what’s left of your run, and only the stats you switch on. It never includes the times your watch recorded. Anyone with the link can view it, and the poster image can be downloaded and shared onwards. Reveal pages ask search engines not to list them.

Taking the link down deletes the published copy straight away. Making your privacy settings stricter applies to a live reveal at once.

If someone sent you a reveal

You don’t need an account, and we don’t set cookies on reveal pages. To stop abuse we count requests per visitor using a scrambled (hashed) version of your IP address, which we can’t turn back into the address, and delete it within a day. We also count that the reveal was viewed, and whether its poster was downloaded, for the runner’s account; we record nothing about you, and the reveal’s address is never sent to our analytics. Links on the page to a charity or to the runner open those sites, which have their own privacy policies; we don’t pass on the reveal’s address.

Analytics

We use PostHog, hosted in the EU, to see how the site is used so we can improve it. It works without cookies:

• On the website we count page views, where visits come from (such as a search engine or a campaign link), the type of device and browser, the country, and how fast pages load. On public pages we also count clicks on links and buttons. PostHog tells visits apart with a code it works out from your connection and browser, which changes every day, so it can’t follow you from one day to the next. Nothing is stored on your device.
• For runners we record steps in the app, such as “artwork created”, “run added” or “reveal published”, against your account’s id, so we can see where people get stuck. These records hold counts and yes/no flags only: never your email, routes, runs, locations, run names or anything from Strava.
• We don’t record your screen or sessions, and reveal pages send nothing to PostHog.

Our legal basis is our legitimate interest in understanding and improving Jot Trot. You can object by emailing us, and blocking scripts in your browser stops it on the website.

Cookies and storage on your device

We use only what the site needs to work: a sign-in cookie for runners, a short-lived cookie while you connect Strava, and your browser’s storage to keep an unsaved drawing safe if you lose connection. Our analytics don’t use cookies. There are no advertising or tracking cookies, so there’s no cookie banner.

Who else handles it

We use these services to run Jot Trot. They act on our instructions:

• Supabase: database, sign-in and file storage, hosted in London. It also sends the sign-in emails.
• Vercel: hosts the website and runs it in London. Like any web host, it keeps short-lived technical logs of requests.
• OpenFreeMap: the street maps. Your browser loads map images from it while you draw or check your privacy settings.
• Route planning: to fit your drawing to the streets, we send the points you place, without your name or account, to an open-source routing service (currently FOSSGIS, in Germany).
• PostHog: analytics, hosted in the EU, as described above.
• Strava, only if you connect it.

Vercel is a US company. Where your information leaves the UK, it’s protected by the safeguards UK law requires, such as the UK–US data bridge or the UK’s standard contract clauses. We never sell your information or use it for advertising.

How long we keep it

• Your account, artworks and original run files: until you delete them.
• A file that was uploaded but never finished processing: deleted within a day or two.
• Runs brought in from Strava: 7 days at most, and sooner if you delete them on Strava or disconnect.
• A published reveal: until you take it down or delete the artwork.
• Hashed IP counts used against abuse: up to a day.
• Analytics events: kept in PostHog for up to a year, then deleted.

Deleting things

Delete an artwork from your artworks list and its route, run files, privacy choices and any reveal link go with it. “Delete my account”, on the same page, removes everything: every artwork, every file, any Strava connection, and the account itself. Both are immediate and can’t be undone.

Your rights

You can ask for a copy of your information, ask us to correct or delete it, object to how we use it, or ask us to limit it. Email hello@jottrot.co.uk and we’ll reply within a month. If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.

Children

Jot Trot is for adults fundraising for charity. It isn’t meant for anyone under 13, and we don’t knowingly hold their information.

Changes

If we change what we collect or who we share it with, we’ll update this page and the date at the top first. Back to the home page.