Privacy

The most important thing on this page is short: your activity file never reaches us.

Your route is drawn in your browser

When you drop a .gpx, .fit or .tcx file into the editor, it is read and drawn on your own machine. The file itself is never uploaded. If you close the tab before adding anything to the basket, we never had your file.

Two things in the editor do reach our print service before that — and only if you use them:

- Photos. A photo you add to the print is uploaded so it can be placed on the print. Its location and camera data are stripped when it arrives. If it never goes in the basket, it is deleted after seven days; if it does, it follows the design. - The satellite background. When you choose it, the design — including the trimmed route — is sent to our print service so the imagery can be fetched ahead of time. It is kept for one hour, and nothing is drawn from it.

What we receive is what you put in the basket: the finished design, with the route stored as a compressed line — already trimmed around its start and end by the privacy radius you chose, unless you switched it off. With the radius on, your home address is not in the order because it was removed before the order existed. The design is stored by our print service from the moment it goes in the basket, so the print file can be made; see How long we keep it below.

Besides the route, the design carries the numbers and graphs of your activity: distance, time, elevation and — if your file or your Strava activity has them — heart rate, power, cadence, speed and temperature, sampled along the route. They travel with the design so the print can be redrawn exactly as you approved it. Heart rate can say something about your health; we use it for the print and for nothing else. If you let the editor estimate your maximum heart rate from your age, only the resulting number is kept, not your age.

We do not keep an archive of your activities. There isn't one to leak.

The route generator talks to two services

Activity files — .gpx, .fit or .tcx — are read and drawn in your browser. They are never uploaded, and that does not change.

The route generator talks to two servers of its own:

• Typing a place sends the text you typed to Mapbox's geocoding service (api.mapbox.com/geocoding), so it can be turned into a location. Nothing else about you goes with it.
• "Use my location" sends your device's own position — not the map square you happen to be looking at — as coordinates in the request to our road-network server, and only when you press that button yourself. If you never press it, your position is never sent anywhere.
• Either way, what the road-network server fetches from OpenStreetMap is an area around that point. Never a route and never a history — no file, no track, no account. What is cached is the road network itself, snapped to a fixed grid cell rather than the exact point you searched or stood at — not a record of your visit. Two people browsing the same neighbourhood land on the same cell, and the cell carries no trace of either one.

Who is responsible

Epic Efforts is a trading name of Forml ApS, CVR 45580377, Hejrebakken 75, 3500 Værløse, Denmark. hello@epicefforts.com

What we collect, and why

The newsletter

If you sign up in the footer, your email is stored in Shopify with your consent to receive the newsletter. We use it for nothing else. Every email has an unsubscribe link, and when you use it — or ask us — your consent is withdrawn and we stop writing.

Strava

If you connect Strava, you are asked to let us read all your activities, including the ones you set to "Only You" (activity:read_all), and your heart-rate zones (profile:read_all), so a print can use them. We read your list of activities when you connect, and an activity's full track only when you pick it. You can disconnect at any time from your Strava account.

Your Strava access token never reaches your browser. It is held server-side and expires after an hour; the page only ever holds a lookup id. When the hour is up, we revoke our access ourselves, so Epic Efforts disappears from your Strava settings without you doing anything.

Unlike an uploaded file, Strava activities do pass through our server — that is how the connection works. The list of your activities, and the activity you pick, are each held for fifteen minutes so that browsing does not hammer Strava with the same request, and then they are gone. Photos from a Strava activity are fetched through our server and, if you add them to the print, handled like any other photo.

To see who is using the connection and where it gets stuck, we note your Strava athlete id, your first name and the initial of your last name, when you connected, which years you fetched, how many activities you opened, which tools you used (cropping, segments, photos), and whether you then put a design in the basket and placed an order. Nothing from the order itself goes into that note — no amount, no address, no email. The note is deleted 7 days after you connected. We also keep daily totals (how many connected, added to the basket, ordered) with no names or ids in them.

A design you make from Strava is marked as coming from Strava — only that, not who you are — and if you do not order it, it is deleted 21 days after it went in the basket. If you order it, it is kept with the order (see How long we keep it), because we need it to handle a complaint about the print you bought.

If you disconnect Epic Efforts in Strava, Strava tells us, and we delete the note about you, your sessions and anything still held from your activities straight away. Designs you did not order are gone within 30 days at the latest, as Strava's terms require.

Strava may monitor and collect usage data about how our connection is used, and may use that data for any business purpose, as its API terms allow. Strava's own privacy policy applies to that: strava.com/legal/privacy.

Who else touches your data

We use these processors, and no others:

• Shopify — the shop, checkout and order records. Ireland/EU.
• Gelato — printing and shipping. Receives your delivery address and the print file.
• Cloudflare — hosting, and the print service that stores designs, print files and photos.
• Mapbox — map backgrounds, in the editor and in the print file, when you choose one, and the address search in the route generator. The map is fetched as tiles for the area your route covers, so Mapbox sees which area was requested and your IP address — not your file, and not the line itself. The route generator's address search sends Mapbox the text you typed, and "Use my location" sends your device's position straight to our own server, not to Mapbox. Choose Clean line and no map request is made. The free tools never request a map; their "See it on a map" button opens the editor, where this applies.

• Microsoft (Microsoft 365) — our email. If you write to us, your message is held there.

• Google (Google Tag Manager and Google Analytics 4) — usage statistics, only if you accept analytics cookies, as described under Cookies below. Google Ireland Limited, with data processed in the EU and the US under the EU–US Data Privacy Framework. We send Google no names, no email addresses, no activity files, no routes and no titles — only which pages were viewed and which choices were made in the editor, in broad categories such as "ride, 50–100 km, 50×70, framed".

Some of these companies are based in, or process data in, countries outside the EU/EEA — Cloudflare, Mapbox, Microsoft and Google in the United States, and Shopify, which may also process data in Canada and the United States. Where your data leaves the EU/EEA, the transfer is covered by an EU adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission's standard contractual clauses in our agreement with that company.

We do not sell your data, and we do not share it for advertising.

How long we keep it

You can always ask us to delete your data sooner. Where the law requires us to keep the order record, we keep only that.

Your rights

You can ask for a copy of what we hold, have it corrected, have it deleted, object to how we use it, or ask us to move it elsewhere. Write to hello@epicefforts.com and you will hear back within a month.

If you think we are handling your data wrongly, you can complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby — datatilsynet.dk.

Cookies

You choose in the cookie banner, and you can change your mind at any time from Cookie settings at the bottom of every page.

Before you answer, and if you say no, nothing is sent to Google. Google Tag Manager and Google Analytics 4 are not loaded at all — no Google script, no Google cookie, and no "cookie-less" signal either. They load only after you accept analytics cookies.

If you accept analytics cookies, we count visits and see how far people get in the editor and the checkout. The data we send is deliberately coarse: which page, which step, which kind of print (for example "ride · 50–100 km · 50×70 · framed"), and the value of an order. Your title, your route, your activity's name and date, and your Strava account never leave your browser for this purpose. Google receives your IP address as part of the request. Analytics data is kept for 14 months and then deleted. If you later withdraw your consent, the measurement stops and the Google Analytics cookies are removed.

Whatever you choose, Shopify — which runs the shop and the checkout — collects the technical data it needs to operate them: that a page was loaded, error and performance reports, and checks against fraud and automated traffic. When you decline, Shopify marks you as not trackable and sets neither its analytics nor its marketing cookie.

### The cookies

Expiry times are the ones Shopify (shopify.com/legal/cookies, updated 8 October 2026) and Google (support.google.com/analytics/answer/11397207) state for these cookies.

We do not use advertising cookies. If we ever add them, you will be asked first.

Last updated: 13 October 2026