1. Scope & Responsibility

This policy applies to processing for which we determine the purposes and means across the Lumtrk website, web application, native apps and supporting services. Features depend on the version and services available to you; describing a feature does not mean it is available in every region or on every device.

We handle privacy questions about Lumtrk. Activity platforms, social login providers, basemap services and payment providers may independently determine purposes for their own services. Data held on those platforms and related requests should also be managed through their channels. We will help you identify the appropriate recipient of a request.

This policy is a notice, not blanket permission for all processing. Registration, browsing, accepting terms, a default selection or third-party authorization does not automatically provide valid consent for health information, optional contributions, non-essential tracking or new purposes. Processing requiring consent must have separate, informed, freely given and withdrawable consent.

2. Categories of Information

Information comes from what you provide, platforms you authorize and technical records needed to operate the service. Fields depend on file contents, permissions and enabled features.

• Account and profile: login identifiers, names or nicknames, usernames, primary email and verification status, avatars, language and time-zone preferences; first and last names, profile or website links actually supplied by the identity service, and linked social-provider identifiers, emails and avatars. We retain field-filtered local profile records and change history for account management and traceability. Different emails do not automatically merge accounts.
• Activities and connections: source account identifiers, permissions, server-side authorization credentials, synchronization and import records, activity IDs, names, types, dates, durations, distances, device information, deduplication links, and original FIT, GPX or other files you upload or authorize us to download, together with parsed results.
• Precise location and potential health information: GPS coordinates, timestamps, elevation and routes. Complete activity files may contain heart rate, power, pace, physical or performance information. Platform notifications may also contain health fields unused by the map. A field can remain in an original file or notification even if it is not displayed; absence from the interface does not mean it was not collected.
• Technical and usage context: IP addresses, browser or device information, request times, error and security logs, map viewports and tile areas, and necessary session and authorization records. Pricing or checkout may use an IP-derived country and your billing country. Browser or operating-system location supports map positioning and the location indicator when you use those features.
• Billing and entitlements: Paddle customer, transaction, subscription, price and notification identifiers, status, entitlement periods and scheduled changes. The checkout provider also processes billing contact and payment information. We do not receive or store full card numbers or security codes, or provide private routes or activity files to Paddle.
• Support and requests: emails you send, account-identifying information, problem descriptions and handling records. Do not send passwords or OAuth tokens. Do not send identity documents or activity material unsolicited; supply only necessary portions after we explain the need and provide an appropriate secure channel.

3. Sources & Necessity

You can provide account preferences, upload activity files or contact us directly. Logto and your chosen social login provider supply identity information. Connected activity platforms supply data through official authorization, downloads or notifications. Technical information comes from browsers, operating systems, networks and relevant providers. We do not ask for your activity-platform or social-platform passwords.

Public pages generally do not require an account. Login identifiers and necessary sessions support account services; personal heatmaps need activity data. Platform connections, device location and global contributions can be controlled separately. Refusing optional processing should not affect unrelated account or private-map features. A payment provider may be unable to complete a transaction without legally required billing information.

We limit field use to feature needs and subsequent access to official permissions. Original files are not guaranteed to have every unrelated field removed before import. If you do not want to provide sensitive contents, do not upload or authorize transmission of that file; contact us about alternatives. Only upload files you are entitled to use, and avoid supplying another person’s routes or health information.

4. Purposes & Legal Bases

Where a legal basis is required, including under the GDPR and UK GDPR, processing must use the appropriate basis below. One basis does not cover all data and purposes.

• Requested services: authenticating accounts, managing preferences, importing and deduplicating activities, generating private routes, statistics and personal heatmaps, administering subscription access and providing support. Ordinary personal data may be processed where necessary to perform the service contract. Health or other special-category data also needs an additional lawful condition.
• Consent: health processing, optional global contributions and non-essential device tracking requiring consent need valid consent for the relevant purpose. Explicit consent is generally needed where GDPR Article 9 applies and no other valid condition is available. Platform OAuth permissions and operating-system location permissions control access; they do not replace consent we need for our specific purposes.
• Legitimate interests: proportionate and necessary account and system security, abuse prevention, troubleshooting and service reliability, after assessing the impact on you. This basis does not automatically permit special-category processing or optional contributions. You can object to processing on this basis because of your particular circumstances.
• Legal obligations: applicable tax, accounting, breach-reporting, valid legal-request and privacy-rights obligations, retaining only records necessary for the relevant obligation.
• Purpose limits: we do not sell or rent activity, location or health data, use it for targeted advertising or data brokerage, or assess insurance, employment or credit eligibility. Lumtrk currently has no AI features. We do not send this data to AI model providers or use it to train, fine-tune, evaluate or improve our own or third-party AI or machine-learning models.

5. Precise Location & Health Information

Routes can reveal homes, workplaces, visits to medical or religious locations and routines. Metrics such as heart rate, or routes combined with other information, may qualify as health or other sensitive information. We treat these risks conservatively. Removing names or account identifiers does not guarantee route anonymity.

When explicit or separate consent is required, it must follow notice of the categories, necessity, purposes, recipients and withdrawal method. The relevant sensitive processing must not proceed without a valid applicable condition. You can withdraw any consent-based processing without invalidating earlier processing based on valid consent. We will not switch to contract or legitimate interests to bypass withdrawal for the same purpose. Retention for an independent legal obligation or another already-disclosed purpose must remain necessary and limited, with any additional special-category condition still satisfied.

Device location and GPS in imported files are separate sources. You can deny or revoke foreground location permissions in your browser or system settings and still view imported maps. Lumtrk currently has no background route-recording feature. The app’s location indicator and map SDK may update location while relevant foreground features are in use; see section 10 for SDK processing.

Private activity access is restricted by account. We do not directly provide private activity files, complete individual routes or health metrics to other ordinary users, advertisers or payment providers. The global heatmap is a separate aggregate purpose subject to section 7’s eligibility, protections, choices and withdrawal rules; it is not publication of personal activity details.

6. Garmin Data & Activity-Platform Authorization

This section explains how Lumtrk collects, uses, processes and stores Garmin data, and which service providers help process it.

• Information collected: with your authorization, we receive activity notifications through the Garmin Activity API and obtain activity summaries, details and files. These may include activity types, times, distances, devices, GPS, elevation, heart rate, pace and power. Complete files or notifications may contain fields that are not displayed in the interface.
• Purposes: to connect your account, import and organize activities, identify duplicate records, and create and display your private activities, routes and personal 2D/3D heatmaps. We do not sell or rent Garmin data, provide it to advertisers, or write your Garmin activities to other activity platforms.
• Processing: Garmin data is received by services controlled by our company. After checking your authorization, we organize activity data, calculate routes and heatmaps, and display private results through your signed-in Lumtrk account.
• Storage and protection: account connections, authorization information, activity files, synchronization records and heatmap results are stored in private cloud storage and server environments managed by us. We protect information through encrypted transmission, encryption of connection credentials and account access restrictions. These measures do not mean that all data is end-to-end encrypted.
• Service providers: Cloudflare provides cloud hosting, storage and security services and processes Garmin data needed to operate Lumtrk. Server hosting, backup and operational providers supporting our heatmap services may also process necessary data. Identity and payment providers do not receive Garmin activity files or health metrics. Map providers may receive map requests and related location or usage information, but we do not upload Garmin activity originals or activity metrics to them. Sections 8–10 explain their specific roles.
• Authorization and AI: authorization takes place through Garmin’s official pages. We do not obtain your Garmin password or expose authorization credentials in client applications. Garmin data is not provided to third-party AI services or used to train, fine-tune, evaluate or improve AI models.
• Retention and deletion: activity data is retained as needed to provide your private activity service and removed through deletion requests or account deletion. Temporary notification copies are deleted after successful processing. Unprocessed or failed copies expire 7 days after receipt and are removed by scheduled cleanup. This period does not apply to retained activity data or backups; section 11 explains other retention and deletion rules.
• Disconnection: you can disconnect Garmin in Lumtrk or revoke authorization in Garmin Connect. Successful disconnection stops new synchronization and clears connection credentials, but does not automatically delete imported activities or heatmaps. You can request deletion of these records or delete your Lumtrk account; this does not delete data retained by Garmin.
• Personal heatmaps and global aggregation: within your authorization, your Garmin activities may be used to create your own private routes and 2D/3D heatmaps. A global heatmap that combines data from multiple users and makes it available to other users is a separate purpose, subject to Garmin permission, your contribution authorization and applicable privacy requirements. Connecting Garmin or enabling contributions by default does not automatically authorize this use. Global contribution settings do not affect your personal heatmap.
• Policy changes: we publish the updated policy on this page. If how we collect, use or share data changes significantly, we notify you through the website or in-app notices. For changes involving new purposes or requiring renewed authorization, we seek your consent before starting the relevant processing. You can decline optional purposes or withdraw authorization you have granted.

7. Optional Global Aggregate Heatmap

The Global 3D Heatmap and its 2D continuation are designed to show routes and passage intensity across contributors. When the feature provides eligible aggregate outputs, other users with access can view them. Enabling a setting alone does not mean an output exists or your activities have been published. Eligible historical and future activities may be included only with source-use permissions and necessary legal conditions. Viewing the global heatmap does not require contributing. Private heatmaps and contribution settings are managed separately.

The contribution switch currently defaults to on in account settings and can be turned off in the data-source panel. A default is not valid consent or evidence that your activities have entered global results. Regions and data categories requiring affirmative or explicit consent must have separate valid consent before this optional use. A default selection, continued use or platform authorization cannot replace that requirement.

Protections applied when generating and providing global results include spatial quantization, exclusion of areas near continuous route-segment endpoints, minimum contributor thresholds, and omission of names, emails, accounts, activity IDs and health metrics from global outputs. These reduce risk but do not guarantee against re-identification. Sparse areas, unusual routes and external information can still reveal clues. De-identification alone does not establish that all global data falls outside privacy laws.

Turning off contributions stops future inclusion and initiates withdrawal of existing contributions. Hiding or deleting relevant activities also makes them ineligible. Saving a setting and finishing removal of old outputs, tiles and caches are separate states and can involve asynchronous processing. Use withdrawal completion or support confirmation to determine the result. We cannot recall screenshots already obtained by others; that does not justify indefinitely retaining identifiable outputs we still control.

About Global 3D Heatmap Contributions

8. Recipients, Providers & Disclosures

Outside the aggregate use you control, private activities are not made available to other ordinary users. Providers process information needed for their relevant functions. Processors must have appropriate contractual, confidentiality and security obligations. Independent controllers’ own purposes are also governed by their privacy notices.

• Logto and social login providers: authentication, account recovery and profile management involving identities, emails, avatars, linked accounts and login records. Social providers may process login information under their own rules. We receive only returned profile fields that pass our field selection. We do not send them activity originals, routes or health metrics.
• Cloudflare: website/API hosting through Workers, network security, D1 business databases, queues and private R2 object storage involving account records, connection status, encrypted D1 connection credentials, original activity files, retained notifications and request information. Temporary large-notification originals may contain authorization identifiers and have no application-layer encryption. Its network infrastructure may process requests across multiple overseas regions. Cloudflare processes activity data as infrastructure for Lumtrk; use of private storage does not mean no third party processes the data.
• Heatmap computing and server hosting: our company-controlled Python service parses originals, stores routes in PostGIS and generates private or eligible aggregate outputs. Server hosting, backup and operational providers supporting this environment may process the necessary activity files, routes or technical records. Company control does not mean the underlying providers never process data, and private heatmap computation is not performed only on your device.
• Map services: OpenFreeMap, Esri / ArcGIS, AWS S3 terrain resources and the app’s Mapbox SDK may receive IP addresses, device or usage information, tile areas or SDK location telemetry. Private activity files are not uploaded as basemap tile request bodies, but requested areas can indirectly reveal locations you are viewing.
• Paddle: merchant of record for Pro purchases, independently processing checkout, subscription billing, tax, customer portal and payment-recovery information. The pricing page may load Paddle price preview. An identified Paddle customer ID can support payment recovery, and checkout may prefill email and country. We use necessary billing records to manage access and do not send routes or health data.
• Connected activity platforms: authorization, revocation, downloads and notifications. They retain source-account data under their own rules. Deletion in Lumtrk does not replace a deletion request to the platform.
• Other lawful disclosures: necessary information may be disclosed for valid legal requirements, necessary protection of people or systems, legal claims or your relevant authorization. A corporate transaction involving personal information also remains subject to applicable law, confidentiality and purpose limits. Material changes to the controller or purposes will be notified under section 19.

9. Overseas Processing & Transfer Safeguards

Lumtrk’s overseas hosting, authentication, payment, mapping and network services may process information outside your country, including in overseas data centers or through controlled remote access. Storage locations, request-processing locations and provider headquarters can differ. This policy does not promise that all data stays within the EU or UK.

Transfers governed by EU/EEA, UK or Swiss rules must have an applicable adequacy decision, valid standard contractual clauses with necessary supplementary measures, or another legally permitted mechanism. UK transfers may need the applicable IDTA or Addendum, and Swiss transfers require relevant adaptations. A provider privacy notice, HTTPS or your use of the service alone cannot replace a transfer mechanism.

Contact us for recipients, actual processing regions and applicable transfer safeguards relevant to your information, and to request a copy or explanation. Trade secrets or other people’s information may need redaction. Describing these requirements does not certify that an unverified provider contract, certification or transfer assessment has been completed.

10. Cookies, Device Storage & Third-Party SDKs

Login sessions and official connections use necessary storage. Web platform authorization uses short-lived browser-binding cookies to prevent authorization-request abuse. The current Garmin, COROS and Intervals.icu binding cookies last at most 10 minutes, are cleared after callbacks, and use HttpOnly, SameSite and Secure under HTTPS. The identity service may also set storage under its session rules.

Browser local storage remembers language, theme and heatmap-style preferences; session storage may remember dismissed notices. Preferences may remain until you clear site data. Apps use system secure storage, encrypted session storage and map caches for login and display. Sign-out or account switching triggers user-cache cleanup; it does not delete server-side or source-platform data.

Lumtrk currently has no first-party targeted-advertising or behavioral-analytics SDK. This does not mean third-party SDKs perform no independent processing. Paddle can load on the pricing page, and native Mapbox SDKs may process location and usage telemetry. Non-essential tracking is not treated as necessary for private maps; consent-dependent processing must be enabled only after the relevant consent is valid.

You can clear browser storage, restrict cookies and manage location permissions in system settings. Blocking necessary storage may prevent login, authorization or payments. Consult map SDK and payment-provider notices for their choices; contact us if you cannot find a relevant control. Refusing non-essential processing should not require a purchase or disable unrelated features.

11. Retention & Deletion Boundaries

Retention depends on category, feature necessity, your choices and legal obligations, not indefinite possible future usefulness. Where no uniform fixed number of days is set, the criteria below apply. You can ask about retention relevant to your account.

• Profiles, preferences and profile change records: generally retained while the account exists and account management or traceability still requires them; account deletion initiates cross-system cleanup. Profile history does not authorize permanent retention of all identity information.
• Original files, routes, source links and personal heatmaps: generally retained while the account exists and your private-data service needs them, until relevant deletion or account cleanup is completed. Disconnection, sign-out, the end of a free display window, Pro expiry or hiding an activity does not automatically delete historical originals.
• Connection authorization credentials: encrypted in D1 while the connection is valid and synchronization requires them, cleared after successful disconnection or revocation handling, and not used for other purposes. Short-lived authorization transactions expire under their expiry rules. Authorization information in temporary notifications follows section 6’s notification-cleanup rules.
• Notifications, synchronization, error, security, privacy-request and withdrawal records: retained as necessary for troubleshooting, abuse prevention, evidence of request handling and reliable withdrawal. Some cleanup records may remain temporarily after the main account record is deleted to finish retries. Their purpose is cleanup and compliance, not restoring your activity display.
• Billing and transactions: retained as necessary for applicable tax, accounting, disputes or legal claims. Payment providers may have their own statutory periods. A deletion exception must be limited to the specific records and purpose and cannot justify keeping all activity data.
• Caches, old aggregate outputs and backups: active-storage deletion, cache invalidation, aggregate withdrawal and backup rotation may complete at different times. Residual isolated backups must expire under the applicable rotation cycle and stay outside routine processing; restoration must reapply valid deletion requests. Queuing a request, returning success or signing out does not mean every copy was immediately and permanently erased.

12. Security & Incident Notifications

We use HTTPS, encryption for connection authorization credentials stored in D1, verified identities and account access controls, controlled internal interfaces and necessary operational records. This does not mean all authorization identifiers or original content have application-layer encryption. The scope of original-file encryption, backups and provider controls depends on actual configuration. Credential encryption is not end-to-end encryption of all information. No system guarantees absolute security; measures are maintained and improved according to risk.

If a personal-data breach occurs, we investigate, contain its impact and preserve necessary records, notifying authorities and affected people as required by applicable law. Where GDPR reporting is required, authorities must normally be notified without undue delay and, where feasible, within 72 hours of awareness. High-risk breaches also require notification to individuals without undue delay. Not every event has the same recipients or deadline.

Report unusual access or receipt of another person’s data through our privacy contact, supplying only information needed to assess the issue. Do not continue accessing, downloading or distributing data you are not entitled to view.

13. Your Data Controls

These actions have different results. Choose the one matching your purpose, or email a request if a feature is unavailable or fails.

• Disconnect: stops new access to that source and clears local authorization credentials; it does not automatically delete imports. Check source-platform revocation separately.
• Hide activities / turn off contributions: controls display or aggregate eligibility and triggers relevant global withdrawal. Hiding is not physical deletion of originals, and turning off contributions does not delete private heatmaps.
• Delete your account: request this in account settings after identity verification and confirmation. An accepted request disables the account and starts asynchronous cleanup of identity, private routes, originals and business records; failures are retried. Global contributions also require withdrawal completion. Contact support if verification factors or deletion dependencies are unavailable.
• Access, export, correction or separate deletion of historical data: currently handled through support@lumtrk.com under applicable law. There is no promised one-click complete export feature. For portability, specify the categories required; we will assess the applicable scope and an available structured, machine-readable format.
• Subscriptions and deletion: deleting Lumtrk does not automatically cancel a Paddle subscription, issue a refund or erase a payment provider’s statutory records. Manage renewal in the customer portal first, or contact us for help, to avoid renewal after your account becomes unavailable.

14. Privacy Rights & Requests

Rights depend on your location, applicable law and the processing concerned. We provide a privacy contact and handle the rights below as applicable. They do not depend on a Pro subscription.

• Information, access and correction: learn the categories, purposes, recipients, retention, sources and safeguards; obtain a copy of your information; correct inaccurate or incomplete records.
• Erasure, restriction and portability: where conditions apply, erase information, restrict disputed processing, or receive eligible data you provided in a structured, commonly used, machine-readable form; request transfer to another controller where technically feasible.
• Withdrawal, objection and opt-outs: withdraw any consent-based processing. Withdrawing processing needed for a particular feature may make that feature unavailable without affecting unrelated features. Object to legitimate-interest processing because of your situation; where applicable, opt out of sale, sharing or targeted advertising and limit sensitive uses beyond necessary purposes. We do not discriminate, require a paid upgrade or reduce unrelated services because you exercise lawful rights.
• Automated processing: deduplication, import scheduling, display ranges and subscription access are computed automatically. We currently do not make solely automated personal assessment decisions producing legal or similarly significant effects. You can request explanations, correction and human review of an access error.

Email support@lumtrk.com with your account email, country or region, requested right and scope. A legally authorized agent can act for you; we may verify authorization where necessary. Do not send passwords, tokens or unrelated identity documents.

We request only verification proportionate to the risk and necessary to the request, preferring an authenticated session or existing account information. Excessive document collection must not obstruct rights. Deadlines start under applicable law, not automatically only after we finish verification. Withdrawal, objection and opt-out requests must not face blanket additional verification requirements.

For a lawful refusal, extension or retention exception, we explain the reason, scope, expected timing and complaint or review route. Requests are generally free. Fees or refusals are limited to cases allowed by law, such as manifestly unfounded or excessive requests, with an explanation of the basis.

15. EU / EEA & UK Supplement

Where the GDPR or UK GDPR applies, you have the relevant access, rectification, erasure, restriction, portability, objection, withdrawal and regulatory complaint rights. Contract necessity does not automatically cover health data; special-category conditions and international-transfer safeguards require separate justification.

Rights requests require a response without undue delay, normally within one month of receipt. Complexity or numerous requests may permit an extension of up to two further months, with reasons given within the first month. Clarification or necessary verification affects timing only where applicable rules allow it. Internal queues, asynchronous tasks or acknowledgement do not replace a substantive response.

You may complain to a data protection authority where you habitually live, work or where an alleged infringement occurred, or to the UK ICO, without giving up other remedies. An applicable UK privacy complaint process normally requires acknowledgement within 30 days and handling without undue delay. Acknowledgement does not mean every matter must be completed within 30 days.

The company privacy contact is not automatically a formally designated data protection officer (DPO) or EU/UK representative. This policy does not claim these statutory roles have been appointed. Required appointments and contact publication must be completed where applicable. You can contact us through the policy email without losing regulatory complaint rights.

16. California Supplement

Where the CCPA/CPRA applies to our relevant business and your information, this section supplements the policy. Not every business or dataset is automatically subject to identical provisions. You can also submit applicable rights requests under other US state laws through the same email.

Categories include identifiers and account information, commercial and subscription records, internet/network activity, geolocation, activity files and potentially health-related information. Sections 2–4 describe sources and purposes, section 8 recipients, and section 11 retention criteria. Precise geolocation, account-access credentials and health information may be sensitive personal information. We do not use it to build advertising or consumer profiles.

Where applicable, you can request information, access, deletion, correction and copies, and limit sensitive uses beyond legally permitted necessary purposes. You can use an authorized agent. Optional global contributions need a separate scope assessment; a mapping service does not make every reuse of sensitive information necessary.

We do not “sell” personal information or “share” it for cross-context behavioral advertising as those terms are used in the CCPA, or use activity, location or health information for targeted advertising. There is therefore no such use to opt out of. Applicable signals such as Global Privacy Control (GPC) must not be ignored. They are distinct from platform disconnection, account deletion and global contribution choices and are not interpreted as account-deletion requests.

Applicable requests to know, delete or correct are normally acknowledged within 10 business days and substantively answered within 45 calendar days. A lawful extension can add 45 calendar days with notice and reasons. Applicable sale/sharing opt-outs and sensitive-use limits must be honored as soon as feasible and within 15 business days, without blanket identity verification as a starting condition. We explain lawful retention or refusal and you may complain to the CPPA or California Attorney General.

17. Other Regions & Consumer Health Rules

The supplements below apply when the relevant law applies. Stronger mandatory protections prevail and cannot be excluded by this policy or the terms. Contact the privacy email for local request, review or regulatory routes.

Switzerland: where the FADP applies, you can request processing information, access, correction and eligible deletion or data delivery, and raise concerns with the FDPIC or seek legal remedies. Transfer safeguards must meet applicable Swiss requirements.

Brazil: where the LGPD applies, you can request confirmation, access, correction, eligible anonymization/blocking/deletion, portability, sharing information, withdrawal and review of qualifying automated decisions, and complain to the ANPD. Timing depends on the request and applicable rules.

Canada: applicable federal or provincial law can provide access, correction, processing information and withdrawal subject to lawful contractual or legal restrictions, with complaints to the competent privacy commissioner. PIPEDA access requests normally require a response within 30 days; lawful extensions require an explanation.

Australia: where the Privacy Act and APPs apply, you can request access and correction, complain to us and seek handling by the OAIC as permitted. Eligible serious breaches require the NDB process. Business size alone does not establish a small-business exemption; health-information activities can be an exception.

US state consumer-health rules: activity and location information may be consumer health data in Washington, Nevada and elsewhere even when HIPAA does not apply. Relevant laws can also require a dedicated health notice, collection/sharing choices, deletion and appeal mechanisms. An ordinary policy, OAuth or general terms cannot replace those requirements. We do not sell consumer health data or use geofencing around healthcare facilities to identify, track or target people seeking care.

18. Children & Young People

Lumtrk is primarily for adults and is not directed to children under 14. The current terms allow eligible users aged 14–17 under guardian guidance and consent. This does not waive local age, contractual-capacity or digital-consent requirements. Higher age thresholds or verified guardian authorization must be satisfied where required.

EU consent ages for offering online services directly to children vary by member state, generally between 13 and 16. A uniform age of 14 is not sufficient everywhere. Location, health and global contributions involving young people require additional care and legally valid authorization. General guardian consent is not unlimited permission for public or aggregate uses.

If you believe a child’s information was improperly collected, contact support@lumtrk.com. We will investigate, restrict the relevant processing and delete or take other necessary measures under applicable law. You do not need to publicly disclose a child’s routes to demonstrate the issue.

19. Policy Changes & Mandatory Rights

We show the version and last-updated date on this page. Material changes to categories, purposes, significant recipients, contributions or rights channels will be explained through the website, in-app notice or appropriate account communication, in advance where required.

Where a new purpose requires fresh consent, valid consent must precede it. Continued use is not automatic consent, and policy updates do not retroactively legalize unauthorized processing. You can decline optional processing through the relevant controls or by contacting us without accepting unrelated new purposes.

The English and Chinese versions aim to state the same rules. Mandatory privacy protections prevail over conflicting translations, terms, jurisdiction clauses or other statements. Regulatory complaints and statutory remedies do not require a prior complaint to us or litigation where the company is based.

1. 适用范围与负责主体

本政策适用于 Lumtrk 网站、Web 应用、原生 App 及其配套服务中由我们决定目的和方式的个人信息处理。具体功能以您使用的版本及可用服务为准；介绍某项功能不表示该功能已在所有地区或设备上开放。

我们负责回应与 Lumtrk 有关的隐私问题。运动平台、社交登录提供方、底图服务商和付款机构可能就各自业务独立决定处理目的；其原平台数据和相应权利请求也应通过各自渠道管理。我们会帮助您区分应向谁提出请求。

本政策是信息告知，不是对所有处理的概括授权。注册、浏览、接受使用条款、默认勾选或第三方平台授权，不自动构成对健康信息、可选贡献、非必要跟踪或新用途的有效同意。依法需要同意的处理应取得单独、知情、自由且可撤回的同意。

2. 我们处理的信息类别

信息来自您提供的内容、您授权的平台以及使用服务产生的必要技术记录。具体字段取决于文件内容、授权范围和您启用的功能。

• 账户与资料：登录标识、姓名或昵称、用户名、主邮箱及验证状态、头像、语言和时区等偏好；身份服务实际返回的名字、姓氏、资料或网站链接，以及关联社交身份的提供方标识、邮箱和头像。我们保留经过字段筛选的本地资料镜像及变更记录，供账户管理与追溯使用；不同邮箱不会自动合并账户。
• 运动与连接：来源平台账号标识、权限、服务端授权凭据、同步与导入记录、活动编号、名称、类型、日期、时长、距离、设备信息、去重关联，以及您上传或授权下载的 FIT、GPX 等原始文件及解析结果。
• 精确位置及潜在健康信息：GPS 坐标、时间点、海拔与路线；完整活动文件可能包含心率、功率、配速、身体或运动表现等信息。平台通知也可能包含不用于地图的健康字段。即使某字段未在界面显示，原始文件或通知中的该字段仍可能被保存，不能等同于未收集。
• 技术与使用环境：IP 地址、浏览器或设备信息、请求时间、错误及安全日志、地图视口与瓦片区域、必要会话和授权记录。定价或结账可使用 IP 推断的国家及您填写的账单国家。您使用定位按钮或 App 位置功能时，浏览器或系统提供的位置用于地图定位和位置点显示。
• 账单与权益：Paddle 客户、交易、订阅、价格及通知事件编号，状态、权益期限和计划变更；结账机构还处理付款联系信息及付款数据。我们不接收或保存完整银行卡号或安全码，不向 Paddle 提供私人轨迹或活动文件。
• 联系与请求：您发送的邮件内容、账户识别信息、问题描述及处理记录。不要发送密码或 OAuth 令牌。证件或活动资料也请勿主动发送；仅在我们说明必要性并提供适当安全渠道后，才补充确有必要的部分。

3. 信息来源与必要性

您可直接提供账户偏好、上传活动文件或联系我们。Logto 及您选择的社交登录方提供身份资料；您连接的运动平台通过官方授权、活动下载或通知提供运动数据。技术信息由浏览器、操作系统、网络和相应服务商产生。我们不要求您交出运动平台或社交平台的登录密码。

访问公开页面通常不需要账户。登录标识和必要会话用于提供账户服务；没有活动数据无法生成您的个人热图。运动平台连接、设备定位和全球贡献可以分别控制；拒绝可选处理不应影响与其无关的账户或私人地图功能。法定账单信息缺失时，付款机构可能无法完成交易。

我们按功能需要限定使用字段，并以官方授权范围限制后续访问。原始文件不保证在导入前已剔除全部无关字段；如您不愿提供其中的敏感信息，请不要上传或授权传送该文件，并联系我们了解替代方式。您应仅上传有权处理的文件，避免将他人的轨迹或健康信息提供给我们。

4. 使用目的与法律依据

在 GDPR、英国 GDPR 等要求法律依据的制度下，不同处理应分别适用以下依据；不能以一个依据概括全部数据和用途。

• 履行您请求的服务：验证账户、管理偏好，导入与去重活动，生成和展示私人路线、统计及个人热图，处理订阅权益和服务支持。普通个人信息可在履行服务合同所必需的范围内处理；健康等特殊类别信息还必须满足额外条件。
• 同意：依法需同意的健康信息处理、可选全球贡献或非必要设备跟踪，需要对应用途的有效同意；GDPR 第 9 条适用时通常还需要明确同意。运动平台 OAuth 权限和操作系统定位许可分别控制访问，不能替代我们对具体处理目的所需的同意。
• 合法利益：在必要、相称并评估对您影响的前提下，保障账户与系统安全、防止滥用、排查故障和维护服务可靠性。该依据不自动允许处理特殊类别信息或可选贡献。您有权基于自身情况反对依此开展的处理。
• 法律义务：履行适用的税务、会计、安全事件报告、有效法律请求和个人信息权利义务；仅保留与相应义务有关的必要记录。
• 用途限制：我们不出售或出租您的活动、位置或健康数据，不用于定向广告、数据经纪或保险、雇佣和信贷评估。Lumtrk 当前不提供 AI 功能；不将这些数据发送给 AI 模型服务商，或用于训练、微调、评估或改进我们或第三方的 AI / 机器学习模型。

5. 精确位置与健康信息保护

路线可能揭示住所、工作地点、经常到访的医疗或宗教场所及日常安排；心率等指标或与其他信息组合后的轨迹可能属于健康或其他敏感信息。我们按较严格的敏感程度对待这些风险；删除姓名或账号并不保证轨迹匿名。

法律要求明确或单独同意时，需在告知信息类别、必要性、用途、接收方及撤回方式后取得同意。没有适用的有效条件，不应开展相应敏感信息处理。任何基于同意的处理均可撤回；撤回不影响此前基于有效同意进行的处理。我们不会为规避撤回而临时改用合同或合法利益继续同一用途；如有独立法律义务或已告知的其他目的必须保留部分数据，须限定必要范围，特殊类别信息仍须符合其额外条件。

设备定位与已导入的 GPS 文件是不同来源。您可以在浏览器或系统设置中拒绝或撤销前台定位许可，继续查看已导入的地图。Lumtrk 当前没有后台持续录制轨迹功能；App 的位置点及地图 SDK 在使用相关前台功能时可能持续更新位置，具体 SDK 处理见第 10 节。

私人活动的访问按账户控制。我们不将私人活动文件、完整单条轨迹或健康指标直接提供给其他普通用户、广告商或付款机构。全球热图是独立的聚合用途，受第 7 节的资格、保护、选择及撤回规则约束，不等同于公开您的个人活动详情。

6. Garmin 数据与运动平台授权

本节说明 Lumtrk 如何收集、使用、处理和保存 Garmin 数据，以及参与处理的服务商。

• 收集内容：经您授权，我们通过 Garmin Activity API 接收活动通知，并获取活动摘要、详情及活动文件。这些资料可能包含活动类型、时间、距离、设备、GPS、海拔、心率、配速和功率等信息。完整文件或通知可能包含界面未展示的字段。
• 使用目的：用于关联您的账户、导入和整理活动、识别重复记录，以及生成和展示您的私人活动、路线和个人 2D/3D 热图。我们不出售、出租 Garmin 数据，不向广告商提供这些数据，也不向其他运动平台写入您的 Garmin 活动。
• 处理方式：Garmin 数据由本公司控制的服务接收。我们核验授权后整理活动资料、计算路线和热图，并通过您登录的 Lumtrk 账户展示私人结果。
• 存储与保护：账户关联、授权信息、活动文件、同步记录及热图结果保存在由我们管理的私有云存储和服务器环境中。我们采用传输加密、连接凭据加密和账户访问限制等安全措施保护信息；这些措施不代表所有数据均采用端到端加密。
• 服务商处理：Cloudflare 提供云托管、存储和安全服务，会处理运行 Lumtrk 所需的 Garmin 数据。支持热图服务的服务器托管、备份和运维服务商，也可能处理必要资料。身份和付款服务商不接收 Garmin 活动文件或健康指标；地图服务商可能接收地图请求及相关位置或使用信息，但我们不向其上传 Garmin 活动原件或活动指标。具体职责见第 8–10 节。
• 授权与 AI：我们通过 Garmin 官方页面完成授权，不获取您的 Garmin 密码，也不在客户端暴露授权凭据。Garmin 数据不提供给第三方 AI 服务，不用于训练、微调、评估或改进 AI 模型。
• 保存与删除：活动资料在提供您的私人活动服务所需期间保存，并根据删除请求或账户注销流程清理。临时通知副本在处理成功后删除；未处理或失败的副本在接收后 7 天到期并由定时清理移除。这一期限不适用于长期活动资料或备份，其他保存和删除规则见第 11 节。
• 断开连接：您可以在 Lumtrk 断开 Garmin，或在 Garmin Connect 撤销授权。成功断开后停止新同步并清除连接凭据，但不会自动删除已导入的活动和热图。您可申请删除这些资料或注销 Lumtrk 账户；这不会删除 Garmin 平台保留的数据。
• 个人热图与全球汇总：您的 Garmin 活动可在授权范围内用于生成您自己的私人路线和 2D/3D 热图。将多名用户的数据合并并向其他用户提供的全球热图属于独立用途，须符合 Garmin 许可、您的贡献授权和适用隐私要求。连接 Garmin 或默认开启贡献，不自动授权这种用途。全球贡献设置不影响您的个人热图。
• 政策变更：我们会在本页公布更新后的政策。数据收集、使用或共享方式发生重要变化时，会通过网站或应用内通知告知您。涉及新增用途或需要重新授权的变更，我们会在开始相关处理前征求您的同意。您可以拒绝可选用途，也可以撤回已授予的授权。

7. 可选全球聚合热图

全球 3D 热图及其 2D 接续视图用于显示多名贡献者共同经过的路线与热度。当功能提供符合条件的聚合产物时，其他具有访问权限的用户可查看结果；设置开启本身不表示已有产物或您的活动已被公开。纳入范围可包括历史和未来活动，且仅限符合来源使用资格并具备必要法律条件的活动。查看全球热图不以您贡献数据为条件；私人热图与贡献设置分别管理。

当前账户设置中的贡献开关默认开启，您可在数据源面板关闭；默认状态本身不构成有效同意，也不证明您的活动已经进入全球结果。依法需要主动或明确同意的地区和数据类别，必须先具备对应的独立有效同意，才能用于此可选目的。不能以默认勾选、继续使用或运动平台授权代替该要求。

生成和提供全球结果时应用的保护包括空间量化、排除连续轨迹段起终点附近区域、多人贡献门槛，以及不在全球产物中展示姓名、邮箱、账号、活动编号或健康指标。这些措施降低风险，但不能保证不可重新识别；稀疏地区、独特路线和外部信息组合仍可能暴露线索。我们不会仅因去标识化就宣称所有全球数据已不受隐私法律约束。

关闭贡献会停止后续纳入并触发已有贡献撤回；隐藏或删除相关活动也会使其不再符合贡献条件。设置保存成功与旧产物、瓦片和缓存清理完成是不同状态，处理可能异步进行；请以撤回完成状态或支持确认判断结果。我们无法召回他人此前已取得的截图等副本，但不能因此无限期保留我们仍控制且可关联到您的产物。

了解全球 3D 热图贡献

8. 接收方、服务商与披露

除您控制的聚合用途外，我们不向其他普通用户开放私人活动。必要服务商按提供相关功能所需的范围处理信息；作为受托处理方时应受适当合同、保密与安全义务约束。独立处理方的自有用途也受其隐私政策约束。

• Logto 与社交登录提供方：认证、账户恢复及资料管理，涉及身份、邮箱、头像、关联账号和登录记录。社交登录方可能按自己的规则处理登录信息；我们仅接收其实际返回且经字段筛选的资料，不向其发送活动原件、路线或健康指标。
• Cloudflare：通过 Workers 托管网站/API，提供网络安全、D1 业务数据库、队列和私有 R2 对象存储，处理账户记录、连接状态、D1 中加密的连接凭据、原始活动文件、留存通知及请求信息。临时大通知原文可能含授权标识且未做应用层加密。其网络基础设施可能跨多个海外地区处理请求。Cloudflare 作为 Lumtrk 的基础设施服务商处理活动数据；使用私有存储不代表没有第三方参与处理。
• 热图计算与服务器托管服务：本公司控制的 Python 服务解析原件、在 PostGIS 保存路线并生成私人或合格的聚合产物；为该环境提供服务器托管、备份和运维的服务商可能处理必要活动文件、路线或技术记录。公司控制不代表底层服务商从不处理数据，私人热图计算也不只在您的设备上完成。
• 地图服务：OpenFreeMap、Esri / ArcGIS、AWS S3 地形资源以及 App 使用的 Mapbox SDK，可能接收 IP、设备/使用信息、瓦片区域或 SDK 位置遥测。私人活动文件不作为底图瓦片请求正文上传给这些服务，但请求区域可能间接反映您正在查看的位置。
• Paddle：Pro 购买的记录商家，独立处理结账、订阅计费、税务、顾客门户及付款恢复所需数据。定价页可加载 Paddle 价格预览；已识别的 Paddle 客户编号可用于付款恢复服务，结账可预填邮箱和国家。我们仅用必要账单记录管理权益，不发送轨迹或健康数据。
• 您连接的运动平台：处理授权、撤权、活动下载及通知；平台仍按自己的规则保存原账户数据。Lumtrk 删除不能代替您向平台提出删除请求。
• 其他依法披露：只有在有效法律要求、保护人员或系统安全、处理法律主张所必需，或获得您相应授权时，才提供必要信息。企业交易如涉及个人信息，也须受适用法律、保密和用途限制约束；控制主体或用途的重要变化会按第 19 节通知。

9. 海外处理与国际传输保障

Lumtrk 的海外服务器、身份认证、付款、地图及网络服务可能在您所在国家以外处理信息，包括服务商使用的海外数据中心或受控远程访问。数据存储地、请求处理地和服务商总部不一定相同；本政策不作全部数据仅留在欧盟或英国的承诺。

受欧盟 / 欧洲经济区、英国或瑞士国际传输规则约束时，相关传输必须具备适用的充分性决定、有效标准合同条款及必要的补充措施，或其他依法允许的机制；英国可能需要适用的 IDTA 或附录，瑞士需要相应适配。普通的服务商隐私政策、HTTPS 或“您使用服务”不能单独代替传输机制。

您可联系我们了解与您的信息相关的接收方、实际处理地区和所适用的传输保障，并请求其副本或说明；必要时会删去商业秘密或他人信息。本政策列明保障要求，不表示任何未经核验的具体服务商合同、认证或传输评估已完成。

10. Cookie、设备存储与第三方 SDK

登录会话和官方连接流程使用必要存储。Web 运动平台授权有短期浏览器绑定 Cookie，用来防止授权请求被冒用；目前 Garmin、COROS、Intervals.icu 的这类 Cookie 最长 10 分钟，回调后清除，并使用 HttpOnly、SameSite 及 HTTPS 下的 Secure 限制。身份服务也可能按自己的会话规则设置存储。

浏览器本地存储保存语言、主题及热图样式等偏好，会话存储可保存本次提示状态；此类偏好可能保留到您清理网站数据。App 使用系统安全存储、加密会话存储及地图缓存支持登录与显示。退出或切换账户会触发用户级缓存清理，但不会删除服务端数据或原平台数据。

Lumtrk 当前未接入自有定向广告或行为分析 SDK；这不表示第三方 SDK 没有独立处理。Paddle 可在访问定价页时加载，Mapbox 原生 SDK 可能处理位置和使用遥测。我们不把非必要跟踪称为提供私人地图所必需；依法需同意的处理应在相应同意成立后启用。

您可清理浏览器存储、限制 Cookie，并在系统设置管理定位权限；阻止必要存储可能使登录、授权或付款失败。地图 SDK 的遥测及付款机构的选择规则还需参阅其说明；如果您找不到相应控制，请联系我们。拒绝非必要处理不应以强迫购买或禁止无关功能为代价。

11. 保存期限与删除边界

保存期限按数据类别、功能必要性、您的选择和法定义务确定，不因“以后可能有用”无限延长。未设统一固定天数的类别使用下列判断标准；您可询问与自己账户相关的具体保留情况。

• 账户资料、偏好和资料变更记录：通常在账户存续且账户管理或追溯仍有必要期间保存；注销后进入跨系统清理。不能把资料历史理解为永久保存所有身份资料的授权。
• 原始活动文件、轨迹、来源关联与个人热图：通常在账户存续并提供您的私人数据服务所需期间保存，直至相关删除请求或账户清理完成。解绑、退出登录、免费展示窗口结束、Pro 到期或活动隐藏，都不自动删除历史原件。
• 连接授权凭据：在连接有效且同步所需期间加密保存在 D1；成功解绑或撤权处理后清除，不用于其他目的。短期授权事务按到期规则失效。临时通知中的授权信息遵循第 6 节的通知清理规则。
• 通知、同步、错误、安全、隐私请求及撤回记录：按排障、反滥用、证明请求处理和可靠撤回所必需的时间保存。部分可靠清理记录可能在账户主记录删除后短期保留以完成重试；其用途限定于清理和合规，不用于恢复您的活动展示。
• 账单和交易：按适用税务、会计、争议或法律主张的必要期间保留；付款机构可能有自己的法定期限。任何删除例外应限定具体记录和用途，不作为保留全部运动数据的理由。
• 缓存、旧聚合产物与备份：活动存储删除、缓存失效、旧产物撤回及备份轮换可能有不同完成时间。隔离备份中的残留应在适用轮换周期清除，不用于日常处理；如恢复备份，须重新执行有效删除要求。我们不会将请求已入队、返回成功或已退出登录描述为全部副本即时永久删除。

12. 安全措施与事件通知

我们使用 HTTPS、对 D1 中的连接授权凭据加密、经验证的身份及按账户的访问控制、受控内部接口和必要操作记录。这不代表所有授权标识或原文都已做应用层加密。活动原件加密、备份与服务商控制的具体范围取决于实际配置；凭据加密不等于所有信息都采用端到端加密。系统无法保证绝对安全，我们按风险维护和改进措施。

发生个人信息泄露时，我们会调查、限制影响并保留必要记录，按适用法律向监管机构及受影响人员通知。GDPR 适用且事件须报告时，通常须在知悉后无不当延迟并尽可能于 72 小时内通知监管机构；存在高风险时还须无不当延迟通知个人。并非所有事件都适用相同的通知对象或时限。

如发现异常访问或误收到他人数据，请通过隐私联系邮箱报告，只提供判断问题所需的信息，不要继续访问、下载或传播无权查看的数据。

13. 您可以如何控制数据

以下操作的结果不同，请根据目的选择；如功能暂不可用或操作失败，可通过邮箱提出请求。

• 解除连接：停止该来源的新访问并清除本地授权凭据，不自动删除已导入数据。平台撤权还应在原平台检查是否完成。
• 隐藏活动 / 关闭全球贡献：分别控制显示或聚合资格，并触发相应全球撤回；隐藏不是物理删除原件，关闭全球贡献也不删除私人热图。
• 注销账户：可在账户设置完成身份核验及确认后申请。请求成功后账户进入禁用和异步清理流程，依次处理身份、私人轨迹、原件及业务记录，失败会重试；全球贡献另需完成撤回。不具备验证因子或删除依赖不可用时，可联系支持。
• 访问、导出、更正或单独删除历史数据：目前通过 support@lumtrk.com 受理，并按适用法律处理；没有已承诺的一键完整导出功能。需要可携数据时，请说明所需类别，我们会评估适用范围和可用的结构化机器可读形式。
• 订阅与删除：删除 Lumtrk 账户不会自动取消 Paddle 订阅、完成退款或删除付款机构的法定记录。请先通过顾客门户管理自动续费，或联系我们协助，避免账户不可用后仍产生续费。

14. 您的隐私权利与申请方式

适用范围取决于所在地区、法律和具体处理。我们提供隐私联系渠道，并按适用规则处理下列权利；这些权利不是因是否订阅 Pro 才获得。

• 知情、访问与更正：了解信息类别、目的、接收方、期限、来源和保障，获取您的信息副本，更正不准确或不完整资料。
• 删除、限制与可携：符合条件时删除信息、限制争议信息的处理，或取得您提供且依法可携的结构化、常用、机器可读数据；技术可行时可请求传给其他控制者。
• 撤回同意、反对与拒绝：任何基于同意的处理均可撤回；撤回某项功能所需的处理可能使该功能不可用，但不影响无关功能。可基于自身情况反对合法利益处理；适用时拒绝出售、共享、定向广告及限制超出必要范围的敏感信息使用。我们不因您依法行权而歧视、收费升级或降低无关服务。
• 自动化决定：我们会自动执行去重、导入调度、展示范围及订阅权益计算；当前不作仅基于自动化处理且对您产生法律或类似重大影响的个人评估决定。如发生权益错误，您可请求说明、更正并由人员复核。

请向 support@lumtrk.com 发送请求，说明账户邮箱、所在国家或地区、希望行使的权利及范围。可由依法授权的代理人代为提出；需要时会核验代理授权。请勿发送密码、令牌或无关证件。

我们只会要求与风险相称且确有必要的核验信息，优先使用已登录身份或账户现有信息，不以过度收集证件阻碍行权。请求期限按适用法律起算，不能一概从我们完成核验后才开始；撤回、反对或退出类请求也不能无条件要求额外身份核验。

依法存在拒绝、延期或保留例外时，我们会说明理由、适用范围、预计期限及投诉或复核途径。请求通常免费；只有法律允许的明显无依据或过度请求等情形，才可能按规则收费或拒绝，且需说明依据。

15. 欧盟 / 欧洲经济区与英国补充

GDPR 或英国 GDPR 适用于相关处理时，您享有其规定的访问、更正、删除、限制、可携、反对、撤回及监管投诉权利。合同必要性不自动覆盖健康信息；特殊类别条件和海外传输保障分别需要成立。

权利请求须无不当延迟答复，通常在收到请求后一个月内。复杂或大量请求依法可再延长最多两个月，须在首个月内告知原因；仅在适用规则允许时，澄清或必要核验才可能影响计时。我们不以内部排队、异步任务或“已受理”代替实质答复。

您可向通常居住地、工作地或涉嫌违法发生地的数据保护机构投诉，也可向英国 ICO 投诉，无须先放弃其他救济。英国适用的隐私投诉流程通常须在 30 日内确认收件并无不当延迟处理；确认收件不是所有事项均须在 30 日内办结。

公司隐私联系人不等同于依法指定的数据保护官（DPO）或欧盟 / 英国代表。本政策不声称已指定这些法定角色；如适用法律要求，应完成相应指定并公布联系资料。您可先通过本政策邮箱联系我们，不因此丧失监管投诉权。

16. 加州补充告知

CCPA / CPRA 适用于我们相关业务和您的信息时，本节补充一般政策；并非所有企业或所有数据都自动受同一条款约束。其他美国州的适用隐私权利也可通过同一邮箱提出。

收集类别包括标识符和账户信息、商业与订阅记录、互联网 / 网络活动、地理位置、运动文件及可能涉及健康的信息，具体来源和目的见第 2–4 节，接收方见第 8 节，保留标准见第 11 节。精确地理位置、账户访问凭据及有关健康的信息可能属于敏感个人信息；我们不以此建立广告或消费画像。

您可在适用条件下请求知情、访问、删除、更正、数据副本，并限制超出法律允许必要用途的敏感信息使用；也可依法通过代理人申请。可选全球贡献的范围须单独判断，不能仅因服务包含地图，就把任何敏感信息再利用视为必要用途。

我们不按 CCPA 所定义的“出售”或为跨情境行为广告进行“共享”，也不将您的活动、位置或健康信息用于定向广告。因此没有此类用途需要您退出。适用的 Global Privacy Control（GPC）等信号不应被忽略；它与平台解绑、账户注销和全球贡献选择是不同控制，不能将其解读为删除账户请求。

适用的知情、删除或更正请求通常在 10 个工作日内确认、45 个自然日内实质答复；依法需要延长时通知原因，可再延长 45 个自然日。适用的出售 / 共享退出及敏感信息限制通常应尽快且不迟于 15 个工作日处理，不能一律以身份核验作为开始条件。我们会说明依法保留或拒绝的具体原因，您也可向 CPPA 或加州总检察长投诉。

17. 其他地区与消费者健康规则

下列补充只在相应法律适用时生效；更强的强制保护优先，不能以本政策或使用条款排除。需要了解当地请求、复核或监管渠道时，请通过隐私邮箱联系我们。

瑞士：适用 FADP 时可请求有关处理的信息、访问、更正及符合条件的删除或数据交付，并就侵害向 FDPIC 反映或寻求法律救济；跨境保障须符合适用的瑞士要求。

巴西：适用 LGPD 时可请求处理确认、访问、更正、符合条件的匿名化 / 封锁 / 删除、可携、共享信息、撤回同意，以及对符合条件的自动化决定的复核，并可向 ANPD 投诉。期限按具体请求及适用规则处理。

加拿大：适用联邦或省级隐私法时可请求访问、更正、了解处理及在法律和合同限制范围内撤回同意，并向有管辖权的隐私专员投诉。适用 PIPEDA 的访问请求通常须在 30 日内回应，合法延期须说明。

澳大利亚：适用 Privacy Act 及 APPs 时可请求访问和更正，向我们投诉并依法向 OAIC 寻求处理；符合条件的严重数据泄露通知须按 NDB 规则办理。小企业豁免是否适用不能仅凭规模判断，健康信息业务可能有例外。

美国州消费者健康规则：运动和位置资料可能在华盛顿州、内华达州等构成消费者健康数据，即使不适用 HIPAA。相应法律适用时，还须提供所需的专项健康隐私告知、收集 / 共享选择、删除及申诉机制；普通政策、OAuth 或笼统条款不能代替这些要求。我们不出售消费者健康数据，也不利用医疗设施周围的地理围栏识别、跟踪或定向联系就医人员。

18. 未成年人保护

Lumtrk 主要面向成年人，不面向 14 周岁以下儿童。使用条款目前允许符合条件的 14–17 岁用户在监护人指导与同意下使用；这不是免除当地年龄、合同能力或数字同意要求。若适用法律要求更高年龄或经核验的监护人授权，应先满足该要求。

欧盟基于同意向儿童直接提供网络服务的年龄规则因成员国而异，通常在 13–16 岁之间；不能把统一 14 岁当作所有地区都充分。未成年人涉及位置、健康及全球贡献时需要额外审慎与依法有效的授权；一般监护人同意不能被解释为任何公开或聚合用途的无限授权。

如果您认为儿童信息被不当收集，请联系 support@lumtrk.com。我们会核实情况、限制有关处理，并按适用法律删除或采取其他必要措施；不会要求您通过公开发送儿童轨迹证明问题。

19. 政策更新与权利优先

我们会在本页标注版本和最后更新日期。信息类别、用途、重要接收方、贡献规则或权利渠道发生重大变化时，将通过网站、应用内告知或适当的账户通知说明变化；依法需要提前告知时会提前进行。

新用途需要重新同意时，须在开始前取得有效同意；不会把您继续使用服务作为自动同意，或通过更新政策追溯合法化未经授权的处理。若您不同意可选处理，可关闭相应功能或联系我们，不必因此接受无关的新用途。

中英文版本旨在表达相同规则。如翻译、使用条款、争议管辖或其他说明与适用强制隐私保护冲突，以该强制保护为准。您可直接向有权监管机构投诉或行使法定救济，不以先向我们投诉或在公司所在地诉讼为前提。