Lapper1Home

Privacy Policy

Last updated: 10 November 2026

This Privacy Policy explains how UAB Lapper1 ("we", "us") collects and uses personal data when you use the Lapper1 mobile app, the Lapper1 companion apps for smartwatches, and the Lapper1 website (together, the "Service"). Lapper1 records GPS data during track sessions to time your laps, and lets you share tracks, compare lap times and connect with friends.

1. Who is responsible for your data

The data controller is UAB Lapper1, Taikos pr. 4A-52, Kaunas, Lithuania, company code 308180884. For any privacy question or request, contact us at privacy@lapper1.com.

2. What data we collect

Account data

  • Email address and password (stored hashed by our authentication provider).
  • If you sign in with Google, Apple or Facebook: your name, email address and an account identifier provided by that service. We do not receive your password for those services.

Profile data you choose to add

  • First and last name, nickname, profile photo and nationality.
  • Home location (used to suggest tracks near you).
  • Vehicles you add (for example make, model or name).
  • App preferences and privacy settings.

Location and session data

  • Precise GPS location, speed, time and route while you record a session. With your permission, the app can keep recording location in the background (for example with the screen locked) so a session is not interrupted. We only collect location while a session is being recorded, not at other times.
  • GPX files you import, and the sessions, laps, lap times and tracks created from them.
  • Data recorded by a connected smartwatch companion app (currently Apple Watch; support for other watches such as Garmin and Wear OS devices may be added), such as GPS location and session timing, which is synced to your account.

Social data

  • Friend requests, friend connections and invite links.
  • Comments you post on tracks.
  • Lap times you share to leaderboards.
  • Notifications we generate for you (for example new friend requests or comments).

Technical data

  • IP address, browser or device type and request logs, processed by our hosting and backend providers to deliver and secure the Service.
  • Data stored on your device (local storage) so the app works offline and keeps you signed in.

We do not use advertising, ad tracking or third-party analytics, and we do not sell your personal data.

3. Why we use your data and our legal basis

  • Providing the Service (account, recording and timing sessions, storing and syncing your tracks and sessions across devices, friends, leaderboards, comments, notifications): performance of our contract with you (Art. 6(1)(b) GDPR).
  • Location data: collected only after you grant the location permission on your device; you can withdraw it at any time in your device settings. Without it, live session recording does not work, but you can still import GPX files.
  • Security, abuse prevention and fixing problems: our legitimate interest in keeping the Service safe and working (Art. 6(1)(f) GDPR).
  • Legal obligations, such as responding to lawful requests from authorities (Art. 6(1)(c) GDPR).

4. What other users can see

  • By default other signed-in users can see your public profile: display name (your full name or nickname, as you choose), profile photo and nationality. You can hide your profile in Settings.
  • Tracks you publish to the community, comments you post, and lap times you share to a leaderboard are visible to other users. Some leaderboards can be limited to friends.
  • Your private sessions and tracks are visible only to you.

5. Who we share data with

We share personal data only with service providers that process it on our behalf under a data processing agreement:

  • Supabase: authentication, database and file storage. Data is hosted in Ireland (West EU).
  • Vercel: hosting of the website.
  • Google, Apple and Facebook (Meta): only if you choose to sign in with them.
  • Map providers (Google Maps in the mobile app, OpenStreetMap on the website): to display maps, your device requests map images for the area shown, which reveals your IP address and the map area to the provider.

We may also disclose data if required by law or to protect the rights and safety of our users.

6. Requests from public authorities

We may receive requests from law enforcement, courts or other public authorities for personal data about our users. We handle every such request as follows:

  1. Legality review. Before responding, we check that the request is legally valid, issued by a competent authority, and that we are legally required to comply with it.
  2. Challenging unlawful requests. If a request is unclear, too broad or unlawful, we ask for clarification, push back, or challenge it through the legal means available to us. We disclose nothing until we are satisfied the request is lawful.
  3. Data minimization. When we must comply, we disclose only the minimum personal data strictly needed to satisfy the request.
  4. User notification. Where the law allows, we notify the affected user before disclosing their data.
  5. Documentation. We keep a record of every request we receive, including the requesting authority, the legal basis, our assessment and reasoning, and the data we disclosed (if any).

7. International transfers

Some providers above are based in, or may access data from, countries outside the European Economic Area, such as the United States. In those cases we rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

8. How long we keep data

We keep your data while your account is active. When you delete your account, your personal data is deleted immediately (backups within 30 days), except:

  • Community tracks you published that other riders are still using may be kept without any link to you, so their sessions keep working.
  • Backups are overwritten on a rolling basis.
  • Data we must keep to meet a legal obligation.

9. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • correct inaccurate data (most profile data can be edited in the app);
  • delete your data and account;
  • receive your data in a portable format (you can export your tracks and sessions in Settings);
  • restrict or object to processing based on our legitimate interests;
  • withdraw a permission or consent at any time.

To use any of these rights, email privacy@lapper1.com. We will reply within one month. You also have the right to complain to a data protection supervisory authority in the EU country where you live or work, or where you believe an infringement took place.

10. Deleting your account and data

You can delete your account at any time in the app or on the website under Settings > Danger zone > Delete account. This immediately deletes your account and the data described in section 8. If you can no longer sign in, email privacy@lapper1.com from the address linked to your account with the subject "Delete my account". This also applies if you signed in with Google, Apple or Facebook; you can additionally remove Lapper1's access in the settings of your Google, Apple or Facebook account.

See the Account & Data Deletion instructions.

11. Security

Data is encrypted in transit (HTTPS) and access to it is restricted by account-level access rules in our database. No system is completely secure, but we work to protect your data and will notify you and the authorities of a data breach where the law requires it.

12. Children

The Service is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the Service changes. We will change the "Last updated" date above and, for significant changes, notify you in the app or by email.

14. Contact

UAB Lapper1, Taikos pr. 4A-52, Kaunas, Lithuania. Email: privacy@lapper1.com.