Privacy Policy

Your files

Activity files you upload (FIT, GPX or TCX) are transferred to our server and processed there. We use them only to run the health check, merge, repair and conversion you asked for, and we store the uploaded files and their outputs only so you can review the results and download them.

• Automatic deletion: stored files and outputs are deleted 24 hours after processing.
• Manual deletion: you can delete a file sooner yourself; the stored data is removed at the same time.
• No secondary use: we do not sell, share, rent, or mine your activity data, and we do not use it to train models.
• Access: your files are tied to your account (or, for guest runs, to an unguessable job ID) and are not listed publicly or indexed by search engines.

Your account

We store your email address and a salted password hash (never the plain password), your plan and usage counters, your saved stream profiles on Pro (your per-stream source preferences only — profiles never contain your activity data), and subscription identifiers provided by our payment processor.

Payments

Payments are processed by Paddle, our merchant of record. We never see or store your card number. Paddle's own privacy policy governs the payment data you give them.

Logs

Server logs record request metadata (time, route, status) for security and debugging. File contents, passwords and payment secrets are not written to logs.

Cookies

We use one essential cookie: a signed session cookie that keeps you signed in. We do not use third-party advertising cookies.

Contact

Privacy questions: support@mergegpxfiles.xyz.