Privacy Policy

Last updated: 23 October 2026

1. Who we are

The data controller for yikang is 段益康, an individual / sole trader operating under the laws of China. yikang and Trail Globe are product names only.

• Legal name: 段益康
• Address: 北京市朝阳区酒仙桥街道 酒仙桥北路甲10号电子城IT产业园203号楼北门
• Privacy and support contact: support@yikang.me
• Phone: 18811429539
• Data protection officer (DPO): Not applicable / not appointed

2. Signing in with Strava

The only way to sign in is Connect with Strava (OAuth). We have no passwords or user accounts of our own. We ask Strava for read-only access (read, activity:read_all) to your own activities.

After you connect, our server keeps one session, stored encrypted on our server (no database):

• your Strava access token and refresh token, and when the token expires;
• your Strava athlete ID and first name, so the app can show who's connected.

Your browser gets one HttpOnly session cookie that points to this session. The session becomes disconnected when its Strava access credentials expire, after a maximum of 7 days, when you log out, or when you disconnect Strava, whichever happens first. Logging out ends this device’s session; it does not remove your purchase or end other devices’ sessions. The minimal Strava athlete ID associated with a lifetime purchase is retained with that purchase record, separately from the expiring login session. You can also revoke access at any time in Strava under Settings → My Apps.

3. Your activity data stays in your browser

When you sync, our server asks Strava for your activity list and passes the fields needed to draw the map straight through to your browser: activity ID, name, sport type, start time, distance, moving time and the route line. The server doesn't save them.

Files you import (GPX, FIT, TCX, ZIP) are read in your browser and never uploaded.

Activities and routes are stored in your browser's IndexedDB on your device. Settings such as language and units are kept in local storage. Local activity data has no automatic expiry and remains in this browser until you remove it. You can delete it in Settings → Delete all data, or by clearing your browser's site data. Signing out or switching accounts also clears this browser's activity data to keep accounts separate. Browsers may remove local storage in private browsing or when device storage is low.

4. Home privacy zone

By default, the app finds places where many of your activities start or end (usually home or work) and fades your routes out within about 500 m of them. This runs on your device and applies to the map and to films. You can turn it off in Settings (“Fade routes near home”). It reduces what others can see in your exports, but it isn't a guarantee, so check a film before you share it publicly.

5. Films

By default, films are rendered and encoded on your device, and nothing is uploaded.

Our server also has a video-encoding endpoint (FFmpeg) that the current app doesn't use. If it's ever used, the rendered video frames (images, not your GPS files) are uploaded temporarily and encoded into an MP4. The frames are deleted once encoding finishes. The MP4 is kept for at most 10 minutes so you can download it, and every job is deleted no later than 30 minutes after it starts.

6. Server logs

Like most websites, our web server writes standard access logs: IP address, time, requested URL, browser user agent and referrer. We use them only for security and troubleshooting. They are rotated daily and deleted after 14 days. The app's service log also records your Strava athlete ID when you connect.

7. No ads, no tracking

We only count anonymous usage. Our own server counts how often features are used (for example “a globe was created” or “a film was exported”), without cookies, and never records your routes, locations, names or Strava account. To count visitors once per day, the server combines your IP address and browser type with a secret value that changes every day and keeps only the resulting one-way code; the IP address itself isn't stored, and visits can't be linked across days. We keep only the country, language, device type and the referring website's domain. For page views we keep only the page path (without query parameters), the referring website's domain and, if you arrived through a tagged link, its utm_source. The country is looked up on our server with IP Geolocation by DB-IP (CC BY 4.0). These counts are kept for 13 months.

Starting view. If you haven't connected Strava, the globe first turns to your approximate city from your IP address, looked up on our server with the same DB-IP database. The IP address and the result aren't stored.

yikang has no advertising, no third-party analytics or tracking scripts, and no third-party cookies. We use the session cookie (section 2), a short-lived security cookie during Strava sign-in (10 minutes), and an HttpOnly purchase cookie to restore paid style access. The purchase cookie lasts up to 400 days and is renewed when you use the Service. Lifetime purchases are linked to your Strava athlete ID, so signing into the same Strava account on another browser or device restores access automatically. A recovery code can restore access only for the signed-in Strava account that owns that purchase. We retain that purchase-to-athlete association, purchase references, delivery identifiers and entitlement status separately from your activity data; deleting local activity data does not delete a lifetime purchase. We do not store card details in these records. We do not sell your personal information, including a sale as that word is used under the CCPA. We don't use your data to train AI models.

8. Third-party services

To show the globe, your browser loads map tiles directly from the providers below. Like any website, they receive your IP address and which map tiles are requested.

9. Earlier waiting-list sign-ups

We no longer take sign-ups. If you signed up to our earlier waiting list, we keep the details you gave us (name, email address, country and any optional details) only to follow up with you. We don't sell them or share them for advertising, and they are never linked to Strava data.

We keep them for 24 months, then delete them, unless the law requires us to keep them longer. You can ask to see or delete them at any time by emailing support@yikang.me.

10. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California law), you can ask to access, correct, delete or export your personal data, restrict or object to how it is processed, or withdraw consent where we rely on consent. Almost everything is on your own device and under your control. To remove what our server holds, log out or disconnect Strava. For anything else, email support@yikang.me. We respond within 30 calendar days. You can also complain to your local data protection authority.

We process data to provide the service you ask for (the service you request, including any optional paid unlock) and, for security logs, for our legitimate interest in keeping the service secure. Our server is located in Hong Kong, so your data may be processed outside your country.

11. Children

yikang is for people who are at least 18 years old, the same minimum age as our Terms of Service. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us information, email support@yikang.me and we will delete it.

12. Changes

If this policy changes, we'll update the date at the top of this page. If a change is significant, we'll also announce it in the app.