Privacy and cookie policy
Last updated: 19 October 2026
Lakelegends uses your data for one thing: running this website and making it better. We don't sell it, we don't use it for advertising, and we don't track you.
1. Who is responsible for your data
The controller of your personal data under the General Data Protection Regulation (GDPR, EU 2016/679) is:
North-wind
Kreniststraat 70
3583 Paal
Belgium
E-mail: simon@north-wind.com
2. Which data we collect
- Account data: your e-mail address, your sailor name, your password (stored only as a one-way encrypted hash, never readable, not even by us), when you created your account, when you last logged in, and when you accepted this policy.
- Activity data: the files you upload (GPX, FIT, TCX) and the GPS points in them: positions with date and time. This shows where you were and when, so we treat it with care. We only keep the position and time of each point. Other data in your file, such as heart rate, is not stored in our database, but it stays in the original file you uploaded.
- Race data: races you create (name, description, zone or marks, dates), races you join, and your results.
- Security data: when a login fails, we record the e-mail address entered and your IP address to stop password guessing.
- Server logs: our hosting provider automatically records technical data for each visit, such as IP address, browser type, the page requested and the time.
We don't ask for, and don't want, any sensitive data such as health data. Please don't put personal information about others in race names or descriptions.
3. Why we use your data, and on which legal basis
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Creating and running your account, scoring your uploads, showing leaderboards, letting you create, join and share races | Performance of our agreement with you (6.1.b) |
| Keeping the site secure: blocking password guessing, detecting misuse and cheating | Legitimate interest in a safe and fair service (6.1.f) |
| Improving Lakelegends, for example making scoring more accurate and filtering GPS errors better | Legitimate interest in improving the service (6.1.f) |
| Keeping records we are legally required to keep | Legal obligation (6.1.c) |
4. Your data is used only for Lakelegends
All data you upload or enter is used only to provide the Lakelegends website and to improve this website. In particular:
- We never sell, rent or trade your data.
- We don't use it for advertising, marketing or profiling, and we don't send you newsletters unless you ask for them.
- We don't use it for any other product or service, and we don't share it with third parties except the service providers listed in section 6, who work only on our instructions.
- When we analyse data to improve the website, we use combined or pseudonymised data wherever possible, so that the analysis doesn't identify you.
5. What other people can see
- Your sailor name, your results, the time of your best result and the sport and boat of that session are shown on the leaderboard of every race you join. For a public race, anyone with the link can see it; for an invitation-only race, people with the invite link can see it.
- As a race creator, your sailor name is shown on the race page.
- Your tracks and uploaded files are private. Other users never see them, only the result they produced.
- Your e-mail address is never shown to anyone.
Tip: choose a sailor name that you're comfortable showing publicly. It doesn't have to be your real name.
6. Service providers
- Hosting: hostinger.nl stores the website and database for us as a processor, under a data processing agreement (Article 28 GDPR), inside the European Union.
- Maps: map images are loaded by your browser directly from the OpenStreetMap Foundation (United Kingdom, which has an EU adequacy decision) and OpenSeaMap (Germany). Like any website your browser contacts, they receive your IP address. See the OpenStreetMap privacy policy.
- Place search: only when you use "Find a lake or place" when creating a race, the text you type is sent to OpenStreetMap's Nominatim service.
- Share buttons: these are plain links. Nothing is sent to WhatsApp, Facebook or your e-mail program unless you click one.
We don't use Google Analytics or any other analytics, advertising or social media tracking.
7. How long we keep your data
- Account, activity and race data: as long as you have an account. You can delete single activities at any time on the Upload page.
- When you delete your account, your account, all your uploaded files and tracks, your results, and the races you created are deleted immediately. Copies in backups are overwritten within 30 days.
- Failed login records: 24 hours.
- Server logs: kept by our hosting provider for a limited time, at most 30 days.
8. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it;
- have incorrect data corrected;
- have your data erased;
- restrict how we use your data;
- data portability: receive your data in a machine-readable format;
- object to our use of your data based on legitimate interest, including for improving the website. We will then stop, unless we have compelling reasons.
You can do most of this yourself on your Account page: download all your data as a file, or delete your account. For anything else, e-mail us at simon@north-wind.com. We answer within one month.
If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or the data protection authority in the EU country where you live.
9. How we protect your data
Connections are encrypted (HTTPS). Passwords are hashed with Argon2id. Uploaded files are stored outside the public part of the website and are only available to you. Access to the database is limited to the website itself and the people who run it.
10. Minimum age
You must be at least 13 years old to create an account. If you are under 16, please ask a parent or guardian before you sign up.
11. Cookies
Lakelegends uses one cookie, and it is strictly necessary:
| Name | Purpose | Duration | Type |
|---|---|---|---|
ll_session | Keeps you logged in and protects forms against misuse (CSRF) | Until you close your browser or log out; you are logged out after 14 days without activity | Strictly necessary, first party |
Strictly necessary cookies don't need consent under the ePrivacy Directive (2002/58/EC, Article 5(3)) and the Belgian Electronic Communications Act, which is why there is no cookie banner. We don't use analytics, advertising or tracking cookies, and no third-party cookies are set through our pages. If we ever want to use other cookies, we will ask for your consent first. You can delete cookies in your browser settings at any time; you will then be logged out.
12. Changes to this policy
If we change this policy in a way that matters, we will tell you on the website or by e-mail before the change takes effect. The date at the top shows the latest version.