Latir Privacy Policy
Last updated: November 10, 2026 · Versión en español
Latir is an app that connects your sport activity with a solidarity goal: every kilometer you run, walk or hike adds up to a monthly goal the community unlocks together. To do that we need some data about you. This policy explains what data, what we use it for, who we share it with, how long we keep it and how you can control it.
We wrote it to be understood. If anything is unclear, write to dev@latir.io.
1. Who we are
The controller of your personal data is Latir S.A. (company in formation), domiciled in Argentina.
- Privacy contact: dev@latir.io
- Website: https://latir.io
2. What data we process
2.1 Your account
When you create a Latir account we process:
- Email and password, if you sign up with email. The password is stored only as a hash, never in plain text.
- Your Google or Apple identity, if you sign in with either: the identifier the provider gives us, your email (Apple may give us a relay address instead of yours) and the name the provider shares.
- Sessions: when you signed in and from which device, to keep you signed in and protect your account.
Identity management (credentials, sessions, Sign in with Google and Apple) is handled by our provider Clerk (see section 4). In our own database we store an internal identifier for your account, the reference to your identity in Clerk, and the creation and last-update dates. We do not copy your email or name into our database.
2.2 Your activities
Latir does not record activities on its own: it does not use your phone's GPS or sensors. Activities come from a Source you connect. Today the Sources are Garmin Connect and Strava, and you can have only one connected at a time: if you connect one, we disconnect the other.
Connecting a Source is optional and requires your explicit authorization on Garmin's or Strava's screen. You can use Latir without connecting any, although without activities you will not add kilometers.
Garmin Connect. When you connect Garmin we ask for permission to share your activities (Activity Export). Without that permission the connection is not completed. We do not request your health data (sleep, steps, all-day heart rate, stress and the like). After each sync of your watch, Garmin sends us the summary of your new activities.
Strava. When you connect Strava we request the
activity:read_all permission, which includes your activities with "Only You"
visibility. If you untick it when authorizing, the connection still works with
activity:read and only your activities visible to everyone or to your followers
count; the app tells you so.
When you connect a Source we store:
- Your user identifier on the Source, the access tokens it issues to us (encrypted), the permissions you granted and the connection date.
- For each activity that counts (running, walking or hiking, with a distance greater than zero), a derived record with these fields and nothing else:
| We store | We do not store |
|---|---|
| The activity's identifier on the Source | Title and description |
| Type (run, walk or hike) and the original sport type | Route, map, coordinates and privacy zones |
| Start date and time | Splits, heart rate, power, cadence, calories |
| Duration | Photos, comments, kudos |
| Distance | Your followers, your clubs, your profile on the Source |
| Whether it was entered manually, whether it was on a treadmill or indoors, whether it was uploaded as a file, the device name | Activities that do not count (cycling, swimming, yoga, etc.): discarded on arrival |
Activities of other sports are not stored at all, not even as "does not count".
Only activities that start after you connect the Source count. We do not import your history.
You are the only person who sees your activities. No other Latir user sees your activities, distances or times. The only thing shared with the community is an anonymous total of kilometers (see section 3).
To prevent fraud, each activity gets a status (valid, under review or rejected) and, if it goes under review, the reasons and the date someone on the team looked at it. In the app you see the main reason your activity is under review. The team receives an internal notice for each activity that goes under review, with its data and your contact email.
2.3 Technical data
Our servers log the requests the app makes (date and time, endpoint, IP address, result) in logs we use to operate the service and troubleshoot. They are deleted after 14 days.
The app uses no third-party analytics or advertising tools, shows no ads and does not track your location. This website uses no analytics or tracking cookies.
3. What we use your data for
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and maintain your account, sign you in and keep it secure | Performance of a contract |
| Fetch your activities from your Source and show you today's, this week's and this month's with their kilometers | Your consent (when connecting the Source) |
| Add your valid kilometers to the anonymous community total that unlocks the month's solidarity goal. The total is a sum; it never shows individual data or identifies you | Performance of a contract |
| Detect activities that need review and review them by hand, so the solidarity goal reflects real effort | Legitimate interest (fraud prevention) |
| Answer your questions and claims | Performance of a contract and legitimate interest |
| Comply with legal obligations and the terms of the providers we use | Legal obligation |
We do not sell your data, do not use it for advertising and make no automated decisions with legal effects on you.
Artificial intelligence. We do not use data from your Sources to train or feed artificial intelligence models, and we do not process it with third-party AI services.
4. Who we share your data with
We work with providers that process data on our behalf, only for the purposes described above:
- Garmin (Garmin International, Inc., USA): a Source of activities through the Garmin Connect API, with the authorization you gave. Garmin processes your data under its own privacy policy. Garmin and Garmin Connect are trademarks of Garmin Ltd.; Latir is not a Garmin product.
- Strava (Strava, Inc., USA): a Source of activities through the Strava API, with the authorization you gave. Strava may collect usage data about that connection under its own privacy policy. Latir is "Powered by Strava" but is not a Strava product.
- Clerk (Clerk, Inc., USA): manages your identity: email, password, Sign in with Google and Apple, and sessions.
- Amazon Web Services (USA, Northern Virginia region): hosts our servers, database and logs.
- Apple and Google: if you sign in with them, they share your identity with us; they also distribute the app through their stores.
- Cloudflare (Cloudflare, Inc., USA): hosts this website and may log technical data about visits, such as the IP address, to serve and protect it.
We share your data with no one else, unless a law or a competent authority requires it.
International transfers. Our providers are in the United States. If you are in Argentina, your data is transferred to a country that may not offer an equivalent level of protection; we do so under contracts with data protection clauses with each provider. If you are in the European Economic Area or the United Kingdom, transfers rely on standard contractual clauses.
5. How long we keep your data
- Your account: as long as you have it. When you delete it, everything associated is deleted (see section 6).
- Your Source's tokens: until you disconnect the Source, revoke it from Garmin or Strava, or Latir loses access. They are deleted immediately. Garmin has one exception: if, when you disconnect, we cannot tell Garmin to stop sending your data, we keep the encrypted token only to retry that request once a day, and delete it as soon as Garmin confirms.
- Derived record of your activities: as long as you have your account. When you disconnect a Source, the activities that already counted stay in your account so your kilometer history does not disappear; you can ask us to delete them at any time (section 7) and we do so within 30 days, with written confirmation.
- Activities you edit or delete on your Source: edits are reflected in Latir. If you delete an activity on Strava, or remove the visibility you allowed us to read, we delete it from Latir within 48 hours. Garmin does not notify us when you delete an activity on Garmin Connect: if you want us to remove it from Latir, write to us and we delete it within 30 days.
- Rejected activities: keep that status as long as you have your account, as a record of the review. You can appeal by email and we look again.
- Technical logs: 14 days.
- Internal review notices: kept in the team's mailbox for at most 12 months.
6. Disconnecting your Source and deleting your account
Disconnect your Source: from the app, under Profile → Tu reloj. You can also do it from Garmin Connect, in the list of connected apps, or from Strava under Settings → My Apps → Revoke Access. In every case we revoke the authorization with the Source and delete the tokens; your next activities stop arriving. You can reconnect whenever you want: activities count from that new connection.
Delete your account: from the app, under Profile. We delete your account in Latir and in Clerk, revoke the authorization on your Source and delete your Integration and all your activities, in the same operation and with no grace period. If you had Garmin connected and we cannot tell Garmin to stop sending your data, we keep your Garmin identifier and the encrypted token only to retry that request once a day, and delete them as soon as Garmin confirms (section 5). Your contribution to the anonymous community total of previous months cannot be undone because it is not linked to you.
If you cannot access the app, write to dev@latir.io and we do it for you within 30 days, with written confirmation.
7. Your rights
You can ask us at any time for:
- Access: what data we hold about you and a copy.
- Rectification: correcting inaccurate data. Activity data is corrected on your Source and Latir reflects it.
- Erasure: deleting your data, all of it or a Source's part.
- Objection and restriction: that we stop using your data for a given purpose, for example activity review.
- Portability: receiving your data in a machine-readable format.
- Withdrawing consent: by disconnecting your Source; it does not affect what was done before.
Write to dev@latir.io from your account's email. We answer within 30 days and confirm in writing when a deletion is complete.
If you are in Argentina, you can also file a complaint with the Agencia de Acceso a la Información Pública (www.argentina.gob.ar/aaip), the supervisory authority under Personal Data Protection Law 25.326. If you are in the European Economic Area or the United Kingdom, with your country's data protection authority.
8. Security
All communication between the app, our servers and our providers is encrypted (TLS). Your Sources' tokens are stored encrypted (AES-256-GCM) with a key that does not live in the database. Access to the systems is restricted to the Latir team and protected with two-factor authentication. If an incident affecting your data occurs, we notify you without undue delay and inform the relevant authorities and providers.
9. Children
Latir is not directed at children under 16 and we do not knowingly create accounts for them. If you believe a child has given us data, write to us and we delete it.
10. Future Sources
We are evaluating adding Apple Health (Apple Watch) and Health Connect (Android) as Sources. Today the app accesses neither. Before enabling a new Source we update this policy and ask for your authorization inside the app; health data arriving through those channels is used only for the purposes in section 3, never for advertising, and is not shared with third parties.
11. Changes to this policy
When something important changes, we let you know in the app before it takes effect and update the date above. The current version is always at https://latir.io/privacy.