Privacy Policy
Last updated October 24, 2026
- Your ride files are read and saved in your browser. Files you load are never uploaded to us. If you connect Hammerhead or Wahoo, ride files from your Karoo or Wahoo device pass through our server on their way to your browser, and we don't keep them. If you connect Garmin, each new ride file is collected from Garmin when it syncs and held on our server, encrypted, until your browser brings it in, then deleted (after 30 days at most).
- To draw terrain and estimate wind, Segment Atlas asks public map and weather services about a place and a date. It never sends them your ride file.
- An account is optional. If you sign in, we store your route outlines and short ride summaries so they appear on your other devices. Never your GPS tracks or sensor data.
- There are no ads, no analytics, and no tracking cookies. We don't sell or share your information.
Who we are
Segment Atlas is a 3D ride replay and route analysis tool for cyclists at segmentatlas.com. It is operated by Zachary Donnenfield. In this policy, "we" means the operator, and "you" means anyone using the site.
Questions or requests: zachary.donnenfield@gmail.com.
What stays in your browser
Segment Atlas does its work in your browser. These are saved there, on your device, and nowhere else unless you sign in:
- Rides: the GPS track and any heart rate, power, cadence, speed and elevation data from the FIT or GPX files you load, along with names, colors and favorites you set.
- Original ride files, only if you turn on Keep original files in My Rides.
- Routes you build, and the terrain and imagery downloaded for them.
- Settings and your rider model (system mass and drag area), pace plans, and your last session.
- A copy of the site's own files, so it loads faster and works offline.
This data lives in your browser's storage for this site. Your browser may clear it if your device runs low on space or you clear site data. You can delete individual rides and routes, or everything at once with Delete all data in My Rides.
What leaves your browser
Some features need information from outside services. Each request goes straight from your browser to that service. Your ride file is never sent to any of them.
| Service | When | What it receives |
|---|---|---|
| GitHub Pages | Every visit | Hosts the site. Like any web host, it receives your IP address and browser details with each request. See GitHub's privacy statement. |
| Google Fonts | Every visit | Serves the Source Serif 4 typeface. Receives your IP address and browser details. See Google Fonts privacy. |
| U.S. Geological Survey (The National Map) | When you build a route or regenerate its terrain, the first time you open a built route, and when you view a ride's map in the Rides tab | For routes, the rectangular map area around the route and the requested resolution, for elevation, imagery and water data; and, for sharper imagery along the route, the blocks of ground about 1 km square that the route passes through, which together show roughly where the route goes. For a ride's map, requests for the map tiles covering the area shown, as you zoom and pan, which your browser may cache. Not your ride file or timestamps. |
| Open-Meteo | When wind is estimated for a ride, and for Best Window forecasts | One point on the route (the middle of the effort, or the middle of the route) and the date range. Not your ride file. See Open-Meteo's terms. |
These services also see your IP address, as with any web request. We don't control how they handle it.
Share & Export creates images, CSV files, videos and session files in your browser. Nothing is sent anywhere unless you choose where to send it, such as saving the file or using your device's share sheet.
If you create an account
Signing in is optional. Everything above works without it. An account keeps your routes on every device you use.
Signing in with Google
You sign in with your Google account. Google tells us your account ID, your email address, and your name. We don't receive your password, and we can't see your Gmail, contacts, files or anything else in your Google account.
We use this information only to sign you in and to show which account you're using. We don't sell it, share it, use it for advertising, or use it to train AI models. Segment Atlas's use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
Using the Google sign-in button loads Google's sign-in service, which may set Google's own cookies. See Google's privacy policy. You can remove Segment Atlas's access at any time from your Google account connections.
What your account stores
- Your profile: Google account ID, email address, display name (your Google name to start), and a home region if you set one.
- Sign-in sessions: a scrambled (hashed) form of the session key, when it was created and expires, and a short description of your browser.
- Routes you build: the route line, start and finish points, sections, name and distance, plus its elevation summary (climbing, highest and lowest points) and where it crosses bridges or runs through tunnels. A route line shows where you ride, which may be near where you live. Bridges and tunnels are found in your browser by comparing a ride's recorded elevation with the terrain; only their positions are stored, not the ride's elevation.
- Ride summaries: the ride's name, start date and time, which route it was on, total time and distance, effort time and distance, whether the effort was complete, and whether you marked it a favorite.
- A Hammerhead connection, only if you connect one: your Hammerhead user ID, when you connected, the keys that let us fetch your rides (encrypted), and the IDs of Karoo rides waiting to be brought into your browser.
- A Wahoo connection, only if you connect one: your Wahoo user ID, when you connected, the keys that let us fetch your rides (encrypted), and the IDs and start times of Wahoo rides waiting to be brought into your browser.
- A Garmin connection, only if you connect one: your Garmin user ID, which kinds of data you chose to share with us, when you connected, the keys that let us fetch your rides (encrypted), and the IDs, start times and recording device model (for example Edge 1050) of Garmin rides waiting to be brought into your browser.
Your account never stores ride files, GPS tracks, heart rate, power, cadence, terrain or your settings. Those stay in your browser.
Connecting Hammerhead
If you have a Hammerhead Karoo, you can connect your Hammerhead account so your rides arrive in Segment Atlas without uploading them. You approve the connection on Hammerhead's own page, which asks only to read your activities. We never see your Hammerhead password, and we never change anything in your Hammerhead account.
When a ride syncs from your Karoo, Hammerhead tells our server its ID. The next time you open Segment Atlas, your browser asks our server for the ride file, and our server fetches it from Hammerhead and passes it straight on without saving it. Your browser then reads it like any file you load, and it stays there. Hammerhead is run by SRAM; see SRAM's privacy policy.
Connecting Wahoo
If you ride with a Wahoo ELEMNT bike computer or the Wahoo app, you can connect your Wahoo account the same way. You approve the connection on Wahoo's own page, which asks to read your profile and your workouts and to tell us when a new one arrives. We never see your Wahoo password, and we never change anything in your Wahoo account. Only outdoor rides are brought in; other workouts are ignored.
When a ride syncs to Wahoo, Wahoo sends our server a notice about it. We keep only the ride's ID and when it started, and nothing else from the notice. The next time you open Segment Atlas, your browser asks our server for the ride file, and our server gets it from Wahoo and passes it straight on without saving it. See Wahoo's privacy policy.
Connecting Garmin
If you ride with a Garmin device, you can connect your Garmin Connect account. You approve the connection on Garmin's own page, where you choose what to share; Segment Atlas needs only your activities. We never see your Garmin password, and we never change anything in your Garmin account. Only outdoor rides are brought in; other activities are ignored and never downloaded.
Garmin works differently from Hammerhead and Wahoo: when a ride syncs, Garmin sends our server a link to the ride file that can be used only once, within 24 hours. So our server downloads the file straight away and keeps it, encrypted, until your browser next brings rides in. The copy on our server is deleted as soon as your browser has it, and in any case after 30 days. Besides the file, we keep only the ride's ID, start time and the model of the device it was recorded on, which Segment Atlas shows next to the ride ("Garmin Edge 1050") as Garmin requires. See Garmin's privacy notice.
Where it's stored
Account data is stored with Cloudflare, which runs the account service and its database. Garmin ride files waiting for your browser are held, encrypted, in Cloudflare's file storage (R2). Cloudflare processes requests on our behalf and keeps short-lived operational logs. See Cloudflare's privacy policy.
How long we keep it
- Your account data is kept until you delete it or delete your account.
- Sign-in sessions expire after 30 days and are then removed.
- A Karoo ride's ID is kept until your browser has brought the ride in, then for a few more days so the same ride isn't brought in twice. Disconnecting Hammerhead removes the connection, its keys and every ride ID right away, and asks Hammerhead to revoke our access.
- Wahoo ride IDs are kept the same way. Disconnecting Wahoo removes the connection, its keys and every ride ID right away, and asks Wahoo to revoke our access.
- A Garmin ride file is deleted from our server as soon as your browser has brought it in, and after 30 days in any case. Its ID is kept a week longer, so the same ride isn't brought in twice. Disconnecting Garmin deletes the connection, its keys, every ride ID and every held file right away, and tells Garmin to remove the connection.
- When you delete a route or ride, its content is erased from your account right away. We keep only its ID and the time it was deleted, so your other devices know to remove it too.
- When you delete your account, all of its data is removed right away. Database recovery snapshots may hold a copy for up to 7 days before they expire.
Your choices
In the app, under Account (the Sign in button, or your initials, at the top of the map), you can:
- Download account data: everything your account stores, as a JSON file.
- Sign out: your routes and rides stay in that browser.
- Connect or disconnect Hammerhead: rides already brought in stay in your browser. You can also remove Segment Atlas's access from your Hammerhead account.
- Connect or disconnect Wahoo: the same, for Wahoo. You can also remove Segment Atlas's access from your Wahoo account.
- Connect or disconnect Garmin: the same, for Garmin. You can also remove Segment Atlas from your Garmin Connect account, or turn off activity sharing there, which stops new rides arriving.
- Delete account: removes your account and everything stored in it. Everything saved in your browser stays.
To correct anything else, or for any request about your data, email zachary.donnenfield@gmail.com.
Cookies
Segment Atlas sets one cookie, and only while you're signed in: __Host-sa_session on api.segmentatlas.com. It keeps you signed in for up to 30 days, and the site's scripts can't read it. There are no advertising, analytics or tracking cookies.
The site also uses your browser's storage for the data described in What stays in your browser.
Children
Segment Atlas isn't directed to children under 13, and we don't knowingly collect information from them. If you believe a child has created an account, contact us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects what an account stores or who it's shared with, we'll also say so in the app before it takes effect.