Privacy Policy

Effective: 3 March 2026 · Last updated: 3 June 2026 · Wersja polska

Data Controller

The data controller is Piotr Kutkowski (Radlin, Poland). Contact: pkutkowski@gmail.com.

Data We Collect

Data	Purpose	Legal Basis
Email address	Registration and login	Art. 6(1)(b) GDPR
Password (bcrypt hashed)	Authentication	Art. 6(1)(b) GDPR
Precise GPS location	Navigation, displaying route in ride mode	Art. 6(1)(a) GDPR — consent
Cycling routes	Route planning	Art. 6(1)(b) GDPR
User ID (UUID)	Linking data to account	Art. 6(1)(b) GDPR
IP address	Security, rate limiting	Art. 6(1)(f) GDPR

An account is optional — guest route plans remain stored locally on the device.

Storage and Location

Routes are stored locally — uninstalling removes data.
GPS is active only while using the app.
Location consent can be revoked in system settings.

Third-Party Services

Mapbox — maps, geocoding, and routing. Data sent: route coordinates. Mapbox Privacy Policy.
Nominatim (OpenStreetMap) — fallback geocoding (when Mapbox returns no results). Data sent: the typed search query (e.g. place name or street address). Servers operated by OSMF. openstreetmap.org/copyright.
Open-Meteo — route elevation profile. Data sent: route point coordinates. Public API, no registration required. Open-Meteo Terms.
Railway (EU-West region) — backend application and database hosting. Data processed: user account, hashed password, session tokens. Railway Privacy Policy.
OpenStreetMap Overpass API — accommodation search near your route (EU servers). Data sent: GPS coordinates of the search area. Data licensed under ODbL. openstreetmap.org/copyright.

Cookies

We use a single technical cookie refresh_token (httpOnly, 7 days, not accessible from JavaScript).

Telemetry

We collect pseudonymous error and crash data (event name, error message, app version, platform, IP address). Telemetry events are sent to our own backend hosted on Railway (EU region). IP addresses are retained by the logging infrastructure for a maximum of 30 days and are not linked to user accounts. Purpose: improving app quality and stability. Legal basis: Art. 6(1)(f) GDPR — legitimate interest.

Data Retention

Account data — deleted when account is deleted.
Session tokens — expire after 7 days.
Telemetry logs — maximum 30 days.

Your Rights

Under the GDPR you have the following rights:

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure — "right to be forgotten" (Art. 17)
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21)
Right to withdraw consent at any time (Art. 7(3)) — withdrawal does not affect lawfulness of prior processing

Route plans are stored locally on your device and can be exported as GPX. To obtain a copy of your account data, email pkutkowski@gmail.com. Account deletion: account deletion instructions.

Complaint to Supervisory Authority

If you believe your data is processed in violation of the GDPR, you have the right to lodge a complaint with the Polish supervisory authority: President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

Obligation to Provide Data

Providing your email and password is voluntary but required to create an account. Without an account you can use the app in guest mode — route plans are then stored locally only.

GPS location consent is voluntary and does not affect basic functionality.

Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Security

Passwords hashed with bcrypt (12 rounds), JWTs expire after 15 minutes.
Refresh tokens hashed with SHA-256.
All connections encrypted via HTTPS, rate limiting, Secure/SameSite flags.

EU Data Storage

Data is hosted on Railway in the EU (eu-west) region. Transfers to Mapbox in the USA are governed by Standard Contractual Clauses (SCC).

Policy Changes

Changes are communicated via in-app notifications.

Contact

Piotr Kutkowski · Radlin, Poland · pkutkowski@gmail.com