Privacy policy

Who is responsible

The controller of your data, in the sense of the GDPR, is:

Write to that address about anything on this page, or to use any of your rights.

In short

• This website sets no cookies, has no forms and no analytics, loads nothing from anyone else, and its log keeps no IP address.
• The app works without an account. Without one, the routes you plan are saved only on your phone; to draw their roads, our server sends their points to GraphHopper, which keeps its request logs for up to five weeks.
• With an account, we keep what you save so that it is there on any phone: your profile, your Dream Trips, your recorded rides, your bikes and your privacy zones.
• Your location is used on your phone. It leaves the phone only when you use it for something, as listed under Your location.
• When you record a ride, the app records it on your phone, in the background too if you allow it. Without an account, nothing of it reaches our server. With an account, each ride you keep goes to your account as well: its whole track, every position with its time and height. Your phone keeps its own copy (see Rides in your account).
• With an account, you can download in the app everything our database holds about you (the few things left out, and why, are under Your rights), and delete your account.
• If something does not work, you can send us a problem report: it is made on your phone, you read all of it first, and it reaches us only if you send it yourself (see Problem reports).
• We keep no backups today: our one server holds our only copy of what you save, your recorded rides included, apart from a copy of its whole disk that we take before an update that changes the database and delete within 7 days. Your phone keeps its own copy of every ride it recorded until you delete it.
• Nobody else receives your data, except the services named under Who else receives what, for the job named there.

This website

romboride.com is a set of fixed pages, served from our server in Helsinki. It sets no cookie, has no form and no analytics, and asks your browser to load nothing from anyone else: even the fonts come from us.

If you open the bare address, your browser's preferred language decides whether you land on the English or the German pages. It is read for that answer and not stored.

For each request to this website, our server logs the time, the page's address (without anything after a question mark), the answer's status and size, and how long it took. It does not log your IP address, your browser, the page you came from or your language. This log is limited by size, not by time; see How long we keep what.

Our pages ask your browser not to tell the next website you open that you came from us.

The app without an account

The first time you open the app, it creates an anonymous identity on our server: a random ID, with no name and no email address. It lets the app work without an account, and it carries the Sunday Button's monthly meter.

With it we keep your sign-in sessions (when each one started, when it was last renewed, when it ends) and the key that renews a session, only in scrambled form (as a hash). We do not record your IP address, your device's name or your browser there.

Without an account, the routes you plan are saved only on your phone. To draw a route's roads or its weather, the app sends its points to our server, which keeps them only in its memory, for up to 30 minutes, and asks the services named under Routing, weather, place search and the map. GraphHopper, which works out the roads, keeps its request logs, with the points, for up to five weeks.

Our server deletes an anonymous identity, with its sessions, in its weekly clean-up once it has not been used for 90 days. If it ever pressed the Sunday Button, it is kept until those records are gone, which can be up to about 15 months after its last press (see How long we keep what). Deleting the app removes what it stored on your phone.

Your account and signing in

This part is about your account and how you sign in. What an account keeps of what you save is under What you save.

When you create an account with your email address, we keep the address once you have confirmed it, and when you confirmed it. We keep your password only as an argon2id hash: nobody at RomboRide can read it.

Until you confirm, your sign-up waits in a one-time link that works for 24 hours; it holds the address, the password hash and your language. A used link keeps neither. An unused one is deleted 7 days after it stopped working, so an unconfirmed address is gone after about nine days at most. A link to reset your password works for one hour and is deleted the same way.

If you choose to sign in with Google, the sign-in happens between your phone and Google, which handles it as the controller of your Google Account. From what Google sends us, we keep only your Google account's ID and, if Google says it is verified, your Google email address. We do not read or keep your name, your picture or anything else. Our server sends Google nothing about you: it only fetches Google's public keys to check the sign-in.

Your sessions are kept as described above, with no IP address, device name or browser. A session ends after 60 days without use, when you sign out, when you ask to delete your account, or when we end it to protect your account. Each renewal spends the key it used. A spent key keeps its time only until the next renewal (30 days at most); after that we keep only its hash, with no time, for as long as the session lives, so that a stolen key is recognised whenever it is used, and the session is then ended. So no record says when you used the app, beyond when each session started and when it was last renewed. When a session has ended, its spent keys are deleted the following night, and the session itself (its dates and how it ended) with its last key 30 days after it ended. We keep that month so that we can answer "why was I signed out?" and see whether someone else was on your account.

Moderators and admins also sign in with a second step: we keep its secret encrypted and its recovery codes as hashes, until the account is deleted, and we count wrong answers in the database, so that a lock survives a restart. A set-up that was started and never finished, and a recovery code once it is used, are deleted 30 days later.

What you save

With an account, we keep what you save, so that it is there on any phone you sign in on:

• Your profile: your username, home country, language and units, the riding styles you chose, the badges you pinned, and your account's number (the order in which accounts were made, used for the founding-rider badge). It also holds your role (rider, moderator or admin) and whether the account is active or blocked; if an admin ever blocks an account, the time and the admin's reason are kept with it. There is no email address and no real name in your profile.
• Your badges: which ones you earned, when, and under which version of the rules.
• Your Dream Trips, the routes you save: the title and notes, the places you chose (their coordinates, which may include your home), the road between them and its numbers, the planned date, the riding mode and the gravel setting. We also keep the newest 20 versions of each route.
• Your recorded rides: each ride you keep, with every position of its track; what exactly, and what we never receive, is under Rides in your account.
• Your bikes: the kind of vehicle (a motorcycle), make, model, year, the odometer reading when you added it, and whether a bike is archived. No photo, no frame number, no plate.
• Your privacy zones: the name you give each one, a point (a place you want hidden, usually your home) and a radius between 200 m and 5 km. Our server gives a zone back only to you; no admin screen shows it (only an export made on your behalf contains it, and that is recorded), and its coordinates are never written to our logs.

Each saved change records which of your phones made it, by a random ID the app creates when it is installed. It is never a hardware ID.

When you delete a Dream Trip, it disappears from all your phones, and on our server its title, notes, date, places, line and numbers are erased at once, together with its versions. What remains is a marker (its ID, when it was deleted, its sync number, and three settings that are not your words: where the route came from, the riding mode and the gravel setting) so that your other phones learn it is gone; the marker goes when your account does.

One exception: if the Dream Trip was a loop you kept from the Sunday Button, the same loop is also one of that press's suggestions, and stays there until a week after the month ends (see The Sunday Button).

When you delete a bike, its make, model, year, odometer reading and the ID of the phone that added it are erased at once; what remains is its ID, its kind, whether it was archived, and its dates. When you delete a privacy zone, its name, its point and the phone's ID are erased at once; what remains is its ID, its radius and its dates. Both markers go when your account does.

So that saving stays safe when the connection drops, we keep a short record of each change your phone sends: which item (by its ID; the ID of a recorded ride or of one of its parts tells when it was made, so about when you rode), whether it worked and an error code, never its content. We keep it for at least 90 days, then delete it.

The Sunday Button

Each press asks our server for loops. To find them, our server sends the point they start from, at full precision, with points around it, to GraphHopper (see Routing, weather, place search and the map). For each press we keep your identity's ID (anonymous or with an account), the month, that start point (where you are, or the middle of the map when the app does not know where you are), the loops we suggested, whether it worked, how many routing requests it used, and a fingerprint of the question: that point rounded to an area of about 1 km, the loop's length and the month.

We keep them so that the meter (three presses a month, free for everyone) counts honestly, and so that asking the same thing twice gives you the same answer instead of counting twice. The limit of six presses an hour is counted from these same records.

The start point, the suggested loops and the whole fingerprint, with its area, are erased one week after the month ends; after that, nothing on the record says where you were. The rest (your identity's ID, the month, the result, how many routing requests it used, and the times) is deleted 15 months after that month.

Pass reports

When you report a pass as open, partly open or closed (with an account), we keep your account's ID, the status, the time, your note if you write one (up to 500 characters), and one number: how far you were from the summit. If the app knows where you are, it sends that position with the report; our server uses it once, to work out that distance, and does not store it.

Everyone using the app sees the reports: the status, the time, the note and the distance, never who you are or where you were. A note is therefore public: please do not write anything personal in it.

Reports are kept, because they are facts about a road. When your account is deleted, your ID is removed from them. The limit of 20 reports an hour is counted in memory only.

Your location

The app uses your phone's location on the phone, to show you on the map, to follow a route and to record your rides. It sends a position to our server only when you:

• press the Sunday Button from where you are (the start point, see The Sunday Button);
• plan a route from where you are: your position becomes a place in the route, kept only if you save the route with an account;
• open the weekend-window finder: it sends where you are (or the middle of the map), your phone's time zone and your altitude if the phone knows it, and none of it is stored (see Routing, weather, place search and the map);
• search for a place: the app rounds the middle of the map to about 10 km before it sends it, our server rounds it again before it asks the place search, and none of it is kept beyond ten minutes in our server's memory (see Routing, weather, place search and the map);
• look at the map closely enough to see mountain passes: the app asks our server for the passes in the area on screen, widened to a grid of about 5 km; that area is used for the answer and is neither stored nor logged;
• keep a recorded ride with an account, or make one later: its whole track goes to our server, to be kept in your account (see Rides in your account);
• report a pass (used once for a distance, not stored).

Under Profile, then Appearance, the choice Automatic (the default) makes the app light by day and dark at night, by the sun where you are, worked out on your phone. It uses a position the app already has (your marker on the map, or the place the map opened on) and asks for no new permission. It keeps only the last place it used, rounded to a tenth of a degree (about 10 km), on your phone; that place never leaves it. "Delete everything on this phone" and removing the app delete it. Until the app knows where you are, it follows your phone's own light or dark setting.

Recording your rides

When you press "Record", the app records your ride on your phone: the positions the GPS gives, each with its time, its height, how accurate the phone says the position and the height are, the speed the phone measured and how sure it was of it (used only to tell moving from stopped, and never shown), when the recorder stored it, and whether the phone marked it as simulated, together with the phone's battery level and whether it was charging. With each recording, the app keeps when it started and ended, your phone's offset from UTC at the start, how it ended, whether the app recovered it after an interruption, how often it carried on after the app restarted, how many positions it kept, an ID for the recording (which tells when it was made) and a random one for your phone, and the ID you recorded it under: your account's or, without an account, that of the anonymous identity the app was given. What you write, choose or mark on a ride's screen (when it ends, or later on its page under Trips, then Ridden) is kept on your phone until it is saved, and is deleted with the ride or recording; so is a "Not now" to joining it with another ride. When you keep a ride, the app also keeps the ride itself, with its parts in order, and, until our server has them, the changes that take it to your account, each with its own copy of what it sends (see Rides in your account).

It keeps recording with the screen off and the phone in your pocket, until you stop it with "Hold to stop". If you allowed location in the background ("Always" on an iPhone, "Allow all the time" on Android), a recording also carries on after the phone restarts and, on an iPhone, after you close the app. Without it, closing the app on an iPhone stops the recording until you open the app again; on Android it carries on with the app closed, but a restart of the phone pauses it until you open the app. The app uses location in the background only while a recording runs.

If you allow the motion sensors ("Motion & Fitness" on an iPhone, "Physical activity" on Android), they are used on the phone only, to tell when you have stopped and when you ride on; with location in the background allowed as well, the GPS can then rest while you are stopped. The app keeps no sensor readings (except inside a record it sets aside, below): in the track it marks only the moments the phone switched between moving and stopped. Nothing from the sensors is sent anywhere. You can record without them.

On Android, the phone shows a quiet notice while a ride records ("RomboRide is recording your ride"); a tap on it opens the app. On Android 13 and later the app asks once, at your first recording, whether it may show that notice; if you say no, it records all the same, and the recording shows only in the phone's list of active apps. On an iPhone, the system's blue location indicator shows it instead.

The recorder first keeps each position in its own store on the phone, as the phone gives it, with the phone's other readings for that moment, such as the direction you were heading and its guess at how you were moving (in a vehicle or on foot, for example), and it counts the distance it has recorded, as one number. The app takes what is listed above into its own database, within seconds while it runs and otherwise the next time you open it (on a full phone, once there is room), and then the recorder deletes the position from its store. A record the app cannot read is set aside on the phone, whole, and never sent; it may hold a position. The recorder also keeps its own technical log of warnings and errors on the phone (it may hold a position), for up to 3 days.

Without an account, your recorded rides stay on your phone: nothing of them is sent to our server. With an account, the rides you keep go to your account as well (see Rides in your account), and your phone keeps its own copy until you delete it. Apart from that, we receive a recording only if you send it to us yourself, in a file (see Problem reports). You can also export your rides yourself (see Your rights). While the recording screen is open, its map is loaded around you from OpenFreeMap, as when you follow a route (see Routing, weather, place search and the map). Like the rest of the app's data on your phone, a recording can also be copied by your phone's own backup or by its transfer to a new phone, if you use one: on an iPhone, an iCloud backup, a backup on your computer or a move to a new iPhone; on Android, a transfer from phone to phone. That copy is wherever your backup or transfer puts it, and we never see it.

To delete one recording, tap "Discard this recording" on the screen that shows when it ends, or "Delete" beside it under Trips, then Ridden (or "Delete this ride" on its page), and confirm. With or without an account, the whole recording goes from your phone at once: every part of it (the app splits a very long ride into parts), with all its positions, and the copies of its positions that the recorder still holds in its own store. If it never reached our server, the app keeps nothing of it: no positions, no times and no marker that it existed. If it may have reached our server, the confirmation says so: "It is deleted from this phone and from your account, and it can’t be brought back." Our server then deletes it the next time your phone syncs your account, and keeps it until then. A joined ride is deleted whole (every ride in it, each with all its parts), and the confirmation says how many. A ride that another of your phones recorded is deleted from your account, and that phone deletes its own copy the next time it syncs; the confirmation says that too. Afterwards your phone and our server each keep a marker for the ride and for each of its parts: its ID, when it was deleted and its sync number, so that your other phones learn it is gone. The ID is made when the ride or part is made, so it still tells when that was, to the millisecond. The markers stay until your account is deleted (on your phone, until you delete everything on it or remove the app). What can remain for a while: if the recorder will not let go of some of those copies yet, the app keeps a list of their bare technical IDs (not where or when they were taken), skips them from then on, and deletes them as soon as the recorder allows (the app never deletes another recording's positions to do this); if the problem log is on, as it is unless you switch it off, its entries about what the recorder did, such as that a recording started, stopped and was deleted, each to the minute and with no place, until the log drops them or you clear it (see Problem reports, which also says how long the phone keeps its copy of a recording diagnostics file you sent); and if you shared an export of the ride just before, on Android the share function's copy of it, which goes once it is an hour old, the next time you start or return to the app, or at your next share. A backup of your phone made before you deleted the recording still holds it until that backup is replaced.

The list shows your rides, those recorded on your other phones included (without an account, the rides made on this phone without one), and the recordings that are not rides yet, those of an account our server lost (or may have lost, until it answers) included (see Rides in your account). Each row shows the ride's name or when it started, its distance and riding time (for a recording, how long it ran), and where it is: in your account, waiting to go, refused by our server, or only on this phone; rides you joined into one are one row. It includes recordings the app recovered after an interruption or kept from positions an earlier ride left behind. Only an ended recording can be deleted: not one that is being recorded, not one the app is still recovering as it opens, and not one of an account our server may have lost until it confirms it did. While you record, the list shows nothing.

In rare cases, some positions of a deleted ride can come back as a separate recording: positions the app had not yet saved when the ride ended (a very long ride whose saving ran out of time, or a full phone), or copies of its positions that the recorder had earlier refused to delete, if the app could not look through the recorder's store when you deleted (the recorder could not be reached, or it held too much to go through in time). The next time the app starts, it shows such a recording as an interrupted one ("This recording was interrupted."), or keeps it quietly if you start a new recording first; it is what is left of the deleted ride, not a failed delete, and it is in the list, where you can delete it again.

Without an account, "Delete everything on this phone" goes in steps. On a phone that has recorded, before it deletes anything, the app does three things, and it tries the first and the last up to three times. First, it stops the recorder and checks that it has stopped. Second, it saves into its own database every position the recorder still holds, except those of recordings you deleted, and checks that nothing else is left; a recording that is running is stopped and saved. Third, it empties the recorder's own store of positions, its technical log and the distance it has counted, and checks that the recorder is stopped, holds no positions and counts zero. Only then does it delete from the phone everything in the app's database: your recorded rides and the records set aside, your routes and the changes still waiting to be sent, your bikes, privacy zones and badges, the problem log and your settings; and also the copies of problem reports it made for sharing, and every export and route file it made for sharing, on Android including the copy the share function keeps of the last file you shared. That includes what this phone keeps hidden for another account (see Rides in your account). It then gives the phone a new anonymous identity; without a connection, that happens the next time the app reaches our server.

If the recorder cannot be stopped, nothing is deleted, and a recording that is running goes on. If the positions cannot all be saved (saving fails or does not finish in time), nothing is deleted either: the recorder is not emptied, and the positions it still holds are saved the next time the app starts, if the phone has room. If the recorder cannot be emptied, nothing the app keeps is deleted (your rides, routes and settings among it); by then every position it held is saved in the app's database, apart from those of recordings you deleted, and part of what the recorder holds (its store, its technical log or its distance count) may already have been emptied. In each of these cases the app says, in red and read out by screen readers: "The recorder couldn’t empty its own store on this phone, so your rides, routes and settings were not deleted. Try again." If a recording was running and was stopped on the way, it adds: "Your recording was stopped and kept." The same button tries again. Removing the app deletes all of it.

Rides in your account

With an account, a ride goes to your account when you tap "Done" on the screen that shows when it ends; before you tap it, the screen says "On this phone — Done keeps it in your account too." If you tap neither "Done" nor "Discard this recording" on that screen, because the app closed or you started a new recording, the app keeps the ride in your account by itself later, for example the next time it starts, with what was already on that screen: its name, notes, bike, any stretches marked not ridden and, if you chose "Join the rides", the join. It is sent at once or, with no connection, as soon as there is one. "Discard this recording" on that screen, before "Done", sends nothing.

Rides you recorded with an earlier version of the app (which told you that your recordings stay on your phone) stay only on your phone until you tap "Keep in my account" beside one: under Trips, then Ridden. Only the account they belong to can do that. If you answered the recorder's questions in an earlier version, the app tells you this once, on your first such screen, and keeps no ride in your account before it has: "From this version on, a ride you keep goes to your account too, if you have one. Rides you recorded before stay on this phone until you choose “Keep in my account”." When the app asks for your location to record, it now says: "RomboRide records where you ride, on this phone. For that it needs your location while you use the app. Your rides are kept on this phone, and in your account if you have one."

Without an account, nothing of a ride is sent. If you later make an account on that phone, every ride you kept on it goes to that account; if you sign in to an account you already have, the rides you kept on the phone without one go to it too, with a recording still running at that moment. Rides from an earlier version still wait for "Keep in my account" there.

For each part of a ride (the app splits a very long ride into parts), we receive every position the app kept, each with its time to the millisecond and, where your phone had one, its height, and what those heights are measured from; when the part started and ended; your phone's offset from UTC at the start; whether the app recovered it after an interruption; how many positions it kept; the version of the app's filter that kept them; how many of the positions your phone marked as simulated, if it says, so that, from a later version, badges can tell a ridden road from a simulated one; the part's ID, which tells when the part was made; that it was recorded rather than imported; and the random ID the app made for your phone when it was installed (never a hardware ID), which tells us which of your phones sent it.

For the ride itself: its ID, which in the same way tells when it was made; when it started and ended; your phone's offset from UTC; its parts in order; and the random ID of the phone that last saved it; the name and notes you give it, the bike you choose and the stretches you mark as not ridden; and, for rides you joined into one, which ride each of them points to. Our server adds to each part and ride when it stored it and last changed it, and a sync number.

We never receive how accurate a position or its height was, any speed (the app uses speed on your phone only, to tell moving from stopped, and never shows it), the direction you were heading, which positions were marked as simulated (only how many), your battery or charging, anything from the motion sensors, the recorder's own readings, events or log, how a recording ended or how often it carried on after the app restarted, the positions the app left out, a part with fewer than two positions, or a ride's numbers (distance, riding time, climb): your phone works them out each time and never sends them with a ride.

A ride's track is kept whole, from its first position to its last, so where you start and stop, often your home, is in it. A privacy zone changes neither the track kept in your account nor the file "Export this ride as GPX" makes: that file holds the whole track, wherever you send it. Zones will hide their area from what you share through the app; nothing can be shared through the app yet. Above your privacy zones, the app says: "Rides in your account are kept whole, and so is a ride you export as GPX. A zone hides its area from anything you share in the app — and nothing can be shared in the app yet. Zones don’t apply to a diagnostics file you send us yourself."

We keep your rides in your account for you: so that they are there on every phone you sign in on, and in your data export. It is part of the service you use when you keep a ride with an account (see Why we may do this).

Only you see your rides: on the phones you sign in on, and in your data export. Your other phones receive a ride's details without its track. A track is downloaded to one of them only when you ask for it there: when you open the ride (under Trips, then Ridden), or when you tap "Download and count" in your stats (under Profile, then Stats), which downloads the tracks of the rides your stats are still waiting for in the period they show. A downloaded track then stays on that phone until the ride is deleted. No other rider sees your rides; our admin tools show none of them, no track and no name; and a track is never written to our logs. Under Profile, then Privacy, "What we keep about you" says of your account: "With an account, it also holds the rides you keep: every point of each ride’s track with its time and height, and the name, notes and bike you give it — never a speed. Your phone keeps its own copy until you delete the ride."

On a ride's page (under Trips, then Ridden), any of your phones can change its name, notes, bike, not-ridden marks and joins; for each of them, the last change our server receives wins. Joining and separating rides is saved at once; anything else you change there stays on that phone until it is saved: when you tap "Done" or go back, or, if the app closed first, by the app itself the next time it starts. A ride's track is never changed: a part can only be deleted.

If someone else signs in on the same phone, they do not see your rides: they stay on the phone, hidden, and come back when you sign in again. A ride not yet in your account waits for your account and is never sent under another. Before you sign out, the app counts your rides that are not in your account yet and offers "Export from this phone" first; for one ride it says: "One ride on this phone isn’t in your account. After you sign out it stays here, hidden, until you sign in again — export it first if you want a copy now." If it cannot count them, it says: "Some rides on this phone may not be in your account yet — export them first if you want a copy now." "Delete everything on this phone" and removing the app delete the rides of every account on the phone. Before it deletes, "Delete everything on this phone" says how many rides of another account are not in that account yet; for one ride: "This phone also holds 1 ride of another account that isn’t in that account yet. It is deleted too."

One exception: rides recorded with an earlier version of the app under a sign-in that is no longer on the phone, when the phone cannot tell whether that sign-in was a guest's or an account's. Those are listed by their day and time under "Found on this phone" (in Profile, after "Your data") for whoever uses the phone, who can export them, or bring them into their own account with "Bring into this account" and then keep them there with "Keep in my account". The app says beside them: "Kept on this phone before this version, under a sign-in that is no longer here — the phone cannot tell whether that was a guest or another account. Bring them into this account only if they are yours."

Backups are off (see Where your data is kept), and your phone keeps its own copy of every ride it recorded. If our server ever loses data or goes back to an earlier copy, your phone notices, sends again what it holds of your account, repeats the deletions it made, and says so once under Sync: "Our server lost some of its data. What this phone holds of your account is being sent again — nothing for you to do." If our server loses your account itself, your phone tells you once: "Our server lost your account. All your rides are still on this phone — export them to keep a copy. You can make a new account." It keeps that account's rides listed for whoever uses the phone, and lets them, with that account's routes, be exported with "Export from this phone". It never sends them, and a new account you make does not take them. If the phone cannot ask our server at that moment, it shows them in the same way until it can ask again.

Routing, weather, place search and the map

Routing. To draw a route, the app sends its places to our server, which asks GraphHopper (Munich, Germany) for the roads, with the points at full precision. Our server keeps each answer in its memory for 30 minutes, filed under the question and never under who asked, and forgets all of them when it restarts; nothing about a route preview is written to our database. For the Sunday Button, our server sends GraphHopper the start point and points around it in the same way (what we keep of a press is under The Sunday Button). GraphHopper sees our server's address, not yours, and no ID of yours, and keeps its request logs, with the points, for up to five weeks.

Weather. For the weather along a route, the app sends points of the route and times to our server; for the weekend window, where you are (or the middle of the map), your time zone and your altitude. Our server asks Open-Meteo (Switzerland) about the centres of grid squares of about 4 by 5.5 km (for the weekend, the square you are in and eight points 40 km around it), at a rounded height, never about your exact point. Open-Meteo sees our server's address and no ID of yours. The time zone only decides which days are the weekend; it is not stored and not passed on. Forecasts stay in our server's memory for up to six hours, filed under place and height, never under who asked.

Searching for a place. When you search for a place in the app, the app sends the words you typed, the app's language and the middle of the map, already rounded on your phone to about 10 km, to our server. Our server rounds it again and asks Photon, a place search that komoot (Germany) runs on OpenStreetMap data, for places that match. Photon receives the words, the language and the rounded point with our server's address: not your IP address, not your account, no ID of yours, and no position of yours, except that the rounded point is near you when the map is showing where you are. We do not store what you search for: neither the words nor the point are written into any log or kept on disk. Like every request, a search leaves a line in our logs saying that a search was made, from which address and when (see Protection and logs). So that we ask Photon less often, our server keeps each answer in its memory for up to ten minutes, filed under the words, the rounded point and the language, never under who asked, and forgets all of them when it restarts.

The map. The map's style and tiles come to your phone straight from OpenFreeMap (Hungary). OpenFreeMap therefore receives your phone's IP address, which part of the map it draws and at what zoom, and the app's technical signature (its user agent). OpenFreeMap says it keeps no IP addresses by default, and that it may use Cloudflare to deliver the tiles.

Emails from us

When you sign up with your email address, reset your password or change it, we send you an email: to confirm the address, to reset the password, or to tell you it changed. If someone tries to create an account with an address that already has one, we send its owner an email saying so, instead of a second confirmation. An account that is being deleted gets none of these. We send them through Brevo (Sendinblue SAS, Paris, France), which receives the address, the subject and the text, including the one-time link to confirm or to reset. Our emails come from no-reply@romboride.com.

If an email cannot be sent, our log records only which kind of email it was and the error codes, never your address.

Brevo keeps its own log of the emails it sends; unless told otherwise, without a time limit. Before our first email goes out, we set that log to the shortest time Brevo allows: one month.

Problem reports

In the app, under Profile, then Report a problem, you can send us a report when something does not work. It is one file, made on your phone, and before it goes you can read all of it, exactly as it will be sent. The file's first sentence says what it holds: apart from what you typed, only fixed facts. They are a random report number and the time; the app build (its version and the server it talks to); the phone's model, system version, language, text size, theme and screen size; the location permission as one word (such as precise, approximate, denied or off), never a position; the battery settings; the sync state as counts, minutes and words (how many changes and rides wait, were refused, or wait for another account on this phone, how long since the last sync, whether it is offline or blocked, and how many minutes your phone's clock is off from our server's); how you sign in; your account's ID, only if you ticked the box; each recent error as its type and fixed codes, never its message; and the problem log described below. Every time in it is to the minute.

A report holds no position, route, title, search, email address, password or token, and nothing an error said. Your account's ID is in it only if you tick "Add my account id so you can look at my account", which is unticked every time the report opens; without an account there is no such box. What you type yourself is yours to choose: if you write an address, it is in the report.

Recording diagnostics. For a recording that went wrong, you can send us a second file the same way: under Profile, then Report a problem, tap "Send recording diagnostics", which the app describes as "A file about your last ten recordings on this phone — when each started and how long it ran, battery, points, gaps, filtered fixes, recoveries and whether it is in your account, never where you rode. You send it yourself, to info@romboride.com or anywhere you like; nothing is uploaded." Besides what you type, it holds a random number, the time and the same facts about the app and the phone as a report (but not the report's sync counts, how you sign in, your account's ID, the errors or the problem log); how many unreadable records are set aside on the phone; and, for each of the newest 10 recordings on your phone that the app shows you (those recorded on this phone that Ridden, under Trips, shows you, and one still being recorded): when it started (to the minute) and how long it ran, how it ended, whether the app recovered it and how often it carried on after the app restarted, how many positions it holds and how many were left out and why, its gaps, the battery (measured off the charger only) and how many positions were taken on the charger, the GPS accuracy, the riding minutes and the distance, and whether its ride is in your account, waiting, refused (with our server's code) or only on your phone. It holds no position, unless you tick "Add the track of my latest recording", which is unticked every time: then it holds every position of that one recording with its time, height and accuracy, from the very start (privacy zones are not applied to this file). In every other way it is a report: it leaves your phone only when you send it yourself, and what happens to its copy on your phone and how long we keep it are as described here for a report.

A report leaves your phone only when you send it yourself. Send opens your phone's share menu, with the address info@romboride.com written in the message for you to send it to, and you choose how it goes: by email, through another app, or not at all. Nothing is uploaded to our server, and nothing is sent in the background. The app you choose carries it under its own terms. If you send it by email, we also see your email address and the name your mail app shows, and keep them with the report; through a messenger, we see that account's name and number the same way.

To hand the report to the app you choose, the phone keeps a copy of the file among the app's temporary files. If no app takes it, the copy is removed at once. Otherwise it is removed when you next open a report, or when you next open or return to the app at least an hour after sending it, since a mail app may read the attachment only when the mail goes out. "Clear the problem log", switching the log off and "Delete everything on this phone" remove every copy at once.

The problem log. So that a report can say what happened, the app keeps a short list of what it did, as fixed words, counts and codes, each with its time to the minute: the app starting, going to the background and coming back, screens opened, following a route starting, stopping or arriving, a Sunday Button press's result (never its point), a route preview's result (never its places), sync runs, requests that failed (which one, how, and roughly how long it took), the location permission changing, the account ask being shown or answered, a report being opened or sent, a recording starting, stopping, carrying on after the app restarted, being closed after an interruption, recovered or discarded, a long recording being split in two, the recorder refusing to start, your phone being too full to record, the location permission found gone when the app opens, records the app could not read being set aside, your answers to the recorder's questions, a ride being queued for your account, sent, refused (with its code) or deleted from your account, our server's data having changed (how many items were sent again), and errors by their type. With its times, the log shows when you used the app, followed a route and recorded. It never holds where you are, where you rode, which ride, what you called anything or what an error said.

The problem log is kept only on your phone: the newest 500 entries of the last 7 days, and the newest ten errors. The app drops older entries each time it starts, each time it has written 20 new ones and before it makes a report, so an entry older than 7 days stays only until the app next starts. It leaves the phone only inside a report you send. It is on unless you turn it off: under Profile, then Report a problem, the switch "Keep a problem log on this phone" turns it off, which empties it, and nothing is kept while it is off; "Clear the problem log" empties it at any time; "Delete everything on this phone" and removing the app delete it too.

A report you send us lands in our mailbox for info@romboride.com, or in the conversation you sent it in. We use it only to understand and fix the problem and, for recording diagnostics, to measure and improve how the recorder uses the battery. We delete it by hand, with the message that carried it, at the latest 90 days after the problem it reports is closed; write to us and we delete it at once.

The mailbox for info@romboride.com, where every report and every message you send us lands, is hosted by: Namecheap (Email Forwarding), forwarding to a Gmail mailbox (Google).

Protection and logs

Limits against abuse. Our server counts some requests for a short while: new anonymous identities and email requests per network address, sign-ins with Google per network address, failed sign-ins per email address and per network address, emails per recipient, place searches per network address, and weather and pass requests per ID. Of an IPv6 address, only its first half (the /64 network) is used. Apart from the second sign-in step's lock (above), these counts live only in the server's memory, never in the database, a file or a log. Each one covers a minute, 15 minutes or an hour; an expired count is dropped when the same key comes back, in a clean-up, or when the server restarts (at every update).

Logs. Our server keeps technical logs, for security and to find faults. The app service's log has one line per request: the path (without anything after a question mark), the result, how long it took, a request number, and four of the request's headers and no other: your IP address (as our web server passes it on), the app's user agent, and the type and size of what was sent. So it holds no language, cookie or token. A few lines about events also carry the ID of an account or an anonymous identity (for example when a profile is created or an account is deleted), never an email address or a location. This log is deleted every time we update the service, and never grows beyond 100 MB.

Our web server's log for the app service keeps your IP address, which path was asked for (without anything after a question mark), the result, its size and how long it took, but no request header (so no user agent, language or credentials) and no response header. When the app service does not answer, for example during an update or a restart after a crash, the log also gets an error line: the path (again without anything after a question mark), what went wrong and when, but no header and no IP address. It survives updates and is limited only by size, not by time: it shares 100 MB with this website's log, so when traffic is low it can reach back months. Lines from before this policy was published also hold the request's other headers, such as your language and the app's user agent; they drop out as the 100 MB fills.

Rarely, an unexpected error in the service's log contains a piece of the data it failed on, for example a username that was already taken; never a privacy zone's point or a ride's track. The database's own log notes a statement that was slow or failed, but not the values in it; only a fault in our code could make one of its error messages quote a value. Rarely too, a warning about the weather service quotes a point on that service's own map grid, never yours. These logs are limited by size in the same way.

Records of admin actions. Every change made with admin rights (blocking or unblocking an account, changing a role, deleting an account on someone's behalf, running a job, a curator's pass report), and every export made on someone's behalf, is written to an audit record: when, who acted and in which role, what they did, to which ID (an account, a job or a pass), counts and results, and the reason given. These records hold no email address, name, location or route: the only personal detail in them is an account's ID. A reason is about the action, never about the person, and our server removes email addresses, access tokens and web addresses with parameters from it before it is saved. We keep these records without a time limit, on purpose: they are the proof that an account was deleted when its owner asked, that a block had a reason, and that no admin changed anything unseen.

Our background jobs record, for each run, how many items it handled; the job that deletes accounts also records, for each account it worked on, its ID and how many items of each kind were deleted. These records are deleted after 90 days, except each job's latest run and its latest successful one.

Where your data is kept

Everything we keep on our side is stored on one server we rent from Hetzner Online GmbH (Gunzenhausen, Germany), in its data centre in Helsinki, Finland, apart from the messages you send us, which are in our mailbox (see Problem reports), and the snapshot described below, which Hetzner stores in Germany. What the app keeps on your phone stays on your phone, except as this page describes.

We keep no backups today. That server holds our only copy of what you save: if its disk were lost, your Dream Trips, bikes, zones and the rides in your account would be lost there, and your account with them. The one exception: before an update that changes the database, we take a snapshot of the server's whole disk, and we delete it within 7 days, once the update is working. A snapshot is a full copy of everything on the server at that moment, your rides included, and of anything you delete in those days, and Hetzner stores it in its data centres in Germany (Nuremberg or Falkenstein) until we delete it. Your phone keeps its own copy of every ride it recorded until you delete it, so a ride is lost for good only if our server and your phone both lose it, for example with a lost, wiped or reset phone, or the app removed; if our server loses some data, your phone sends again what it holds, and if it loses your account, nothing is sent again and your phone keeps your rides for you to export (see Rides in your account). "Export from this phone" makes a third copy whenever you want one. Before we start keeping backups, this page will say where they are kept and for how long.

Only the founder, who runs RomboRide, can reach the server, with a personal key; apart from those snapshots and the data exports described under Your rights, nothing copies your data off it. As admin, the founder can look at accounts through admin tools. They show what support needs, including your profile and the titles and notes of your Dream Trips, but no email address, no sign-in data and no location: not the places or line of a route, not a privacy zone, not a Sunday Button point, and no recorded ride (no track, no name). Every change made with them is recorded; looking is not. An export made on your behalf contains everything your own export does, and is recorded.

Who else receives what

These services receive data from us or from your phone, each for one job:

Hetzner Online GmbH, Germany

Hosting. Our server, and so everything on this page that we keep on it, is in Hetzner's data centre in Helsinki, Finland; the snapshot we take before an update that changes the database is stored in Germany until we delete it, within 7 days once the update is working.

GraphHopper GmbH, Germany

Routing. Receives from our server the points of a route, and the Sunday Button's start point with points around it, with our server's address and no ID of yours. GraphHopper keeps its request logs, with those points, for up to five weeks.

OpenMeteo GmbH, Switzerland

Weather. Receives, from our server, the centres of grid squares of about 4 by 5.5 km (for the weekend window, also eight points 40 km around one), rounded heights and times, with our server's address and no ID of yours. Open-Meteo keeps its server logs, which contain those coordinates, for 90 days.

komoot GmbH, Germany

Place search (Photon). Receives from our server the words you search for, the app's language and a point of the map rounded to about 10 km, with our server's address and no ID of yours. komoot publishes no privacy statement for Photon and does not say how long it keeps Photon's server logs; the link on its name leads to komoot's general privacy policy.

OpenFreeMap (Hyperknot Software Kft.), Hungary

Map tiles, straight to your phone. Receives your phone's IP address, the part of the map it draws and the app's user agent. OpenFreeMap says it logs no IP addresses by default, only temporarily during a security incident (for at most 30 days), and that it may use Cloudflare to deliver the tiles.

Brevo (Sendinblue SAS), France

Our emails to you. Receives your email address, the subject and the text. Brevo processes it for us and says its servers are in the European Union.

Google Ireland Limited, Ireland

Only if you choose to sign in with Google. The sign-in happens between your phone and Google, which is responsible for your Google Account itself. Our server sends Google nothing about you.

Namecheap (Email Forwarding), forwarding to a Gmail mailbox (Google)

Our mailbox for info@romboride.com. Receives what you email us, with your email address and the name your mail app shows: a problem report or recording diagnostics you choose to send, a request about your data, a question.

No one else receives your data. Registering our domain name, issuing our security certificates and hosting our code involve none of it.

How long we keep what

Your rights

You have the right to see your data, to take it with you, to have it corrected or deleted, to restrict or object to how we use it, and to complain. In practice:

• See and take your data: in the app, under Profile, then Your data, tap Export my data. You get a ZIP file with everything our database holds about you: your profile; your account (your email address and any address still waiting for its confirmation, any email link not yet used, when the account was created and linked, whether you have a password and when you set it, the Google account linked to it by Google's ID for it, your two-step sign-in status, each session's dates and how it ended, your role, whether the account is blocked and why, and every export asked for); your badges; your Dream Trips, with each earlier version in full, and their lines as GPX files; your Sunday Button presses, with their start points, loops and fingerprints while we still hold them; your pass reports; your bikes; your privacy zones, with their points; your recorded rides: each part (its details, without its positions), each ride with its name, notes, bike, not-ridden marks and joins, and one GPX file per ride with every position, its time and height (and one for a part that belongs to no ride); the records of admin actions about your account, naming who acted only by their role; and the record of changes your phones sent. Left out on purpose: your password and every other key or code (we hold them only as hashes, or encrypted), the markers left by what you deleted, records about other people, our server logs, which cannot be searched by account, and what the services named above hold. We keep the file for 7 days, and its link works for 24 hours: anyone who has the link can download it in that time, so keep it to yourself.
• Your recorded rides: they are in that export once they are in your account. With or without an account, "Export from this phone" (under Profile, then Your data) makes a file with one GPX file in it for each recording made on this phone that Ridden (under Trips) shows you (a ride the app split into parts is one file), those not yet in your account included; when you are signed in, the app says: "This file holds your rides recorded on this phone — the ones not yet in your account too." "Found on this phone" has its own export for what is listed there. "Ridden" (under Trips) lists your rides, those recorded on your other phones included, and the recordings that are not rides yet; "Delete" beside one removes it, and a ride's own page exports it as one GPX file ("Export this ride as GPX") (see Recording your rides, which also says whose they are).
• The files the app makes for you to share: the app hands an export, or a ride's or a route's GPX file, to your phone's share menu, and removes its own copy once the share menu closes. On Android, the copy the share function keeps is removed once it is an hour old, the next time you open or return to the app. Without an account, "Delete everything on this phone" removes them all at once. A copy that the app you share it with makes is in that app.
• Delete: in the app, under Profile, then Your account, tap Delete account. For 30 days your account is marked as being deleted and can no longer be used on our server: every phone and browser signed in to it is signed out at once, it cannot be signed in to again or have its password reset, everything that needs it is refused, the Sunday Button, pass reports and the export included, and nothing new is stored under it on our server. The app keeps working on your phone with what it holds. This cannot be undone. On day 31 we delete everything that carries your account's ID and blank your email address. That includes your recorded rides on our server; your phone keeps its copy until you delete it, and a ride still waiting on your phone is never sent to any other account. What stays: your pass reports, without your ID; the records of admin actions about your account, such as a block and its reason or the deletion itself, which hold its ID but no email address, name or location; and the deletion job's record of the account's ID and what was deleted, for 90 days, or longer while it is that job's latest run.
• Without an account: the app offers no export or deletion on our server for you, because nothing there carries your name or email address; you can still write to us. On your phone, under Profile, tap Export from this phone to save what the app holds, your recorded rides included, one GPX file for each recording, or Delete everything on this phone to remove it; deleting the app removes it too. What our server holds (the anonymous identity, its sessions and its Sunday Button presses) expires as described under How long we keep what.
• A problem report or recording diagnostics: write to us and we delete what you sent, at once; the problem log on your phone you empty or switch off yourself (see Problem reports).
• Correct: change your profile in the app. Your email address cannot be changed in the app yet: write to us and we will change it.
• Restrict, object or ask: write to info@romboride.com.
• Complain: you can complain to a data protection supervisory authority, in particular in the EU country where you live, where you work, or where you think the problem happened.

Why we may do this

Most of what is described here is what you ask the app to do, so we process it to provide the service you use (GDPR Article 6(1)(b)): the anonymous identity, your account, your profile, your Dream Trips, bikes and zones, the Sunday Button, routing, weather, place search, recording your rides on your phone, which you start with "Record", keeping the rides you keep in your account, and the emails.

The rest serves our legitimate interest in keeping the service safe, working and fair (GDPR Article 6(1)(f)): the logs, the limits against abuse, the record of changes your phone sends, the Sunday Button's meter, pass reports as a road-status service for everyone, the records of admin actions, the snapshot before an update, and the problem reports and recording diagnostics you choose to send us.

Changes to this policy

When what we do with your data changes, this page changes first: before we switch on anything new that handles your data (for example error reports or backups), it is described here. The version and the date at the top always show the current text.