Privacy policy
This policy explains what routess collects, why, who else sees it, and how to make us delete it. It covers routess.com, routess.be, the app at app.routess.com, the docs, and the public API. It is written to be read, not to be survived.
Who we are
routess is operated by Robbe Verhelst, Buisstraat 45, 2890 Sint-Amands, Belgium (enterprise number BE 1024.261.897). We are the data controller for everything described below.
For anything privacy related, including access, correction, or deletion requests, email [email protected]. We answer within 30 days. Please do not send personal data through the public GitHub issue tracker.
What we collect and why
We collect what the service needs to work, and product analytics to understand what to build next. Nothing is sold, and nothing goes to advertisers.
| What | Why | Legal basis |
|---|---|---|
| Name and email address, from Google sign-in or email signup | To create and secure your account, and to send transactional email such as verification and password resets | Performance of a contract (Art. 6(1)(b)) |
| Your handle, and your avatar if you have one | The public address of your profile. Generated from your display name at signup, never from your email | Performance of a contract (Art. 6(1)(b)) |
| Password hash, if you signed up with email rather than Google | To authenticate you. We never store the password itself | Performance of a contract (Art. 6(1)(b)) |
| Your routes and collections: waypoints, geometry, name, description, activity, tags, visibility | They are the product. We store them so you can come back to them | Performance of a contract (Art. 6(1)(b)) |
| Session records: an identifier, your IP address, your browser user agent, and the time of last activity | To keep you signed in, to show you your active devices, and to let you and us spot suspicious sign-ins | Performance of a contract and legitimate interest in security (Art. 6(1)(b) and (f)) |
| Product analytics events, described in detail below | To understand which features get used and where people get stuck | Legitimate interest (Art. 6(1)(f)), with an opt-out in settings |
| Browser error reports and performance traces | To find and fix crashes and slow pages | Legitimate interest (Art. 6(1)(f)) |
| Your approximate location, only if you grant the browser permission | To centre the map on you and to start a generated loop from where you are. It is used in the moment and not stored on our servers | Consent, given through your browser (Art. 6(1)(a)) |
| Only if you turn on weekly route suggestions: your email address, the area and activity of your most recently saved route, when you opted in, and which routes we already sent you | To email you, once a week, a few public routes near where you last planned. Off unless you switch it on | Consent (Art. 6(1)(a)). Withdraw it any time in Settings or with the one-click unsubscribe link in every email |
Product analytics
We use Umami, which we run ourselves on our own infrastructure. No third party receives this data and it is never used for advertising. Umami sets no cookies and does not fingerprint your device.
Beyond page views, the app records named product events such as creating a route, importing a GPX file, or copying a share link. Each event carries context: the activity, distance and waypoint count of a route, the visibility you chose, your interface language, theme and unit preference, and the app version. Search terms are recorded only as a length bucket, never as the text you typed.
If you are signed in, events also carry a pseudonymous identifier: a salted SHA-256 hash of your account ID. The salt lives only on our server and is never sent to your browser, so the hash cannot be reversed by anyone reading our JavaScript. It does let us follow one person's journey across sessions and devices, which is why we treat it as personal data rather than calling it anonymous.
Every event also carries a random device identifier that the app stores in your browser's local storage. It is generated on your device, says nothing about you, and lets us see whether someone who planned a route without an account came back or later signed up. Signed-in events carry both identifiers, so once you sign in on a device its earlier events are linked to your account, and they are erased with it. Signing out or switching off analytics deletes the device identifier; a new random one is made next time.
You can turn all of this off. Open Settings, then Privacy and sharing, and switch off usage analytics. Nothing is sent after that, including page views. We also honour your browser's Do Not Track setting automatically. This is your right to object under Art. 21, and you do not need to give a reason.
Error reporting
When something breaks in the app, your browser sends us a crash report so we can fix it. We use the Sentry SDK pointed at a GlitchTip instance we run ourselves. No third party receives these reports.
A report contains the error, a stack trace, the page you were on, recent interactions, and the shape of what you were editing: how many waypoints, how far, which mode. It does not contain your route coordinates, your email, or your name. Authentication tokens are stripped from URLs before sending, and reports are tagged with the same pseudonymous hash the analytics use, not your account ID.
Who else receives your data
Most of our stack runs on our own infrastructure. These are the outside services that necessarily see something, and what they see:
| Service | What it receives | Where |
|---|---|---|
| Mapbox | Map tiles, place search, address lookup, and terrain data are requested by your browser directly, so Mapbox sees your IP address, the part of the map you are looking at, what you type into search, and the coordinates of the route you are drawing | United States |
| If you sign in with Google, Google confirms your identity and gives us your name, email and profile picture. Google Fonts also serves the app's typefaces, so Google sees your IP address on page load | United States | |
| Resend | Your email address and the contents of the email we send you: transactional email, and the weekly route email if you opted in | United States |
| Umami, GlitchTip, Valhalla, map tile server | Analytics, error reports and route calculation all run on our own servers. Nothing leaves our infrastructure | European Union |
Mapbox, Google and Resend are based in the United States. Transfers to them rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, or on Standard Contractual Clauses where that does not apply. You can ask us for a copy of the safeguards.
Administrator access
We would rather tell you this plainly than let you assume otherwise. routess has an admin panel, and the small number of people with admin rights can, when they use it:
- Search all accounts by name or email address
- See your active sessions, including the IP addresses and browsers you signed in from
- Open any route, including your private ones, and see its full waypoints and geometry
- Delete or restore accounts and routes, and sign a device out
This exists for support, moderation and abuse handling, not for browsing. Every admin action is written to an audit log recording who did what, to which record, and when. Private means private from other users; it does not mean encrypted against us. If that matters to you, self-hosting gives you a copy where nobody but you holds the keys.
What becomes public when you share
Every route starts private. You choose, per route, whether to make it unlisted or public. Nothing changes visibility on its own.
- Private: only you and administrators can see it.
- Unlisted: anyone with the link can see it. It is not listed anywhere and we ask search engines not to index it.
- Public: it appears in Discover, on your profile, and search engines may index it. Its geometry, name, description, tags and your handle, display name and avatar are all visible to anyone.
A public route reveals where you have been. If a route starts at your front door, so does the map. Consider trimming the start and end of routes you publish. Who you follow, and who follows you, is visible on your profile. Changing a route back to private removes it from public pages, but search engines may keep a cached copy for a while, which is outside our control.
How long we keep things
| What | How long |
|---|---|
| Your account, routes and collections | Until you delete your account. Deletion has a 30-day grace window in which you can change your mind by signing in again; after that everything is permanently erased |
| Sessions, including IP address and user agent | 7 days from last activity. Expired sessions are purged automatically every hour |
| Email verification links | 24 hours |
| Password reset links | 30 minutes |
| Product analytics events | 14 months. Your events are also erased when your account is permanently deleted |
| Browser error reports | 90 days |
| Weekly route email: opt-in time and the routes already sent | Until you unsubscribe or delete your account, whichever comes first |
| Administrator audit logs | 12 months |
| Cached route calculations | 7 days, or 30 days for surface analysis. These are keyed by coordinates and are not linked to your account |
Your rights
Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to how we use it, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting what came before.
Two of these you can exercise yourself, immediately, without asking us. Your profile settings include a full export of your account as JSON plus a GPX file per route, and a delete-my-account button. For anything else, email [email protected].
If you think we have got this wrong, you can complain to your local data protection authority. In Belgium that is the Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be. We would rather you told us first, but it is your call.
Children
routess is not directed at children under 16. We do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.
Automated decision-making
We do not make automated decisions that produce legal effects for you, and we do not profile you for advertising. Route generation and search ranking are algorithms applied to map data, not judgements about you.
If you self-host routess
routess is open source and you can run your own instance. If you do, this policy does not apply to it: you are the controller of the data on your servers, and your users' rights are yours to honour. There is no phone-home in the code. Analytics and error reporting are off unless you configure them, and the map and email providers are yours to choose.
Changes to this policy
When we change this policy, we update the date at the top. If a change materially affects what we collect or who receives it, we will tell account holders by email before it takes effect. The history of this page is in the public git repository, so you can see exactly what changed and when.