Effective Date: July 26, 2026
1. Introduction
Route Companion ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we handle your information when you use our mobile application.
2. Data We Collect
Route Companion ("we", "us") is operated from Switzerland. The data controller for the purposes of applicable data protection law can be reached at [email protected].
Route Companion is designed to be privacy-first. Your personal data and content (routes, location, preferences) stay on your device. The only data that reaches our servers is the minimum required to fulfill features you invoke and a small set of anonymous operational counters described in section 7.
- Route Data: Routes you import (GPX, TCX, FIT files, Strava, Komoot, Ride with GPS) or create with the route planner are processed and stored locally on your device. If you explicitly start Live Location, a simplified copy of the current route is stored temporarily with that sharing session.
- Stop Data: Stops are fetched from our servers (sourced from OpenStreetMap data) and cached locally on your device.
- Weather Data: Weather forecasts are fetched from third-party weather services based on coordinates along your route. No personal data is sent with these requests.
- Authentication Tokens: If you connect third-party services (Strava, Ride with GPS, Garmin, Wahoo, Hammerhead), OAuth access tokens are stored securely on your device using OS-provided secure storage (Keychain on iOS and Android's secure credential storage where available).
- Location Data: Your current device location is used for navigation, proximity alerts, and Live Activity / Android navigation notification display. Current navigation location is processed on-device unless you explicitly start Live Location. While Live Location is active, the app sends the latest navigation position, accuracy, heading, speed, remaining distance, ETA, and update time to our Cloudflare-hosted gateway so anyone with your unguessable sharing link can view it. We store only the latest position, not a location trail.
- Preferences: App settings such as unit system, map type, route appearance, and fuel plan parameters are stored locally on your device.
3. How We Use Data
Most data processing happens on your device. When you invoke a network feature, we process only the data needed to provide it. We use data solely to:
- Display your routes, stops, and weather forecasts on the map.
- Calculate fuel and hydration estimates based on route parameters.
- Provide navigation and proximity alerts.
- Display Live Activity information on your iOS Lock Screen or persistent navigation status on Android.
- Provide a time-limited route, location, and ETA page when you explicitly start Live Location.
- Export routes with course points to FIT, TCX, and GPX formats for use with GPS devices.
- Import routes from connected third-party services.
4. Third-Party Services
Route Companion integrates with the following services. When you use these integrations, your data is also subject to their respective privacy policies:
- Cloudflare: Our API gateway, Live Location sessions, and aggregate analytics run on Cloudflare Workers. Cloudflare acts as our data processor and may temporarily log request metadata (including IP addresses) at the network edge for security and abuse prevention. Subject to Cloudflare's Privacy Policy.
- Apple: Apple WeatherKit provides weather data, Apple Maps provides map tiles on iOS, and App Store Connect gives us aggregate installation metrics for our developer account. Subject to Apple's Privacy Policy.
- Google Play: Google Play processes Android in-app purchases and subscriptions and gives us aggregate installation, subscription, and store performance metrics for our developer account. Subject to Google's Privacy Policy.
- OpenStreetMap: Stop data displayed in the app is sourced from OpenStreetMap. We query our own servers using geographic coordinates along your route to retrieve nearby stops. No personal data is sent with these requests.
- Weather Services: For fetching weather forecasts along your route. We send geographic coordinates to retrieve forecast data. No personal information is included in these requests.
- Strava API: For importing your saved routes (optional). We request read-only access to your routes. Subject to Strava's Privacy Policy.
- Komoot: You can import Komoot routes by sharing them to Route Companion via your device's share sheet. We do not use Komoot's API or connect to Komoot on your behalf. Subject to Komoot's Privacy Policy.
- Ride with GPS API: For importing your routes (optional). Subject to RWGPS Privacy Policy.
- Garmin Connect: For exporting routes to your Garmin device (optional). Subject to Garmin's Privacy Policy.
- Hammerhead: For exporting routes to Hammerhead Dashboard and Karoo devices (optional). Subject to Hammerhead's Privacy Policy.
- Apple Maps / Google Maps: For map tiles, base map display, and Street View/Look Around previews where available. Subject to Apple's and Google's respective privacy policies.
5. Data Storage & Security
Route data, preferences, and history are stored locally on your device using encrypted storage where available. Requests to our servers contain only the minimum needed to fulfill the feature. Live Location is the narrow exception to immediate-response processing: its simplified route and latest position are stored in an isolated, time-limited session. The session is deleted when you stop sharing or end navigation, after two hours without a location update, or after an absolute maximum of twelve hours. We do not maintain a database of user accounts, personal profiles, or historical location trails on our servers.
6. Data Sharing
We do not sell or rent your personal data. Network requests are made to our servers and to the third-party services listed above only when needed for a feature you invoke. When you start Live Location and share its link, anyone who has that link can view the shared route and latest location until you revoke it or it expires. The link is unguessable, but you should send it only to people you trust.
7. Analytics & Operational Data
We do not use advertising SDKs, tracking pixels, third-party product analytics SDKs, or cross-app tracking. We do record a small set of aggregate, allowlisted feature counters so we can understand which Route Companion features are useful and worth improving. These counters do not include route names, search terms, coordinates, connected account names, or stable user identifiers.
To keep the service running reliably, the following narrow operational data reaches our API gateway. All of it is anonymous by construction:
- Rate-limit counters: short-lived request counters keyed to a hashed install identifier, used only to prevent abuse. Automatically deleted within at most one hour.
- Aggregate usage data: for each request, we record the endpoint name, HTTP status code, response time, and a daily-salted hashed user key derived from an install identifier. The daily salt means today's key and tomorrow's key for the same install are different values, we can count distinct users per day and measure endpoint popularity, but we cannot track any individual device across days or reconstruct a usage history. Under GDPR Recital 26 this qualifies as anonymous data.
- Aggregate feature counters: the app periodically reports allowlisted feature names, open/action counts, and foreground duration totals (for example, that the Discover screen was open for a number of seconds). These reports use the same daily-salted anonymous key and never include route content, location, search text, or identifiers from third-party integrations.
- Third-party service quota counters: the app periodically reports aggregate counts of calls to providers that have monthly quotas (e.g. WeatherKit) so we can monitor our provider budgets. No content, coordinates, or individual request data is reported, only a count.
This data is stored on Cloudflare Workers Analytics Engine for up to 90 days and is used exclusively for operating and troubleshooting the service. Processing is based on legitimate interest under Art. 6(1)(f) GDPR and Art. 31 of the revised Swiss Federal Act on Data Protection.
8. Children's Privacy
Route Companion does not knowingly collect data from children under the age of 13. The app does not require account creation or personal information to function.
9. Your Rights
Under GDPR and the revised Swiss FADP, you have the right to access, rectify, erase, restrict, or object to the processing of personal data about you, and the right to data portability. Because almost all Route Companion data is stored on your device, these rights are primarily satisfied by deleting the app or clearing its storage. For the narrow operational data in section 7, individual access and erasure cannot be technically fulfilled for the anonymous categories because we have no identifier to look up. To exercise your rights or ask questions about your data, contact us at [email protected]
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.
11. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us at [email protected].