Privacy

You can plan rides without an account, and everything you build stays in your browser. If you create an account, we store your email and the rides you save so they follow you across devices. We show no ads and sell nothing about you. We count page visits, without cookies and without anything that identifies you. The iPhone and Android apps need an account and send the rides you record to it; your photos and your phone's motion readings stay on the phone. If you host or join a group ride, the host sees your name and what you tell them, never your email. Cartorider is for people 18 and older.

Routes, stops and settings live in your browser's own storage. We have no copy. Clearing your browser data deletes them, which is also why an account exists.

As you use the map, your browser talks directly to the services that power it, and they receive the technical data any web request carries, such as your IP address. These requests are how the product works, not tracking.

We store your email address, used only to sign you in with a code and for service notices. No passwords. We store the rides you save: their stops, names, options and the routed line, so your collection syncs between devices. A sign-in session records when it expires, not where you were: we do not keep your IP address or browser details on it.

If you choose to, you can add a name, your bike and one line about yourself in My account. All three are optional. The name goes in the GPX files you download, and the name, the bike and the line appear on the rides you share. Clear a field and it disappears from every link you have sent.

You can also add a profile photo and your bikes. The photo is shrunk and redrawn on your device before it leaves, so it carries none of the camera's hidden data, and we keep it in three small sizes. Your photo, name and bikes show on the rides you share and host, and to the host of a group ride you join. Remove the photo and it is deleted from our storage about a day later.

If you add photos to a ride on cartorider.com, your device shrinks each one and redraws it before it leaves, so the copy we store carries none of the camera's hidden data: no location, time, camera serial or owner name. Where and when a photo was taken is kept with the ride, like its stops. Your photos are stored privately and open only through Cartorider: for you, and for the people who open a link you share with Include photos turned on. A photo you remove is deleted from our storage about 30 days later, and from our second backup, in the EU, about 30 days after that.

When you sign in you agree to the terms and this policy and confirm you are 18 or older. We keep a record of that agreement: which version of the terms you agreed to, when, whether you used an email code or Google, and the IP address and browser you signed in from. It is how we can show that you agreed, and we write a new one only when the terms change. Deleting your account (My account → Delete account, confirmed by a link we email you) removes all of this, the record included, 14 days after you confirm.

Publishing a share link stores a frozen copy of that route so everyone who opens the link sees the same ride and downloads the same GPX. Share pages are unlisted, never indexed, show the ride and never your email, show your name and bike only if you added them in My account, and can be revoked at any time. A revoked link stops working.

A link shows your photos only if you turn on Include photos for it, and they show where each one was taken. Turn it off, or turn the link off, and they stop showing within 20 minutes. The preview a messaging app shows for your link never includes a photo.

To keep your door off every link, your account also keeps a short list of private places, worked out from your own rides: your saved Home, a spot your rides keep starting or ending at that is not a public place, a house a shared ride starts or ends at, where your bike stays overnight, and any place you add. A link never shows the stretch of a ride near one. The list is kept with your account, never appears on a link, and is in My account, where you can remove any place; deleting your account removes it.

When you host a group ride, its page shows the ride, its day and time, and your first name, to anyone with the link.

When you join one, you give a name, and optionally your bike, its range and whether you bring a pillion. If you join with your account, the host also sees your profile photo. Only the host sees these. Other riders see how many are going, never who. If the host copies them somewhere else, that is between you and the host.

If you join without an account, you also give an email address. Nobody sees it, the host included. We use it for that ride only: to check it is yours (one tap on the first email), to tell you when the plan changes, and to ask the evening before whether you are still riding. Every email has Leave this ride, which works at once, with no account.

A guest's details are deleted 30 days after the ride, and so is a name the host added for a rider. If you join with your account, your place on the ride is part of your account and goes with it when you delete it.

The Cartorider apps for iPhone and Android record your rides and keep your collection on the phone. They need an account, record nothing until you press Start, and carry no advertising, analytics or crash reporting of their own. What each permission is for:

• Location: while a ride is recording, with the screen off and the phone in your pocket; while the app is open, to show where you are; and for fifteen minutes after a ride ends by itself, in case the bike moves again.
• Motion (Physical activity on Android): your steps, and whether the phone says you are walking or in a vehicle, to tell riding from walking. Used only to read your rides, and never sent.
• Photos: to find the photos you took during a ride, by when and where they were taken. Photos you keep on a ride stay in your library; we never receive them.
• Notifications: the ride's card and its notices, made on the phone. There is no push service.

When a ride ends, the app sends it to your account: the line you rode, its stops and their names, when you rode it, and each leg's distance and riding time. On a long trip the ride so far is saved at each long stop. To fit the line to the roads and find any ferry, the ride's positions go to our own server, which answers and keeps none of them. A walk recorded on its own is never sent.

To name a ride, its stops and the road you are on, the app asks the phone's own place-name service (Apple's on an iPhone, usually Google's on Android), which receives the point it names. On the iPhone the map is Apple's; on Android it comes from our own tile server, as on the website. If you installed through TestFlight, or your phone shares diagnostics with app developers, Apple or Google may send us a crash report, as for any app.

Your rides, their full recordings and the motion readings stay on the phone until you delete the ride, sign out or delete the app. The app also keeps a small log of its own decisions there, which is never sent. Turn any permission off in your phone's Settings. Delete account is at the foot of the app's Account page and works as on the website.

A small set of providers runs the app:

• OVH (France) runs our own routing server, which calculates routes and heights from the points being routed, and nothing that identifies you.
• Cloudflare serves the map and the place search, stores the photos you add, and keeps an encrypted backup. Like any web request, your browser sends it your IP address.
• Neon keeps the account database, and Vercel runs the app.
• Resend delivers sign-in codes and group ride emails (processed in Japan).
• Backblaze (EU) keeps a second encrypted backup, and GitHub runs the job that makes it; nothing is kept there.
• Google, only if you sign in with Google, learns that you signed in to Cartorider and gives us your name, email address and profile picture. Until you set a name of your own in My account, Google's name is the one in the GPX files you download.
• On the phone, Apple and Google name places, as described under The phone apps.

Cartorider is run from Australia, and the providers above keep data in the countries named. Where the law requires it, we rely on the providers' standard contractual safeguards for data that leaves the EU or the UK.

No advertising, no selling or sharing of personal data for marketing, no tracking pixels, no cross-site tracking, no profiles of you built from your rides.

We do count page visits: no cookie, nothing that identifies you, nothing that follows you to other sites. A number, and the site that linked you here.

You can delete your account yourself: My account → Delete account on the website, or Delete account at the foot of either app's Account page, sends you a confirmation link. Opening it turns your share links off at once and signs you out everywhere. Fourteen days later the account and everything stored under it, photos included, are deleted. If you sign in before then, the deletion is cancelled and your rides are still there, but links you had shared stay off. Our first backup keeps a copy of deleted data for about 35 more days. Our second backup, in the EU, lets your photos go about 30 days after they leave our storage, and keeps its copy of your other data until we clear it, which we do not do on a schedule yet. Local, account-less data is under your control in your own browser.

One cookie keeps you signed in. It is needed for sign-in and is never used to follow you. Rides you plan without an account are kept in your browser's own storage, not in a cookie, and never reach us.

We use your data to give you what you asked for: your account, your rides, your share links and your group rides. We also use some of it to keep Cartorider safe and working, which is our legitimate interest: limits against abuse, backups, the record of your agreement to the terms, and counting visits without identifying anyone. On the phone, location, motion and photos are used only with the permission you give in your phone's Settings, which you can take back at any time.

• Your account and everything in it: until you delete it, then 14 days. Copies stay in our backups for a while longer, as Deleting your account explains.
• A photo you remove: about 30 days in our storage, then about 30 more in our EU backup. A profile photo you replace or remove: about a day.
• A share link's copy: until you turn the link off.
• A guest's details on a group ride, and a name a host added: 30 days after the ride.
• The record of your agreement to the terms: until you delete your account.

Wherever you live, you can ask us for a copy of the data we hold about you, to correct it, to delete it, or to stop or limit how we use it. You can take your rides with you at any time: every ride downloads as a GPX file. Write to hello@cartorider.com and we answer within a month. If you are in the EU or the UK, you can also complain to your data protection authority, and in Australia to the Office of the Australian Information Commissioner.

Cartorider accounts are for people 18 and older. If we learn that an account belongs to someone younger, we delete it.

When what we do with your data changes, this page changes first, and its date with it. If a change matters, we tell account holders by email before it applies.

Cartorider is operated by Javier Alvear in New South Wales, Australia. Ask us anything, including to delete your account, at hello@cartorider.com.