Privacy

Last updated 18 September 2026. Applies to the Trail Ride app and to trailrideapp.com.

This policy describes what the Trail Ride app and this website do. The operator's full contact details will be added below. Until then, use the support contact on the app's store listing.

The short version

Your tracks stay on your phone. We do not have an account system, so there is nothing to log in to and no profile of you anywhere. We run no analytics and no advertising, and the app contains no third-party tracking code of any kind.

A few things do leave your phone, each only when something specific happens, and each is described below: a surface check when you ask for one, ordinary web requests to our server (which is also how map tiles and offline maps are fetched), and a diagnostics file if you choose to send one.

Who is responsible

Trail Ride is operated by an individual developer in the Netherlands; the name and postal address will be added here. For anything about this policy or your data, use the support contact on the app's store listing.

Under the GDPR we are the "controller" for the limited processing described here.

Your routes and tracks

GPX files you import, tracks you record, waypoints you add, and the names and colours you give them are stored on your device only. They are not uploaded, not synced through us, and not visible to us. We could not produce a copy of your tracks if you asked us to, because we do not have them.

They are included in your own iPhone backup, if you have one — that backup is between you, your device and Apple or your computer. We are not part of it.

If we ever add syncing between your devices, it will use your own iCloud or Google account, so the data still never passes through our servers. That is a deliberate design rule, recorded in the project's roadmap, not an aspiration.

Surface check

To tell you how much of a track is unpaved, the app sends the shape of that track — a simplified list of coordinates — to two free public services run by the OpenStreetMap community: the FOSSGIS routing server (valhalla1.openstreetmap.de) and the Overpass API (overpass-api.de), both in Germany. They match the line to mapped roads and tracks and return what surface each is recorded as.

• What is sent: coordinates only. No name, no file, no device identifier.
• Who receives it: those two services, not us. They are operated by third parties under their own terms, and like any web server they see the IP address the request comes from.
• When: once per track, when you tap to check it. The answer is stored on your phone, so the same track is never sent twice.

Offline map areas

Downloading a trip's map for offline use does not send us your route. Your phone works out which parts of the map it needs, then fetches them from our map server the same way it fetches the map when you look at it — ordinary requests for pieces of one public map file. The file it builds stays on your phone and can be deleted in Settings.

Those are ordinary web requests, covered in the next section — which is also why their content is not kept: our server does not log which part of the map was asked for.

Ordinary web requests

Using the app's map, and visiting trailrideapp.com, means making web requests. Our server logs the IP address, the time, which of our sites was asked, and how it answered. It deliberately does not log the address that was requested or the request's headers — those can say which part of the map you were looking at — so the log cannot show where anyone was. We use the log to keep the service available and to stop abuse, for example rate limiting someone hammering the map tiles.

• Retention: access logs are kept for 14 days and then deleted. That number is set in our server configuration, not left to habit. The system's own service log is capped by size rather than by age and is not used to look up individual requests.
• Legal basis: our legitimate interest in running a service that works and is not abused.
• IP addresses are personal data. We do not combine them with anything else, and we do not build profiles from them.

The marketing site sets no cookies at all — not analytics cookies, not "essential" cookies, none. That is why you are not being asked to consent to any. The app's API sets none either.

Crash reports

If your iPhone is set to share analytics with developers, Apple may send us crash reports for the app. These come from Apple, in Apple's format, and describe how the app failed — not where you were or what you were riding. You control this in iOS Settings under Privacy & Security ▸ Analytics & Improvements.

We use no third-party crash or error reporting service. There is no such code in the app.

Diagnostics you choose to send

The app keeps a short log of what it did — an import failed, a ride started, the map needed repairing — to make problems diagnosable. It is stored on your phone and is never sent anywhere by itself. You can read it and share it from Settings if you are helping us track something down.

The log is filtered so it cannot contain positions, track names or file names. That filtering is enforced in code rather than left to care: a value that looks like a coordinate or a path is dropped before it is written.

If you email us a log, we keep it only as long as it takes to look into the problem.

Who else is involved

• Our hosting is a single server rented from netcup GmbH, a German company, in an EU data centre. Nobody else operates it and no other service holds a copy of what is on it.
• Cloudflare sits in front of our website and API to keep them available and absorb attacks. It processes the IP addresses of requests on our behalf, and is based in the United States, so this involves a transfer outside the EU under Cloudflare's standard data protection terms. Requests for map tiles go directly to our server and do not pass through Cloudflare.
• Apple and Google distribute the iPhone and Android apps. Their handling of store accounts and downloads is covered by their own privacy policies, not ours.
• OpenStreetMap is where our map data comes from. Map data flows from them to us. The one exception is the surface check described above, which sends a track's shape to two community-run OpenStreetMap services.

We do not sell data, and we have nothing to sell.

Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction, objection, and portability, and you can complain to a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

In practice, for this app, the honest version is:

• Your tracks: we do not have them. Deleting them means deleting them in the app, or deleting the app. There is nothing for us to delete on our side.
• Server logs: we can search for and delete entries for an IP address if you give us one, within the retention period.
• A diagnostics file you sent us: ask and we will delete it.

Children

Trail Ride is a navigation tool for motorcyclists and is not directed at children.

Changes

If this policy changes in a way that affects what leaves your phone, the app will say so in a release note rather than quietly updating a web page. The date at the top is the version in force.