Privacy Policy

Who we are

EnduroRoute is an iOS application for motorbike navigation on UK green lanes and BOATs. The service is operated by EnduroRoute ("we", "us", "our"). For data protection queries, contact us at [email protected].

Location and GPS data

Location access is core to the app. We use it for:

• Showing your position on the map
• Calculating routes from your current location
• Recording your ride track when navigation is active
• Providing weather conditions for your location

GPS data is processed on-device during your ride. Your location is never sent to our servers in real time. It is only uploaded if you explicitly save a ride and choose to sync or share it.

We request "Always On" location access only to support background ride recording while the app is minimised during navigation. You can revoke this at any time in iOS Settings → Privacy → Location Services.

Ride recordings

When you complete a navigation session, you choose whether to save the ride. Saved rides contain:

• The full GPS track (coordinates and timestamps)
• Distance, duration, and elevation data
• Any photos you attach
• Your title, description, and difficulty rating (if you add them)

Saved rides are stored in your account on our servers and are private by default. You must explicitly choose to share a ride to the community for it to become visible to other users.

When sharing, you can use the built-in Trim feature to remove the first and last portion of your track — protecting your home address and personal locations.

Account data

If you create an account, we store:

• Your email address (used for login and account recovery)
• A hashed password (we never store your password in plain text)
• Your display name (shown on shared community rides)
• Your saved routes and rides (linked to your account)

You can delete your account at any time by contacting [email protected]. This permanently deletes all associated data.

Community sharing

When you share a ride to the community feed, the following becomes publicly visible:

• Your display name
• The trimmed route track (not the full original recording)
• Any photos you attach
• Your title, description, difficulty rating, and tags

Shared rides can be removed at any time from the app. Removal deletes the public entry and any associated photos from our servers.

Photos

Photos attached to rides are stored on Cloudflare R2, a cloud storage service. They are served via our CDN and are publicly accessible if attached to a shared community ride. Photos attached to private rides are accessible only to you.

Anonymous usage analytics

We use PostHog (self-hosted on our servers) to collect anonymous usage data. This helps us understand which features are being used and improve the app. Analytics data includes:

• Which screens and features are used
• General usage patterns (e.g. "a route was planned", "navigation was started")
• Device type and iOS version

Analytics data is not linked to your identity and contains no GPS coordinates or personal information. Our PostHog instance runs on our own servers in the EU — data is not sent to PostHog's cloud.

Crash reporting

We use Sentry to capture crash reports when the app encounters an unexpected error. Crash reports contain:

• The stack trace of the error
• Device type and iOS version
• App version

Crash reports do not contain your GPS location, ride data, or account information. Sentry data is processed in accordance with Sentry's privacy policy.

Third-party services

EnduroRoute uses the following third-party services:

• Open-Meteo — weather data. No account required, no personal data sent. Terms
• Nominatim / OpenStreetMap — place name search. Queries sent include the search text you type. No personal data attached.
• What3Words — optional location entry by three-word address. Subject to What3Words' privacy policy.
• BRouter — self-hosted routing engine on our own servers. Route requests contain waypoint coordinates only, not your identity.
• Cloudflare R2 — photo and tile storage. Subject to Cloudflare's privacy policy.

Data retention

• Account data is retained until you delete your account
• Ride recordings are retained until you delete them
• Anonymous analytics are retained for 12 months
• Crash reports are retained for 90 days

Your rights (UK GDPR)

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to processing of your data
• Data portability (export your rides in GPX format)

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Children

EnduroRoute is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it promptly.

Changes to this policy

We may update this privacy policy as the app evolves. Material changes will be notified via the app. The date at the top of this page reflects the most recent update.