Privacy Policy

In short

Who is responsible

ScoutRoute is developed by Marco Lüthi, the controller responsible for data processing under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Marco Lüthi
Gutstrasse 172
8055 Zürich
Switzerland
hi@luthi-mar.co

Data stored on your iPhone

The routes you save, the rides you record (tracks, ride summaries and place names), the rider name you enter and your app settings are stored locally on your iPhone. They are not sent to the developer or to any server. They may be included in your iPhone backups, depending on your own iCloud or computer backup settings. Deleting the app deletes this data.

Location

With your permission (“While Using the App”), ScoutRoute uses your precise location to show where you are on the map, to guide you along a route and to record the rides you choose to save. While you navigate or record, location continues in the background so guidance and recording work with the screen locked. You can change this permission at any time in the iOS Settings app.

Apple Maps and Apple Weather

To calculate routes, search for places and gas stations, show place names and check the forecast along your route (Rain Watch), ScoutRoute uses Apple's MapKit and WeatherKit services. For this, the relevant locations and search terms are sent directly from your iPhone to Apple. The developer does not receive this data. Apple processes it under its own privacy policy: apple.com/legal/privacy.

Group rides

Group rides are optional. When you start or join one, ScoutRoute shares the following with the other riders in that group:

• the name you enter and a random rider ID generated by the app,
• your position, course, speed and the time of the update,
• the route you are navigating (so others can use Ride Along), and
• any requests you send, such as “Need Fuel” or “Pull Over”.

This data is transmitted through the app's database in Apple iCloud (CloudKit). It is end-to-end encrypted (AES-GCM) with a key that exists only in the group's invite link or QR code. Without the invite, neither the developer nor Apple can read it. To find the right records, the database also stores a one-way hash of the group key. To share your own position you need to be signed in to iCloud on your iPhone. iCloud attaches an app-specific identifier to the records you create; it does not reveal your Apple Account, name or email to the developer.

When you leave a group ride, your records are deleted from the database. Riders who haven't sent an update for an hour are no longer shown, and a group ride session ends after 24 hours. If a ride ends without you leaving it, for example because the app was deleted during the ride, your last encrypted record may stay in the database. It stays unreadable to anyone without the invite link.

Anyone you give the invite link or QR code can join the group and see the shared data, so only share it with people you ride with.

Sharing routes

When you share a route as a link or QR code, or a recorded ride as a GPX file, it is packed into that link or file. It is not uploaded anywhere. It goes only to the people and apps you choose in the iOS share sheet. Files you import (GPX) are read on your iPhone. Shared links and group ride invitations point to this website, with the route or the group's key after the “#”, a part of the address that browsers never send to a server (see Shared links on this website).

Legal basis

Where the GDPR applies, the processing described above is necessary to provide the features you use (Art. 6(1)(b) GDPR). Location access and group rides are based on your choice to enable them, which you can withdraw at any time by changing the location permission or leaving the group ride. Under the Swiss FADP, we process personal data only as described here and in line with its principles.

What ScoutRoute does not do

• No account, sign-up or login.
• No advertising, analytics, crash-reporting or tracking SDKs.
• No tracking across apps or websites, and no selling or sharing of data with data brokers.

This website

This website is a static site without cookies, analytics or tracking. Fonts are served from this website itself, so your browser does not contact third-party font services. When you visit a page, the hosting provider Vercel Inc. (based in the United States, with data centres worldwide) automatically records technical access data in server logs: your IP address, date and time, the requested page, referrer and browser type. This is needed to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). The logs are deleted after a short period. Links to the App Store take you to Apple, where Apple's privacy policy applies.

Google Maps to GPX converter

The Google Maps to GPX converter on this website works in your browser: the route and the GPX file it makes are not stored by the developer.

If you paste a short link (maps.app.goo.gl), the page sends that link through this website to a small function run on Supabase (servers in the EU), which asks Google once where it leads and returns the full address to your browser. The function doesn't store or log the link, and Google sees the function's request, not your IP address.

To find the roads between the stops, the page sends the stops and via points to the directions service of Mapbox, Inc. (USA), and it shows the route on a map from Mapbox. Like any internet request, this reveals your IP address, browser type, the route's points and the map area shown to Mapbox, and the Mapbox software reports each time the map loads. Its optional performance measurements are switched off. Both are based on the legitimate interest in converting and showing your route (Art. 6(1)(f) GDPR). Mapbox processes this data under its privacy policy, which also describes the safeguards for transfers to the United States.

Shared links on this website

A shared route or group ride invitation opens in ScoutRoute if the app is on your iPhone. Elsewhere it opens a page on this website that shows the route, or the name of the ride, so you can open it on your iPhone. The route and the group's key are in the part of the link after the “#”. Your browser reads it on your device and never sends it to this website, so the developer never receives it, and the hosting provider's logs only show that the page was opened. The page never shows a group's key.

To show a shared route on a map, the page loads the map for the route's area from Mapbox, Inc. (USA). The route itself isn't sent to Mapbox, but the map tiles it loads reveal the area shown, along with your IP address and browser type, and the Mapbox software reports each time the map loads. Its optional performance measurements are switched off. This is based on the legitimate interest in showing the route you were sent (Art. 6(1)(f) GDPR). Mapbox processes this data under its privacy policy. The group ride invitation page loads nothing from third parties.

Promo codes

From time to time the ScoutRoute page on this website offers free promo codes. To get one, you enter your email address and, where Apple requires its terms for your country to come with the code, your App Store country. Only then does your browser send them to this website, and from there to the developer's code service, run on Supabase (servers in the EU). It picks a code and emails it to you through the email service Resend. The country is used only for that email and is not stored.

Your email address is not stored by the code service. It keeps only a one-way, keyed hash of it next to the code, so that each address gets one code and can ask for the same code again. Your IP address is kept the same way, as a hash, for up to 24 hours to stop the codes from being emptied by automated requests. Resend keeps a log of the email it delivered, including your address, for a limited time under its own privacy policy. Resend is based in the United States, and transfers rely on standard contractual clauses or equivalent safeguards.

Your address is used only to send the code: it is never added to a mailing list or shared with anyone else. The legal basis is your request (Art. 6(1)(b) GDPR) and, for abuse prevention, legitimate interest (Art. 6(1)(f) GDPR). Nothing is sent before you press the button.

Your rights

You have the right to request access to your personal data and to have it corrected or deleted, to object to or restrict processing, and to data portability. Because the apps store your data on your device and do not identify you, the developer usually holds no personal data about you. Most of it you can delete yourself by deleting the app.

To exercise your rights, email hi@luthi-mar.co. You can also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the data protection authority of your country.

International transfers

Apple may process data in the United States and other countries. Apple describes the safeguards it uses for these transfers, such as the Data Privacy Framework and standard contractual clauses, in its privacy policy. This website is hosted by Vercel Inc., based in the United States; its server logs are transferred under the same kind of safeguards.

Children

ScoutRoute is a navigation app for adults and is not directed at children.

Changes to this policy

If the app starts handling data differently, this page will be updated before the change ships, and the date at the top will change.