Privacy

Your routes say where you live and where you go. rutefold keeps them to help you choose your next one, and for nothing else: no ads, no selling your data, no tracking you around the web.

Who's responsible

rutefold is run by Evert Van den Bruel, L. Carrestraat 30b, 2220 Hallaar, Belgium. For anything about your data, write to hello@rutefold.com.

What rutefold keeps, and why

• Your account: your name, email address and password (stored only as a hash). To sign you in and to send you a link when you've forgotten your password.
• Your routes: each route's GPX file (the one you added, or the one rutefold makes from an imported outing) and what rutefold works out from it (the line, distance, climbing, where it starts, the places it passes), plus the names, notes, tags, colours, collections and favourites you give them.
• Your outings: from your Strava archive or from Garmin through Intervals.icu, each outing's date, name, type, distance and moving time. An outing on a new route becomes that route, track and all; one on a route you already have goes into its history. They're how rutefold learns your pace.
• Your home location, if you set one: to show how far a route's start is. Nobody else sees it, except apps you connect (see below), which can use it to find routes near you.
• Your phone's location, in the iPhone app, only if you allow it: to find routes near you and to show where you are on a route. Where you are on a route never leaves your phone; for routes near you, the app sends your position with the search, and rutefold uses it for that search only and doesn't keep it.
• Signing in: for each signed-in browser, its IP address and browser name, to keep your account safe. Removed when you sign out.
• Connections: for Intervals.icu, your athlete ID and name and your API key (encrypted); for apps you connect, like Claude or ChatGPT, which app it is, when it last used its access, and when you turned it off.
• What you do in rutefold: things like signing up and in, adding, downloading, sharing and deleting routes, making collections, connecting an app, and which of rutefold's tools a connected app used, each with when and whether it was on the website, in an app or through a connected app. Never what you searched for, or what you asked a connected app and what it answered. To see how rutefold is used and what to make better.
• Which pages are opened: each page's address (without route numbers, share link codes or searches), the other site that linked to it, if any, a link's campaign tags, whether it was on the website or in an app and by someone signed in, and a code made from the IP address and browser with a random key that's thrown away after the day, so a visitor counts once a day. Nothing that says who it was, so it can't be linked to you or followed from day to day. To see which pages people find and use.

The Strava archive you upload is deleted as soon as the import ends. rutefold keeps all this because you asked it to: it's the service you signed up for (in GDPR terms, the performance of our agreement). The sign-in details are kept in our legitimate interest of keeping accounts safe, and the record of what you do in our legitimate interest of seeing how rutefold is used, to make it better. You can object to that record (see your rights below).

Who else sees it

Nobody, unless you share a route or a collection (then anyone with its link can open it, until you turn the link off) or connect an app (see below). To run rutefold, a few services handle some of your data for us:

• Hetzner (Germany) hosts rutefold and its backups, in the EU.
• Resend (United States) sends rutefold's emails, like the link when you've forgotten your password, so it gets your email address and the message.
• Fastmail (Australia) holds the emails you send to hello@rutefold.com and our replies.
• Mapbox (United States) looks up the places you search for, and the place names along your routes from their coordinates. When it doesn't answer, Photon by Komoot (Germany) does.
• OpenFreeMap serves the map: your browser loads its map images directly, which shows them your IP address.
• Intervals.icu, only if you connect it: rutefold reads your outings from it with your key.
• Apps you connect, like Claude by Anthropic or ChatGPT by OpenAI (both United States): they can read your library, home location included, to answer what you ask them, and, if you allow it, make and change your collections. They can't change your routes. What they do with it is up to them and their own privacy policy. You can disconnect them under Account.

With Resend, Fastmail and Mapbox your data leaves the EU, under the safeguards they offer for that, such as the European Commission's standard contractual clauses. Apps you connect may be outside the EU too.

Cookies

Two cookies, both needed for rutefold to work: one keeps you signed in, the other holds a security code for forms and a few page settings, like the last library view you had. No tracking or advertising cookies, so there's nothing to accept. Your browser also remembers a few display settings on your own device, like whether the heatmap was on.

Server logs

rutefold's server logs requests, with IP addresses and the pages asked for, to find and fix problems. Locations, places and searches are left out of them. The logs are overwritten as new ones come in, and aren't used for anything else.

How long it's kept

As long as you have an account. When you delete it, your account, routes and outings go straight away and their files within minutes. The record of what you did stays, without anything that says it was you. Copies in our nightly backups are removed after 14 days. Place lookups are cached for up to 30 days, without anything that says whose they were.

Your rights

• See and take your data: Account → Download all your data gives you a zip with every route's GPX file, the rest of your library and the record of what you did.
• Correct it: change any route, note or setting in the app, or ask us.
• Delete it: Account → Delete your account.
• Object to or restrict how we use it: write to hello@rutefold.com.

If you think we handle your data wrongly, tell us first if you can. You can also complain to the Belgian Data Protection Authority, dataprotectionauthority.be.

Changes

If this changes, the date at the top changes with it. For changes that matter to you, we'll email you before they take effect.