Privacy notice

Who runs BikeRouteNow?

BikeRouteNow is my personal hobby project. For privacy questions or requests, email bikeroutenow@gmail.com.

What data is processed?

For route calculation, BikeRouteNow processes the addresses, locations or coordinates you enter. With browser permission, your current location can be used. For each route generation, the server logs the IP address, the country inferred by Cloudflare and technical request data for security, abuse prevention and troubleshooting. Your language choice requires no account.

When you open the starting point map, an approximate Cloudflare location or your browser time zone is used to center it. A city name derived from the time zone may be searched through Photon. This does not set your starting point or request device location.

Purpose and legal basis

Data is used to provide the requested route, map and sharing service, secure the site and improve its operation. The legal bases are performing your request, legitimate interests for security and limited aggregate statistics, and consent for analytics cookies and advertising. Your current location is requested only after you allow it in your browser.

External services

Place searches use Photon. Weather and missing elevation data use Open-Meteo. Numbered junction connections use OpenStreetMap data through Overpass. In production, route calculation runs on our own BRouter service. Map tiles are loaded directly from OpenStreetMap when a route map or the starting point map is shown. These providers can receive the coordinates needed for the request and technical connection data. Ko-fi opens when you follow a support link.

Analytics and cookies

We count daily page views and use of features such as route searches, preferences, downloads and sharing on our own server. These statistics contain only totals and separate category counts, without cookies, visitor identifiers, IP addresses, user agents, entered text, addresses, coordinates or shared-route IDs. We do not build visitor profiles or recognise returning visitors from these counts. They are retained for 90 days. The basis is our legitimate interest in improving the site with minimal impact on privacy. You can object by disabling Site statistics under Privacy settings; Do Not Track and Global Privacy Control also disable measurement.

Google Analytics starts only after analytics consent under the current policy. With consent, it can connect visits and actions using cookies. Advertising measurement and personalisation require separate permission. We measure coarse traffic-source categories, language, feature use and consent levels, never entered addresses, coordinates or route contents. Country signals select the applicable regional policy; an unknown region never grants permission. BikeRouteNow is established in the Netherlands, so a visitor outside Europe does not automatically lose GDPR protections. No regions currently enable Google measurement without analytics consent. You can withdraw permission or stop all statistics in Privacy settings. Do Not Track and Global Privacy Control stop measurement and advertising. Accessible tracking cookies are cleared on withdrawal; the page may reload.

Advertising measurement and personalised advertising have separate choices. If you allow them, Google may use cookies and interaction data to measure campaigns and create advertising audiences. With advertising consent, Google AdSense may show personalised or non-personalised ads. After a valid privacy choice without advertising consent, Google may attempt limited ads without personalisation. In the EEA, UK and Switzerland, Google’s certified Privacy & messaging platform collects this choice and lists advertising vendors and purposes. Elsewhere, our own cookie controls ask for your permission once Google confirms the European message does not apply. The Google consent bootstrap loads before a choice with ad requests paused; it can store necessary consent-management information. Limited ads may use storage only to detect invalid traffic. If the Google message is unavailable, ad requests remain blocked. Google does not guarantee that an ad will be shown.

Google Analytics retains event and user data for 14 months; aggregated standard reports may remain available longer. Google and other providers may process data outside the EEA under their applicable transfer safeguards. More information is available at policies.google.com/privacy and policies.google.com/technologies/partner-sites. Contact bikeroutenow@gmail.com for questions or privacy requests.

Retention and security

Unshared route searches are not stored as route records or in server logs. Shared routes expire after 90 days; expired files are cleaned up on access and at least hourly while the service is running. Saved browser preferences contain no locations and can be disabled in the planner. IP addresses used for rate limiting remain in server memory for no more than one hour. The IP address and country of a route generation are also recorded in the protected server log and retained according to the system log retention setting. External services and hosting providers may use their own logs and retention periods. The production connection is intended to be secured through HTTPS.

Your rights

You may request access, correction or deletion of personal data, object to processing or request restriction. Email bikeroutenow@gmail.com. You may also lodge a complaint with the Dutch Data Protection Authority.

Changes

This notice may change when BikeRouteNow or its services change. The latest version and date are always shown on this page.