Privacy

Account data

If you sign up, we store your email address and a Cognito user ID. You can optionally add a first and last name, and you get a username (a public handle, defaulted from the part of your email before the "@", which you can change). We also store an optional "how did you find us" answer (reddit, google, tiktok, an ad, a friend, or other). Sign-in is handled by AWS Cognito, including "Continue with Google". We also record when you last signed in and, unless you opt out of usage statistics, when you were last active.

Billing data

If you buy a paid plan, we store a Stripe customer ID, your subscription status, plan interval (monthly, yearly, or lifetime), and the billing period dates. We do not store your card number. Stripe handles all card data; we never see it.

Trip and content data

Trip names, stops (coordinates, labels, notes), colors, routing preferences, the computed route geometry between stops, groups ("Past", "Planned", and custom groups), routes you follow or share, and your saved places (a name, coordinates, and optional address, note and color for each, including any you import from a Google Takeout file). Because trips and saved places are made of places and routes, they can reveal where you have been or plan to go. While signed out this lives in your browser; on first sign-in it is claimed onto your account and saved to our servers.

Map searches and routing coordinates

When you search for a place or build a route, the search text and your stop coordinates are sent to our mapping providers (see "Who we share data with") so we can return suggestions and compute the driving between stops. No account is required.

First-party product analytics

We measure usage ourselves in two ways. First, your browser sends usage events (for example, exporting a trip or changing the map style) to our server. In the EU, EEA, UK, Switzerland, Quebec, or where we cannot tell your location, it sends none until you click Accept. It also sends none after you click Decline, or if your browser sends Global Privacy Control and you have not clicked Accept. Clicking Accept overrides Global Privacy Control. Second, when you use a feature that calls our API (computing a route, sharing, importing, and similar), our server records that action for our own statistics: aggregate counts, daily, weekly, and monthly active users, and which features are used. Records other than the aggregate counts are tied to your account ID, or to a random anonymous visitor ID (a UUID) created in your browser if you have no account. The ID carries no name, email, or device fingerprint. We do not share these records and do not use them for advertising. If you click Decline in "Cookie preferences", or your browser sends Global Privacy Control and you have not clicked Accept, that browser adds an opt-out header to every request and our server stops recording your actions and counting you as an active user from then on. Our server still adds each action to an anonymous total (for example, the number of routes computed that day) that holds nothing identifying you or your browser. This applies per browser, so repeat it on each device. Account creation and subscription events, which reach us from our sign-in and payment providers rather than your browser, are still recorded. Records we keep for security (IP-ban activity), rate limits, and plan limits continue. In the regions above, recording of your actions continues until you click Decline. This is a free, one-click way to object. When you sign up, the anonymous ID is linked to your account so earlier activity is attributed to you.

IP address

Every request reaches us with your IP address, and we store it in more than one place. It is written onto each per-action journal row, for signed-in and anonymous visitors alike (kept 180 days); onto the once-a-day activity marker for anonymous visitors only, so one person cycling visitor IDs is not counted as several people (about 400 days); and into a per-IP index that links an IP to the visitor IDs and account IDs seen from it (30 days for anonymous entries, 90 days for account entries). If an IP is blocked for abuse, the address and the reason are stored on the block record (about 400 days). Your IP is also the key we count requests against for rate limiting. We use it for abuse prevention, enforcing blocks, rate limiting, deduplicating usage counts, and operator triage. We do not use it for advertising or profiling.

Third-party analytics (Google Analytics 4)

Google Analytics 4 records the pages you visit, with identifying query values removed (only campaign and ad-click parameters such as utm_* and gclid are kept, and never the URL fragment), and high-level lifecycle and revenue events (sign-up, login, password reset, checkout start, purchase, share, trip creation). These carry plan names, opaque share IDs, and amounts, not your name or email. GA4 sets its own cookies and processes your IP and device data. In the EU, EEA, UK, Switzerland, Quebec, and where we cannot tell your location, Google's script is not loaded at all until you click Accept. Everywhere else, including the US, we keep it on by default with no banner. There Google Signals is off and Google's ad storage, ad user data, and ad personalization signals are denied. See "Cookies" below for how to turn it off.

Operational logs

We log technical details of requests and errors: route and handler, HTTP method and status, latency, a request ID, a user ID where signed in, and for client errors the page URL, user agent, release, and error message. URLs are recorded with authentication and token parameters stripped. Some log entries carry content: when a place-search or geocoding provider fails and we fall back to another, we record the search text (trimmed to 120 characters) or the coordinate we looked up, so the failure is diagnosable. If you send feedback from an upgrade prompt, the full text you type is stored as a log entry as well as emailed to us.

Daily games

If you play Detour, Fog of Road, Borderline, or Whereabouts, we store your play history (the day, your score, and the route you drew, or for Whereabouts each round's guesses) and a ranking row carrying your display name and score. Ranking rows are shown to other players on the public leaderboards. Both are kept indefinitely today: they have no expiry, and an account deletion does not remove them. Whereabouts free-play sessions are deleted after 7 days, and the list of locations you have already seen in free play is kept for 365 days to avoid repeats. Your daily Borderline drawings, including past days you play from the archive, are also merged into the Borderline Atlas, a public map of where all players draw each border. It shows only the combined density of many drawings, never one drawing, name, or account. A place appears only after at least 5 players have drawn it, and a spot stays blank until at least 3 drawings pass through it. Casual practice drawings are not used.

Release-note poll answers

When a What's New release note includes a poll, you can pick an option, write a comment of up to 500 characters, or both. We store the option, the comment, the time, and who answered: your account ID if you are signed in, otherwise your random anonymous visitor ID. You can answer each poll once. The operator results view shows the answers and comments and whether each came from an account, not who gave it. Answers tied to your account are deleted when you delete your account. Answers given under an anonymous visitor ID are kept until the release note itself is deleted, and clearing your browser's data does not remove them, so email us if you want one removed. A comment is free text, so leave out personal details.

Your public label

Your username is a public handle. Where you have not set one, some features fall back to the part of your email address before the "@" and show that instead: it is snapshotted onto share links you mint and shown to people you invite to collaborate on a trip. Setting a username replaces it going forward.

Strictly necessary (used to deliver what you asked for)

Sign-in / session tokens (the auth library's CognitoIdentityServiceProvider.* keys) and your account's local copies: trips, groups, follows, and shared-trip caches (rt.trips, rt.groups, rt.serverCache, rt.pendingCreate, rt.followsCache, rt.hiddenFollows, rt.collabCache, rt.hiddenCollab, rt.lockedCollab). These are cleared when you sign out; if your session expires instead, trips that were never saved to your account stay on the device so they are not lost.

Anonymous visitor ID (rt.anonId)

A random ID created on your first visit and kept in IndexedDB. It lets you keep trips and game progress without an account, and it is linked to your account if you sign up. It is not removed when you sign out; it stays until you clear this site's data in your browser. rt.whatsNew remembers which release notes you have seen and holds a copy of this ID (while you are signed in it holds your account email instead, which is replaced by the ID when you sign out). rt.whatsNewPoll remembers which release-note poll you answered, the option you picked, and the results you were shown; it holds no comment and no email, only a hashed tag for your account (or "anon"), and the account-tagged entries are removed when you sign out. rt.games.claimPending remembers whether game progress still needs to move to your account.

Sign-in, sign-up, and checkout hand-offs

Short-lived items that carry state through a redirect and are removed once used or when the tab closes: where to return after sign-in (rt:post-auth-next), the trip you were editing (rt.resumeTrip), which sign-up prompt you came from (rt.signupSrc), a pending checkout (rt.pendingPurchase), shared trips being imported (rt.pendingSharedImport), a guest-trip claim in progress (rt.claimBatchId), a shared trip you just joined (rt.justJoinedCollab), a sign-out in progress (rt.signOutIntent), and the one-time notice after account deletion (rt.accountDeleted). rt.hadAccount is a yes/no flag that this browser has been signed in, so the header offers Sign in rather than Sign up; it stays after sign-out and is removed if you delete your account. rt.lastEmail prefills the email you last signed in with and is cleared on sign-out.

Your cookie choice

omr.consent (localStorage) stores the Accept or Decline choice you made in the cookie banner or in Cookie preferences. We work out whether to ask for consent from your country as reported on each page load, and do not store it.

Preferences and app state

Settings you chose and where you left off, kept only on this device: theme (rt.theme), distance units (rt.units), map style (rt.mapStyle), the last map position and zoom in the trip builder (rt.viewport), map marker and legend settings (rt.markerPrefs, rt.legendOpen, rt.legTimesInList), Reach settings such as drive time, colors, and speeds (rt.reach), the reachable-roads overlay (rt.reachableRoads, rt.reachableRoadsFilter), image export and drawing settings (rt.imageExport, rt.crayonDetail, rt.crayonTurnDeg), dismissed tips and prompts (rt.firstRunDismissed, rt.nameNudgeDone, rt.dunningStripDismissed, rt.promptDismissed.*, rt.promptSlot), a count of how many browser sessions you have opened so first-visit help can fade out (rt.sessionCount, with this tab's number in rt.sessionOrdinal), and a 7-day cache of ferry route lookups (rt.ferry.*). The games keep tutorial flags, board tabs, practice history, and in-progress round state (rt.detour.*, rt.fog.*, rt.borderline.*, rt.whereabouts.*, rt.satfinder.*, rt.regions.lastPlayedDay, and regiongame:session:v1:<modeId> for the Regions game's daily move budget).

Non-essential (analytics)

Google Analytics 4 cookies (_ga and _ga_*). In the EU, EEA, UK, Switzerland, and Quebec they require your consent.