RouteMapBack to RouteMap

Privacy Policy

Last updated 13 October 2026

1. About this policy

RouteMap ("we", "us", "our") is operated by Jason Reeve, based inAustralia. This Privacy Policy explains how we collect, use, store and share your information when you use the RouteMap mobile application ("the App").

We handle personal information in accordance with the Australian Privacy Act 1988and the Australian Privacy Principles. This policy also addresses the requirements of the EU and UK General Data Protection Regulation (GDPR) and theCalifornia Consumer Privacy Act (CCPA) where they apply.

By using the App, you agree to the practices described in this policy.

2. Information we collect

2.1 Account information

When you create an account, we may collect:

• Your email address and name (email and password sign-up).
• Your Google account identifier, email, name and profile photo (Google sign-in).
• Your Apple identifier and, if you share it, name and email (Sign in with Apple).
• Your Strava athlete ID, display name and profile photo (Strava sign-in or connection).
• An email address for reminders, if you add one in Settings > Notifications (see 2.8).
• A session token stored on your device to keep you signed in.

Passwords are stored on our servers as bcrypt hashes. We never store plain-text passwords.

2.2 Strava activity data

When you connect Strava, we access your activities with read-only scope (activity:read_all). We retrieve the activity metadata needed to draw routes on the map: name, type, distance, dates and the encoded route polyline. We store Strava OAuth tokens on our servers, encrypted, so we can sync on your behalf and refresh them when they expire.

We do not post to Strava or modify your Strava data.

Strava also notifies our server when you create, change or delete an activity, or when you revoke RouteMap's access, so the map stays current without polling.

Your activities are stored on your device so your map works offline and opens quickly. We also keep a backup of your activities on our servers (name, type, date, distance, elevation and route line) so your map can be restored if you reinstall or change phones. With a VIP subscription, when your full history is imported, activities are fetched on our servers first and held in a temporary cache for no more than 7 days until the App collects them.

Disconnecting Strava. You can withdraw access at any time withDisconnect in Settings, Sources, or from your Strava account settings on strava.com. When you do, we revoke our access to your Strava account and delete your Strava data from our servers (tokens, the activity backup, any cached activities, and the name and profile photo that came from Strava) straight away, and the App removes your Strava activities from your device. The App confirms on screen when this is done. Routes you imported from GPX files are yours and are kept.

If you delete an activity on Strava, we remove it from our copies too, and keep only its activity number for up to 60 days so an older copy on one of your phones can't bring it back.

2.3 Imported GPX routes

You can import routes from GPX files. They are stored on your device and in your backup on our servers, so they come back on a new phone and show on every phone you sign in on. When you delete an imported route, we keep a record of which route it was so it is removed from your other phones too. GPX routes are never sent to Strava. They stay until you delete them or delete your account.

2.4 Location data

When you grant location permission, the App uses your device's position to:

• Centre the map on where you are.
• Show nearby activities and routes.

Location is processed on your device for map display. We do not store your live position on our servers.

2.5 Photos and media

When you grant photo library permission, the App may:

• Save exported map images to your device's photo library.
• Read images you choose to import for your profile.

We do not upload your photos to our servers. Profile images from Strava or Google are referenced by URL and not re-hosted by us.

2.6 Usage and error data

When the App crashes or hits an error, it sends a report to Sentry (sentry.io) so we can fix it. A report can include:

• Your device model, operating system and App version, and the error with its stack trace.
• A short trail of what the App did just before, for example which screen was open, whether a sync, import or purchase worked, and how far the map was zoomed.
• How many activities are stored on your device.
• Your RouteMap account ID (a random identifier, not your name or email) and whether you have VIP, so a report can be matched to your account when you ask us for help.

Map positions are removed from reports before they are sent, and anything that looks like an email address, password, token or key is redacted.

You can also choose to send us something through Sentry: a feature suggestion from Settings, or a note on the message shown after a crash. If you type your email address into that note, it is sent too, only so we can reply.

2.7 Support diagnostics

So we can help when something looks wrong (for example, your activity totals change), we keep a short record for your account on our server:

• Once a day, counts from the App: how many activities it holds and shows, how many are set aside as duplicates, hidden, filtered out or not drawn on the map, your total distance, whether a filter is on, your App version, and whether you have VIP.
• Events: when you sign in or out, when a session stops working, when Strava is connected or disconnected, when an activity is deleted on Strava, and when your backup gets smaller.

These are counts and yes or no flags only. They never include your routes, locations, place or activity names, or activity IDs. We use them only to answer your support questions and to spot problems in the App.

2.8 Notifications and reminder emails

If you allow notifications, the App gives our server a push token for your phone (a random address issued through Apple or Google) so we can send you notifications. We can also email the address on your account.

If your account has no email address (for example, you sign in with Strava), you can add one inSettings > Notifications just for reminders. We send a link to that address first and use it only after you open the link. It is never used to sign in, and you can remove it in the same place.

Today the only message is a monthly reminder: when you have recorded new activity on Strava and have not opened the App for 30 days or more, we send one notification, or one email if we cannot reach your phone. You get at most one a month, and only when there is something new. We keep a record of each reminder (when, how, and whether it was delivered) to keep to that limit.

Turn reminders off at any time in Settings, Notifications (email and push separately), with the unsubscribe link in any reminder email, or in your phone's settings. Push notifications are delivered through Expo, and on to your phone byApple Push Notification service (iPhone) or Firebase Cloud Messaging (Android). They receive the push token and the text of the message, never your activities.

2.9 Purchase information

VIP purchases are processed by the Apple App Store or Google Play. We use RevenueCat to verify entitlements. RevenueCat receives yourRouteMap account ID, a device identifier and the purchase receipt, not your payment card details.

2.10 Map and search data

The App draws its map with Apple Maps on iOS and Google Mapson Android. When a map is displayed, those providers may collect data under their own privacy policies. Place search sends the text you type to OpenStreetMap's Nominatim service to find matching places.

2.11 Advertising

Free users may see an in-app RouteMap message before certain actions such as export. We do not use third-party ad networks. VIP users do not see these messages.

2.12 Linking to Stridefall (optional, off until you link it)

Stridefall is a game made by the same developer (Mandooist).The link is off until you link it. Nothing about you is sent to Stridefall unless you start the link in Stridefall and then confirm it in RouteMap.

While the link is on, RouteMap shares the following about newly recorded Strava activities with Stridefall, through the Mandooist ledger (a service run byMandooist on Google Cloud): the activity's start and end time and time zone, sport type, distance, moving time, elevation gain, the route line, the Strava activity number, average and maximum heart rate if Strava has them, and the identifiers that join yourRouteMap account to your Mandooist account. We do not send the activity name. Only outdoor activities that Strava recorded with GPS (not manual entries, not indoor activities, and at least 300 metres) are sent, and only activities that start after you link. Activities from before you linked, and routes you import from GPX files, are never sent.

If you delete an activity on Strava, we tell Stridefall to remove it. If you disconnect Strava or revoke RouteMap's access, we tell Stridefall to drop the Strava derived data. You can unlink at any time in RouteMap (Settings, Connected apps, Stridefall) or in Stridefall (Sources); this stops any further sharing. Stridefall's own privacy policy describes what it does with the data it has received.

3. How we use your information

4. Data sharing and third parties

We do not sell your personal information. We share limited data only with:

Our backend is hosted on Railway in the United States. Account, token, session and backup data live in a database we configure there.

Strava may monitor and collect data about how the App uses the Strava API ("Usage Data") and may use it for any business purpose, as described in Strava's API Agreement.

5. Data storage and security

• Server: user accounts, encrypted Strava tokens, session records, your activity and GPX backup, and a temporary (7-day) cache of activities being imported, in PostgreSQL, reached only over HTTPS.
• Device: activities, imported GPX routes, preferences, favourites and your session token in the App's local storage.
• We use industry-standard practices: hashed passwords, signed session tokens, and no secrets embedded in the App itself.

6. International data transfers

Data may be processed in the United States (hosting, RevenueCat, Sentry, Google). We rely on provider compliance and applicable transfer mechanisms where required.

7. Data retention

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information. Use Delete account in Settings,Disconnect Strava to delete only your Strava data, or seeAccount deletion. We confirm when deletion is complete.
• Export your data. Contact us and we will provide a reasonable export of server-held data.
• Withdraw consent where processing is consent-based.
• Lodge a complaint with your privacy regulator.

Australia: OAIC.EU and UK: your local Data Protection Authority.California: we do not sell personal information.

To exercise any of these rights, contact us by email at support@mandooist.com.

9. Children's privacy

The App is not directed at children under 13 (or 16 in the EU). We do not knowingly collect data from children. Contact us to request deletion if you believe a child has provided data.

10. Changes to this policy

We may update this policy. The "Last updated" date at the top will change. Continued use after an update constitutes acceptance of the revised policy.

11. Contact us

Jason Reeve, Mandooist.

You can reach us by email at support@mandooist.com.

Help and frequently asked questions are on theSupport page.

RouteMap (package app.routemap) on the Apple App Store and Google Play.

Back to RouteMap