Privacy Policy

Last updated: October 8, 2026
Effective date: October 8, 2026

1. Data controller

2. Scope

This policy applies to the Roovr mobile app (iOS and Android) and to the website roovr.app. It complies with the Swiss Federal Act on Data Protection (FADP, in its revised version effective September 1, 2023) and the European General Data Protection Regulation (GDPR).

3. Data processed

3.1 Geolocation

Roovr accesses your GPS location only while the app is in active use (iOS / Android “while using the app” permission). Location is never collected in the background, and never stored on our servers or those of our subcontractors beyond the duration of the routing computation, unless you share a loop by link (see 3.4).

To name the loop and show points of interest (water fountains, viewpoints, toilets), the app also queries two open map services directly from your phone: it sends a central point of the loop to Nominatim and the area around the loop to Overpass API (see section 5).

3.2 Anonymous technical data

To improve Roovr, we collect anonymous usage events:

• device type (model, OS, version)
• app version
• aggregated UI interactions (buttons clicked, features used)
• pseudonymous identifier generated on-device, not tied to your identity

This identifier is generated locally on first app launch and stored in your device's keychain (iOS) or keystore (Android). It is reset whenever the app is uninstalled / reinstalled and is in no way tied to your Apple or Google identity, or to your phone number.

3.3 Crash reports

If the app crashes, a technical report is sent to allow the bug to be fixed: error trace, app memory state at the time of the crash, OS version, and app version.

3.4 Shared loops

When you choose Share a link in the app, the loop is sent to our servers and stored so the link works: the full route (starting point included, which may be your home), elevations, distance, elevation gain, loop name and app language. An image of the loop is generated on a Mapbox map background and stored with it.

• This data is only stored if you share a loop. Without sharing, nothing is kept.
• The loop is visible to anyone who has the link. The link is random and cannot be guessed, and shared loop pages are not indexed by search engines.
• No account, name or email address is associated with a shared loop.
• To have a shared loop deleted, write to hello@roovr.app with its link.

3.5 Data we do NOT collect

• No user account, no email address, no name
• No contacts, no photos, no files from your phone
• No advertising identifier (IDFA / GAID)
• No background location
• No personal route history (a shared loop is not tied to any identity, see 3.4)
• No cross-app tracking (App Tracking Transparency): we don't request the ATT permission because we don't track your activity across other apps or sites.

3.6 Permissions requested by the app

The app requests your authorization for the following permissions:

• Location (while using the app): required to generate a loop from your position. Refusing this permission prevents the app from working.
• Internet / Network access: required to communicate with our routing servers.

No other permission is requested (no contacts, no photos, no microphone, no notifications).

4. Purposes and legal bases

5. Subcontractors and recipients

To operate, Roovr relies on the following subcontractors. No data is sold or shared with third parties for commercial purposes.

Several of these subcontractors are US companies (Sentry, Cloudflare, Railway, Upstash, Mapbox), including when the data is hosted in the European Union. Any transfer to the United States is covered by Standard Contractual Clauses (SCC) approved by the European Commission or, for Mapbox, by its Data Privacy Framework (DPF) certification.

Open map services. To name the loop and show points of interest, the app directly queries two public services from the OpenStreetMap ecosystem. They receive your IP address and coordinates of the loop, without any identifier, and process them under their own policies:

6. Retention period

• GPS location: not stored, except for a loop you choose to share (see 3.4). Used in memory to compute the loop, then erased.
• Shared loops: kept as long as the link exists, until deleted on request.
• Rate-limiting counters: until the end of the day (UTC), then automatic deletion.
• Analytics events: 90 days, then automatic deletion.
• Crash reports: 30 days, then automatic deletion.

7. Your rights

Under the FADP and the GDPR, you have the following rights:

• right of access to your data
• right to rectification
• right to erasure
• right to restriction of processing
• right to portability
• right to object to processing based on legitimate interest
• right to withdraw consent at any time (by revoking the location permission in your iOS / Android settings)

To exercise these rights, write to hello@roovr.app. We respond within 30 days at most.

You also have the right to lodge a complaint:

• in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC)
• in the European Union, with your country's supervisory authority (e.g. the CNIL in France)

8. Security

All communication between the app and our servers is encrypted with HTTPS (TLS 1.2+). The pseudonymous data on the analytics side cannot be traced back to your identity. Backend access is restricted by tokens.

9. Cookies and web trackers

The Roovr mobile app does not use cookies. The website roovr.app only uses technical cookies strictly necessary for its operation (no analytics or advertising cookies). Its traffic measurement relies on Umami, which sets no cookies and does not store your IP address.

10. Minors

Roovr is intended for a general adult audience. We do not knowingly collect personal data from children under 16. If you believe a minor has shared data with us, contact us for immediate deletion.

11. Changes

This policy may evolve. The most up-to-date version is always available at roovr.app/privacy. Substantial changes will be announced in the app once a contact channel exists.

12. Contact