Privacy

Vegfar counts which roads you have ridden. Doing that means holding a record of where you have been, which is about as personal as personal data gets. This page says exactly what is held, for how long, and who can reach it.

Who is responsible

The controller of the data described here is ACR Holding AS, a company registered in Norway, organisation number 923 665 307. Write to [email protected] about anything on this page, including a request to see, correct, export or delete what is held about you.

What this page covers

Two things: this website, and the Vegfar app for iPhone. Both are live. What follows describes the app as it is built today, not as it is planned.

This website

• No cookies, no analytics, no trackers. Nothing on this site profiles you, and nothing about your visit is sent to an advertising or analytics company.
• Where you are, for the map. The page shows a city, and guesses which one you are near. It asks this site's own edge for the address your request came from, and matches it against a table of address ranges served from this site. The table comes from DB-IP under CC BY 4.0. Your address is not sent to a geolocation service, because that would hand every visitor's address to somebody else.
• Precise location, only if you ask. The city switcher has a use my location entry. Tapping it asks the browser for your position, the browser asks you, and the answer is used in the page to pick the nearest of ten cities. It is not sent anywhere and not stored.
• What the browser remembers. Two values in your browser's local storage: the city you picked (vegfar.city) and the language you picked (vegfar.lang). They stay on your device, are readable only by this site, and clearing site data removes them.
• Cloudflare serves this site. As it does, Cloudflare processes your IP address and request metadata to deliver the page and to protect it from attack. That is Cloudflare acting for us as a processor, and it is the only third party involved in your visit.

The app: what is collected

• Your rides. While recording, the app captures your position over time and uploads it. The trace is matched to the road network, and the roads it covered are credited to you. The matched geometry and the record of which roads you have ridden are kept for as long as your account exists — a completion percentage is a claim about your whole riding history, so it cannot be rebuilt from data that has been thrown away. How long the ride took, first position to last, is measured on the server and kept beside it.
• Who you are: as little as Apple will allow. Signing in uses Sign in with Apple. What is stored is the pseudonymous identifier Apple issues for you and this app, and nothing else about your Apple account. The app asks Apple for no name and no email address, so Apple hands over neither and neither is stored.
• The people you link with, and the name you type. You can link with one other rider by reading out a six-digit code. Each of you types a name while you do it, and that name is what the other one sees in their list. It is stored, it is shown to that one rider and to nobody else, and nothing searches it. Either of you can remove the link, and removing it removes the pair.
• A notification token for each phone. So that a rider you are linked with can be told you have set off, your phone registers its Apple push token with the server on every launch. It is held against the session that registered it and goes when that session goes.
• A ride while it runs, if you share it. With sharing on, the riders you are linked with see where you are, how far you have gone and how long you have been out, from the moment you start until you finish. What is sent is the trail and a distance — never a time per point, and nothing anybody could turn back into a speed. That buffer is deleted 24 hours after the ride ends; the ride itself is kept the ordinary way.
• What you type into the place search. Searching for a place sends what you typed to Photon, a search service run by komoot GmbH in Germany, which answers with places that match. It is the one request this app makes to anybody but our own server. Nothing in it identifies you — no account, no token and no position — and we do not store what you searched for. What komoot receives is the words you typed and the address the request came from. Moving this onto our own server is recorded as work still to do.
• Operational records. Session and refresh tokens, an upload key that stops a retried upload being counted twice, and the server's own request logs.

The legal basis for all of it is performance of the contract between you and us (GDPR Article 6(1)(b)): none of this is optional decoration, it is the product. Your phone additionally asks for location permission, which iOS governs and which you can withdraw at any time in Settings — after which the app can no longer record a ride.

What is deliberately not collected

• No speed and no pace. There is no column for either in the database, no field for either in the API, and no screen for either in the app. One duration per ride — first position to last, shown beside its length — is the only time this product keeps, and it is never cut into segments. Coverage is the axis this product measures.
• No email address, no phone number, no contacts, no photos, no advertising identifier. The only name held is the one you type for the rider you link with, described above.
• No third-party analytics or crash-reporting service, and no data sold, rented, or shared for anybody's marketing. Ever.

How long things are kept

• Ride traces and coverage: for as long as your account exists. There is no automatic expiry today, and if one is introduced this page will say so before it takes effect.
• A ride you are sharing live: the buffer the other phone reads is deleted 24 hours after the ride ends.
• If you delete your account: every session is revoked immediately, and everything above is permanently deleted 30 days later. The delay is a guard against a mistaken or hostile deletion, not continued use — the account is unreachable from the moment you ask. Revoking Vegfar's access from your Apple ID starts exactly the same process.
• A data export you request: the archive is deleted 7 days after it is made.
• Upload keys: 24 hours.

Where the data is, and who touches it

• Hetzner Cloud, Nuremberg, Germany — inside the EEA. The database and every stored trace live there, on a server run for this service alone.
• Cloudflare sits in front of both the website and the app's API. Your connection is encrypted to a Cloudflare edge server before it reaches Germany, and Cloudflare is a US company operating a worldwide network, so that edge is not always inside the EEA. It is named here because it is the honest position rather than a comfortable one.
• Apple, for Sign in with Apple, for the App Store, and for carrying the notification that a rider you are linked with has set off. Apple's own handling of your Apple account is governed by Apple's privacy policy, not this one.
• komoot GmbH, Germany — place search only, and only the words you typed plus the address they came from. No account, no token, no position. Described above.

Nobody else. There is no advertising network, no analytics vendor and no data broker in this system. Map data comes from OpenStreetMap and routing runs on this service's own servers, so planning a route tells nobody outside where you are going — with the one exception named above: searching for a place by name sends those words to komoot.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, have it deleted, restrict or object to what is done with it, and take it elsewhere. The app carries the first and third of those as buttons — export, and delete my account — and [email protected] covers all of them.

If you think your data has been handled wrongly you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the authority in the EEA country where you live.

Changes

If what is described here changes, this page changes with it, and the date below changes too. A change that widens what is collected or how long it is kept will be said out loud in the app before it takes effect, not published quietly here.

This page is the original. A Bokmål translation is linked below; if the two disagree, that is a mistake — say so and it gets fixed.