Privacy

Vegfar counts which roads you have ridden. Doing that means holding a record of where you have been, which is about as personal as personal data gets. This page says exactly what is held, for how long, and who can reach it.

Who is responsible

The controller of the data described here is ACR Holding AS, a company registered in Norway, organisation number 923 665 307. Write to [email protected] about anything on this page, including a request to see, correct, export or delete what is held about you.

What this page covers

Two things: this website, and the Vegfar app for iPhone. The website is live. The app has not been released yet — the sections about it describe what it will do from its first release, and no rider account, ride or trace exists today.

This website

• No cookies, no analytics, no trackers. Nothing on this site profiles you, and nothing about your visit is sent to an advertising or analytics company.
• Where you are, for the map. The page shows a city, and guesses which one you are near. It asks this site's own edge for the address your request came from, and matches it against a table of address ranges served from this site. The table comes from DB-IP under CC BY 4.0. Your address is not sent to a geolocation service, because that would hand every visitor's address to somebody else.
• Precise location, only if you ask. The city switcher has a use my location entry. Tapping it asks the browser for your position, the browser asks you, and the answer is used in the page to pick the nearest of ten cities. It is not sent anywhere and not stored.
• What the browser remembers. Two values in your browser's local storage: the city you picked (vegfar.city) and the language you picked (vegfar.lang). They stay on your device, are readable only by this site, and clearing site data removes them.
• Cloudflare serves this site. As it does, Cloudflare processes your IP address and request metadata to deliver the page and to protect it from attack. That is Cloudflare acting for us as a processor, and it is the only third party involved in your visit.

The app: what is collected

• Your rides. While recording, the app captures your position over time and uploads it. The trace is matched to the road network, and the roads it covered are credited to you. The matched geometry and the record of which roads you have ridden are kept for as long as your account exists — a completion percentage is a claim about your whole riding history, so it cannot be rebuilt from data that has been thrown away.
• Rides you import. If you import a GPX or FIT file from another app or a GPS unit, it is treated exactly like a recorded ride.
• Who you are: as little as Apple will allow. Signing in uses Sign in with Apple. What is stored is the pseudonymous identifier Apple issues for you and this app, and nothing else about your Apple account. Your name and your email address are never stored.
• Two settings. Your home municipality — a municipality code, not an address — and your home privacy zone, described below.
• Operational records. Session and refresh tokens, an upload key that stops a retried upload being counted twice, and the server's own request logs.

The legal basis for all of it is performance of the contract between you and us (GDPR Article 6(1)(b)): none of this is optional decoration, it is the product. Your phone additionally asks for location permission, which iOS governs and which you can withdraw at any time in Settings — after which the app can no longer record a ride.

What is deliberately not collected

• No speed, no pace, no ride times. There is no column for them in the database, no field for them in the API, and no screen for them in the app. Coverage is the only axis this product measures.
• No email address, no name, no phone number, no contacts, no photos, no advertising identifier.
• No third-party analytics or crash-reporting service, and no data sold, rented, or shared for anybody's marketing. Ever.

The home privacy zone

A circle around a point you choose — your home, normally. Onboarding offers it switched on, with a radius of 300 metres, and you can set it anywhere between 100 and 1000 metres or turn it off.

What it does: once a ride has been matched and the roads have been credited, the raw positions recorded inside the circle are deleted from storage. The order matters. You keep credit for the roads around your own house, and what goes away is the record of when you were there — the pattern of life that a trace store reveals and that an export would otherwise hand back.

What it does not do, stated plainly: it does not remove the fact that those roads are ridden, and it does not remove the matched geometry of the ride, which follows the roads near your home. Making the zone reach that geometry is recorded as work still to do.

How long things are kept

• Ride traces and coverage: for as long as your account exists. There is no automatic expiry today, and if one is introduced this page will say so before it takes effect.
• Positions inside your privacy zone: deleted as soon as the ride they belong to has been credited.
• If you delete your account: every session is revoked immediately, and everything above is permanently deleted 30 days later. The delay is a guard against a mistaken or hostile deletion, not continued use — the account is unreachable from the moment you ask. Revoking Vegfar's access from your Apple ID starts exactly the same process.
• A data export you request: the archive is deleted 7 days after it is made.
• Upload keys: 24 hours.

Where the data is, and who touches it

• Hetzner Cloud, Nuremberg, Germany — inside the EEA. The database and every stored trace live there, on a server run for this service alone.
• Cloudflare sits in front of both the website and the app's API. Your connection is encrypted to a Cloudflare edge server before it reaches Germany, and Cloudflare is a US company operating a worldwide network, so that edge is not always inside the EEA. It is named here because it is the honest position rather than a comfortable one.
• Apple, for Sign in with Apple, and for the App Store. Apple's own handling of your Apple account is governed by Apple's privacy policy, not this one.

Nobody else. There is no advertising network, no analytics vendor and no data broker in this system. Map data comes from OpenStreetMap and routing runs on this service's own servers, so planning a route does not tell anyone outside where you are going.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, have it deleted, restrict or object to what is done with it, and take it elsewhere. The app carries the first and third of those as buttons — export, and delete my account — and [email protected] covers all of them.

If you think your data has been handled wrongly you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the authority in the EEA country where you live.

Changes

If what is described here changes, this page changes with it, and the date below changes too. A change that widens what is collected or how long it is kept will be said out loud in the app before it takes effect, not published quietly here.

This page is the original. A Bokmål translation is linked below; if the two disagree, that is a mistake — say so and it gets fixed.