What Routeloop stores, why, and who else sees it. Written to be read rather than to be defensible.
In effect 17 September 2026
Your email address, the display name and username you chose, the dates you have held past usernames, and—if you signed in with Google—the account identifier Google issues for you. Sign-in tokens are stored as one-way hashes, so a copy of the database yields no usable logins.
Anything you fill in: first and last name, home address and its coordinates, and payment handles for splitting costs on a ride. All of it is optional, all of it is shown only to you, and none of it appears on a shared ride unless you switch it on yourself.
If you sign in with Google, your first and last name are filled in from your Google account as a starting point. They are visible to you on your profile, where you can change or clear them, and to nobody else.
The routes, stops, notes and coordinates you enter, plus how many times a shared ride has been opened. If you upload a KML or GPX file, the original is kept so it can be downloaded again.
If you send a bug report, an idea or a question, what is kept is what you wrote, which screen you said it happened on, any screenshot you attached, and your account so we can write back. Bugs and questions are private between you and me. An idea is only ever shown to other riders if I publish it to the board, and nothing is published automatically.
Along with it, the app records a snapshot of what your browser was doing, so you never have to answer a technical question to report something. That snapshot holds: which screen you were on and the version of the app, the site you came from, your browser and operating system, your screen and window size, your language and time zone, whether you had dark mode or reduced motion switched on, how full the app’s local storage was, and any errors or failed requests from the last few minutes.
Two things it deliberately does not hold. It never records where you are: if the app has permission to use your location, what is stored is the word “granted” and never a position. And every web address in it has anything after a question mark stripped off before it is saved, so a link to one of your rides cannot arrive in it by accident.
A screenshot you attach is shrunk by your own phone or computer before it is uploaded, and that re-encoding removes the hidden metadata a photo normally carries—including, on a photo taken with a phone, the GPS coordinates of where it was taken.
You can turn off follow-up messages about a report, and if you do, nothing is sent to you about it.
Your IP address is used briefly to rate-limit sign-in emails, so the form cannot be used to flood someone’s inbox.
Three cookies are the site’s own, and that is the whole list of ours. One keeps you signed in. The other two appear only while you are signing in with Google, protect that handshake against tampering, and expire ten minutes later. All three are strictly functional—the site does not work without them. Where Google Analytics runs, Google sets two more, _ga and one named for this site, which hold a random number and nothing else, so that a return visit counts as one visitor rather than two; they last two years. There is still no advertising cookie and no tracking pixel, because there is still no advertising here to feed.
How the site is used is counted with Google Analytics. It records that a page was opened and which one, how long you stayed on it, how far down you scrolled, which outside links you followed, the site you arrived from, your country, and the sort of browser, device, and operating system—each visit tied to that random number and to nothing about you: not your name, not your email, not your rides. Google Signals and ad personalization are switched off, so Google does not join these visits to your Google account or use them for advertising, and Google Analytics does not store your IP address. Google processes the numbers on my behalf under its own terms and keeps them for fourteen months. They are read by me and by nobody else, and they are not for sale.
If Cloudflare says you are in the EU, the EEA, the UK, or Switzerland—or you arrive over Tor, where it cannot say—Google Analytics waits. A bar at the top of the page asks first, and nothing from Google loads until you say yes. Your answer is kept in your own browser and never sent to me, so I cannot see who said no, and a no is honored wherever you open the site from afterward. Nobody outside those places is asked, because nobody else’s law asks, and a cookie bar on every site is the thing everybody hates. You can change your answer at any time under Your choices below.
Page views are also counted with Cloudflare Web Analytics, and have been since July 2026. It is cookieless: it stores nothing on your device, does not follow you from site to site, and builds no profile of you. What it records is that a page was opened—which page, the site you arrived from, the country, and the sort of browser, device, and operating system—and nothing that identifies you. It runs for everyone, because there is nothing in it to consent to.
One thing there is worth saying plainly. Both record the address of the page, which means the link to a shared ride appears in my analytics as its own line. Cloudflare records nothing after a question mark; Google Analytics does, though nothing on this site puts anything secret there—a tab name, a saved flag, an error code. The one page whose address is itself a secret, an invitation link, sends nothing to either. Cloudflare already carries every request to this site and sees those addresses regardless; what I cannot do on the plan this runs on is stop them being listed. If that matters for a particular ride, keep it private rather than unlisted.
Five services are involved in running the app. None of them is sent your rides as a body of data.
The application and its database run on hardware I own and administer. Your rides are not held by a cloud provider.
Only what you decide. Every ride starts private. Unlisted means anyone with the link can open it but it is listed nowhere. Public means it can also appear in listings on the site.
A shared ride shows the ride: its routes, stops and notes. It does not show your email, your address, or anything on your profile you have not chosen to share.
Your account and rides are kept until you delete them or ask me to. Sign-in links expire in fifteen minutes and are single-use. Rate-limiting records are held for an hour and then discarded.
A report you send, its screenshots and the browser snapshot attached to it are kept for as long as the report is—there is no automatic expiry on them today, and I would rather say so than name a window I am not enforcing. All of it is deleted with your account, which removes it in one step and by design rather than by a cleanup I have to remember to run.
Routeloop is not intended for anyone under 13, and accounts are approved by hand.
If this page changes in a way that affects what is collected or who sees it, the date above changes and I will say what moved. Silent rewrites defeat the point of publishing it.
17 September 2026. Google Analytics now counts how the site is used, beside Cloudflare, and the “Technical” section says what it records and what it is switched off from. Three things changed with it. The cookie list grew by two, Google’s, where Google Analytics runs. Cloudflare’s counter no longer skips visitors in the EU—it is cookieless, and it is now a snippet this site ships rather than one Cloudflare injects at the edge. And visitors in the EU, the EEA, the UK, and Switzerland are asked before Google Analytics loads, with a bar that appears once and takes no for an answer. Also a correction: this page said Gmail carried the sign-in email. It has been Resend since the app moved off a personal Gmail account, and the list above now says so. What has not changed is what the numbers are for: seeing what gets used, and nothing else—not sold, not shared, not traded, ever.
16 August 2026. Routeloop can now be sent a bug report, an idea or a question from inside the app, and doing that collects things this page did not previously describe: what you wrote, any screenshot you attach, and a snapshot of what your browser was doing when you sent it. The “What you tell us” section above sets out exactly what that snapshot holds, and the two things it refuses to hold—your location, and anything after a question mark in a web address. Nothing starts collecting unless you actually send something.
3 August 2026. A correction rather than a change. This page said there were no analytics. That was wrong: Cloudflare Web Analytics has counted page views since July 2026, and the section above now describes it properly—including that the link to a shared ride is listed in it. The cookie list was wrong in the same way. It described only the sign-in cookie, and the two ten-minute cookies used during a Google sign-in were there the whole time. Nothing new started collecting on this date; the page caught up with what was already true.
Questions, requests for a copy of your data, or a deletion request all go to the same place: the issue tracker for anything public, or the contact route you signed up through for anything that should not be.
Routeloop is an early build of something I’m making. Expect rough edges, missing pieces, and the occasional data reset. Feedback is the whole point.
