Privacy policy.
Rospuutto is designed so that as little data as possible leaves your phone. Routes, rides and settings stay on your device. This page explains what data is processed, where and why.
Updated 18 Oct 2026 | applies to the Rospuutto test version (iOS, web)
1. Controller
Risto Vauras (private individual, Iitti, Finland). Contact: risto@rospuutto.fi. If a company is later founded for the service, the controller will be updated here.
2. What data is processed and where
| Data | Where it is | Why |
|---|---|---|
| Location (GPS) while riding and navigating, also in the background | On the phone only. Recorded tracks are stored in the app's own storage on the device. | Showing your position on the map, navigation, trip and speed cards, ride recording. |
| Route points when you calculate a route | Sent to Rospuutto's own routing server (GraphHopper) to calculate the route. Not stored permanently; the request is processed and forgotten. Technical server logs are kept for at most 30 days. | Route calculation. |
| Service search (fuel, shops, food, lodging, repairs): the route line or your location | The search runs on Rospuutto's server using OpenStreetMap data, and the request is not stored. If the server does not answer, the search falls back to the public OpenStreetMap Overpass service (Germany or France). | Showing services along the route. |
| Saved routes and rides, settings, vehicle details | On the phone only. No account, no cloud storage in the test version. | App functionality. |
| Community reports (obstacle, gate, place): position, type, optional comment, a random device identifier | On Rospuutto's server, visible to other users on the map. The device identifier is a random string not linked to a person; it lets you delete your own report. Reports expire after 12 months. | Warning other riders about gates and obstacles. |
| "My bike" image: make, model, year, colour, notes | Sent through Rospuutto's server to OpenAI's image service, which generates the picture. OpenAI processes the data under its own privacy policy; Rospuutto does not store the request. | Generating an illustrative bike picture for the app. |
| Feedback: your message plus app version, phone model, settings and recent error messages | Sent as an email to the controller only when you press Send. You see the full content before sending. | Fixing bugs during the test phase. |
| Tester sign-up: email and, optionally, name, phone model, vehicle, area and a message | On Rospuutto's server in Helsinki. A new sign-up also sends a notification to the controller's email (risto@rospuutto.fi, Apple iCloud Mail). The details are not passed on; I send invitations and news myself by email. | Test invitations (TestFlight) and news for testers. Basis: consent. |
| Test version invite code and usage figures (app.rospuutto.fi): a personal code, when you started using the test version and last used it, number of days used, app version, number of rides, kilometres and riding time as totals, and the number of planned routes and started navigations | On Rospuutto's server in Helsinki, together with the tester details. The phone sends only increments to these numbers – no routes, locations or individual rides. Only the controller can see them. | Seeing who uses the test version and how much, so that testing reaches active riders and feedback can be weighed against use. Basis: consent (entering the code). |
| TestFlight (iOS test version) | Apple collects crash reports and feedback from testers under TestFlight's own terms and forwards them to the developer. | Distribution and stability of the test version. |
| Feature 👍/👎 votes (Settings → Experiments) | Only the vote is sent to the server: which feature and how the vote changed. No device or user identifier. | Deciding which test features to keep. |
| Website visit counts (rospuutto.fi) | On Rospuutto's server as daily totals only: which page was opened, which site the visitor came from (domain only, e.g. google.com), a campaign code if the link had one, and whether the device was a phone or a computer. No cookies or identifiers; IP addresses are not stored. | Seeing whether and from where people find the website. |
| Weather, rain radar and conditions (Labs): points on the route ahead or your location, when you open the weather | The phone fetches forecasts directly from the weather services, only when you open the weather: the Finnish Meteorological Institute (Finland), MET Norway / Yr (Norway) and Open-Meteo (ECMWF model). The services see the requested coordinates and ordinary technical data (IP address). The rain radar image comes from Rospuutto's server and covers all of Finland, so the request does not reveal your location. Road weather cameras (Fintraffic Digitraffic) and logging notifications (Finnish Forest Centre) are also fetched directly by the phone. | Showing weather and conditions on the route. |
| Map tiles (National Land Survey, OpenStreetMap) | The phone fetches map images directly from the map service or through Rospuutto's server. The map service sees ordinary technical data (IP address, requested area). | Displaying the map. |
3. What is not collected
- The app does not ask for your name, email or phone number, and there is no user account. The web test version only asks for a personal invite code. Signing up as a tester is a separate, voluntary form (see the table).
- No location history on the server: recorded tracks never leave the phone unless you export them as a GPX file yourself. The test version sends only ride totals to the server (see the table).
- No cookies, advertising or third-party tracking. The website counts visits itself without identifiers (see the table above).
4. Legal basis
Providing the app's functionality (contract / the user's request) and a legitimate interest in fixing faults and preventing misuse. Location access is requested separately by the phone's operating system and can be revoked in the phone settings at any time. Tester sign-up is based on consent, which you can withdraw at any time by email.
5. Retention
Data on the device stays until you delete it in the app or remove the app. Community reports are deleted after 12 months or as soon as you delete your own report. Technical server logs at most 30 days. Feedback emails are kept for the duration of the test phase and deleted afterwards. Testers' contact details, invite codes and usage figures are deleted when the test phase ends or immediately on request.
6. Transfers and processors
Rospuutto's own server (routing, community reports, feature votes, site visit counts, map tile relay and rain radar images) is in Finland, in Hetzner Online GmbH's data centre in Helsinki. Hetzner processes the server data on Rospuutto's behalf under a GDPR data processing agreement. Server data does not leave Finland.
The rospuutto.fi website runs on Netlify (United States), which processes the usual technical data of page loads. The image service is provided by OpenAI (United States); data is transferred outside the EU only when a "My bike" picture is generated, and only the vehicle details it contains. Apple (TestFlight) processes tester data under its own terms. The controller's email (risto@rospuutto.fi) is hosted in Apple's iCloud Mail, so sign-up notifications and feedback are also processed there under Apple's terms.
7. Your rights
You have the right to know what data about you is processed and to request its correction or deletion. Because the app does not identify you as a person, most data is deleted by you in the app or on the phone. A community report can be deleted in the app (your own report) or by emailing us the place and time of the report. You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
8. Changes
This policy will be updated when accounts, sync or other new features arrive. Changes are announced in the app and on this page.