RoostlinePrivacy policy
The legal version. For the plain-language one, see the deal. Last updated 2026-05-21.
Roostline is built by one person, in the Netherlands, for offroad riders. I collect the minimum data needed to make the app work. I don't sell it, I don't rent it, I don't share it with advertisers.
What I collect
Account info. Email and a bcrypt-hashed password when you register. Optionally your display name.
Routes you create or upload. GPX files, derived tracks, waypoints, detours, and bookend legs. Stored on my servers so they sync across your devices.
Ride logs. When you start a ride in the iOS app, GPS samples (lat, lng, timestamp, speed) are recorded on your device and uploaded when the ride ends. They're yours and you can delete them any time from My Rides.
Search history and saved places. Optional. Powers the recent-searches dropdown. Nothing else.
What I don't collect
- Contacts, photos, microphone, or any system permission besides location.
- Analytics, ad identifiers (IDFA), or cross-app tracking.
- Background location while you're not riding. The app only records when you've started a ride.
Why location?
Location is the whole point of the app. I use it to:
- Show your position on the map during a ride.
- Give turn-by-turn cues and keep you on the trail.
- Record the GPS track of your ride so you can review it afterward.
"Always" location is requested so recording continues when your screen sleeps and your phone is mounted on the bike. Nothing is recorded unless you've explicitly started a ride.
Third parties
A handful of services see parts of a request as it leaves my server. None of them get your account identity attached.
GraphHopper. Receives start and end coordinates when you ask for a route between two points. Their privacy policy applies to that request.
OpenStreetMap Overpass. Receives your current coordinate (no account ID) for speed-limit lookups. Rate-limited and silent on failure. I never store the response beyond the current session.
OpenFreeMap / map tile providers. Serve the map tiles you see. They see your IP address per request.
Resend. Delivers transactional email (password resets). No marketing email goes through this.
Where your data lives
Application and Postgres database on Railway in Amsterdam (EU). All connections use TLS. Passwords are bcrypt-hashed and unreadable to me. GPX uploads aren't stored as files. Your route's geometry goes straight into the database and the original upload is discarded.
Your rights (GDPR)
Access. Email me and I'll send you a copy of your data.
Deletion. Delete your account from the iOS Profile screen or by email. Private and link-shared routes, ride logs, friendships, feedback, and account info are removed permanently. Routes you made public stay live in the community catalog but are re-attributed to an anonymous identity with no link back to you. They belong to the riders using them now.
Correction. Edit your profile and routes directly in the app.
Portability. Every route is downloadable as GPX from its detail page.
Complaints. You can lodge a complaint with your local data protection authority. In the Netherlands that's the Autoriteit Persoonsgegevens.
Children
Roostline isn't aimed at children under 13, and I don't knowingly collect any data about them.
Changes to this policy
If I materially change how I handle your data, the "Last updated" date at the top moves and active users get an email.
Contact
Anything privacy-related: hello@roostline.app.
— Quinten