Privacy policy
The short version: no tracking, no ads, no cookies — unless you choose to sign in, and then exactly one. Accounts are optional; this page expands on what all that means in practice.
What we measure
We use Cloudflare Web Analytics, which is cookieless and aggregate-only: it tells us which pages are visited, roughly where visitors come from (country level), and which sites referred them. It does not use cookies, does not fingerprint individual visitors, and cannot follow you across the web. GPX downloads are counted the same way — which file, how often, never who.
Error reporting
When something on the site breaks, an anonymous technical report is sent to Sentry: the error message and the browser/device type it occurred on. These reports contain no names, no email addresses, and no location data; we use them only to fix bugs.
What stays on your device
Several features work entirely in your browser and never transmit anything: on-ride mode reads your GPS position to show what's nearby, and that position is processed only on your device — it is never sent to us or anyone else. Your Route Patches check-ins and My ride stop selections are saved in your browser's local storage on this device only. Clearing your browser's site data removes them; nothing is synced or backed up anywhere — unless you sign in (see Optional account), in which case they are also saved to your account. Dismissing a tip (the language suggestion, the on-ride hint, the Home Screen hint or the save-your-ride note) is remembered the same way, as is whether this device has signed in. Adding the site to your Home Screen or installing it as an app sends us nothing; on iPhone and iPad, though, the Home Screen app has its own, separate local storage — your Patches and My ride picks from the browser are not in it. On the first page of each visit, your browser also keeps where you came from — the domain of the referring site (never the page), or the campaign tags from the link you clicked (utm source, medium and campaign), or simply "direct" — in session storage until you close the tab, so our aggregate counts can tell which listing brought riders. No personal data, nothing that identifies you.
Third-party requests
Map tiles are loaded from OpenStreetMap and CyclOSM servers, and the map library (Leaflet) from the unpkg CDN. Your browser requests these directly, so — as with any web request — those servers see your IP address. We send them nothing about you.
If you write to us, we use your message to reply. Your address is not added to any list.
Route launch emails
If you sign up to hear about new routes, we store the email address you enter, the language you signed up in, and where the visit came from (the referring site's domain or the campaign name from the link you clicked, or "direct") on Cloudflare, solely to send you one email per route launch and to know which listings work. Stored with it: when you signed up, when you confirmed, and the two random tokens that make your unsubscribe links work. Nothing else, and the address is never shared. To be removed, use the unsubscribe link in any message or simply reply — we delete the address.
Signing up sends you one confirmation email; the address only joins the list when you click the link in it, and an address that is never confirmed is deleted automatically after seven days. Those emails are sent through Resend (resend.com), our email provider, which processes the address and the message in the United States under the transfer safeguards in its privacy policy — your address is transmitted to them solely so the message can be delivered, and for no other purpose. Open and click tracking are switched off on our account, so the emails carry no tracking pixels and no rewritten links: we cannot tell whether you opened one.
Optional account
You can use everything on this site without an account. If you want your My ride picks and Route Patches check-ins to follow you to other devices and into the installed app, you can sign in with a link we email you — there is no password. On your first sign-in on a device, the picks and check-ins already saved on that device are added to your account; from then on the two are kept in sync (the account's copy wins if they disagree, and a check-in is never lost).
What we store: your email address, the language you signed in with, when the account was created and last used, your picks and your check-ins (the day each patch was earned, never the time), and a session record for each device you sign in on — and nothing else: no name, no profile, no location, and no record of the pages you visit beyond the one page a sign-in link takes you back to, which is stored with the link and blanked the moment it is used. Sign-in links and their codes are stored only as hashes, work once and expire after 15 minutes. The address a link is sent to is kept with it only until the link or code expires (15 minutes), then deleted — whether or not an account exists; requests are rate-limited per address and per connection, and those counters hold only keyed hashes (HMAC) of the address and of your network — never the address or the IP itself — and are deleted once their window has passed. The account lives in a database on Cloudflare that is restricted to the European Union.
The one cookie: signing in sets a single cookie
(ur_session) that identifies your session — a random value, not
your address, marked HttpOnly and Secure, sent only to this site, and valid for
30 days from your last visit if you choose "stay signed in", or dropped by your browser
when you close it — some browsers restore tabs and keep it — if you sign in for
this visit only, and ended on our side after a day at the latest. It is strictly necessary to keep you signed in,
does nothing else, and is the only cookie this site ever sets; there is none
until you sign in. Signing out deletes it. The sign-in and deletion emails go
through Resend, like the route-launch emails above, which
processes them in the United States (see above).
Retention and deletion: the account is kept until you delete it. The account page has a "Delete my account and data" button that removes the address, the sessions, the picks, the check-ins and any sign-in links immediately and permanently, and sends one last email confirming it; the copies on your devices stay yours. (If a device last synced with a different account, signing in there replaces the device's copy with the account's — unless that account is still empty, in which case it takes the device's copy.) The live database is cleared at once, apart from the keyed rate-limit counters, which hold no address or IP in the clear and age out within the day; Cloudflare's rolling database backups, which we use only for disaster recovery, age out within 30 days, and Resend keeps its own delivery logs of the emails it sent under its policy. You can also write to us and we delete it by hand. Sessions unused for 30 days expire on their own, and an account not used for two years is deleted. On a device where you are signed in, your browser also keeps a small sync note — which account the device last synced with, by an internal id, never the address, and a copy of the picks it last saw — so changes made offline are sent later. The route-launch list is separate — deleting the account does not unsubscribe you, and vice versa.
What we count: how often someone asks for a sign-in link, completes one, runs into a rate limit or a dead link, or deletes an account — as aggregate numbers with the edge country and page language, never tied to an address.
Who is responsible, and your rights
Responsible for this site and for your data: Robin Eckmann, Unguided Routes, 1538 Gay Street, Longmont, Colorado 80501, USA — [email protected]. If you sign up for route launch emails, we hold what that section lists — your address, the language you signed up in and where the visit came from — on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in any message or by replying to one; we keep it until you do. An account and its emails rest on your consent too (Art. 6(1)(a)), which you withdraw by deleting the account or by writing to us. A message you write to us is used to answer it, and the sign-in rate-limit counters rest on our legitimate interest in keeping the site working and free of abuse (both Art. 6(1)(f)). The analytics are cookieless and aggregate, and the error reports carry no names, no email addresses and no location data, as those sections describe. You can ask us at any time for a copy of everything we hold about you, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable form — write to either address above — and you can complain to a data-protection authority, normally the one where you live or work.
Why there is no cookie banner
Consent banners are required for cookies and tracking that need consent. We use no tracking at all, and the only cookie we ever set — the session cookie when you sign in — is strictly necessary for the thing you asked for, which needs no consent. So there is nothing to ask.
Last updated: 7 October 2026 · Questions: [email protected]