The short version: local-first, explicit sharing.

Last updated: 3 September 2026

Who is responsible for your data

OffTrail is an independent project published by Ricardo Costa, who is the data controller for personal data processed directly for the operation of OffTrail. Privacy questions or requests can be sent to [email protected].

Some data OffTrail features process may legally qualify as personal data — for example precise location, your rider or display name, GPX data temporarily handled by network features, installation or technical identifiers, contact details you send, and crash or device information. This policy explains what is processed, why, and for how long.

What OffTrail infrastructure handles

There is no rider profile and no leaderboard. OffTrail uses external infrastructure and service providers (see Service providers below); it does not own or physically operate all of it. What OffTrail's own infrastructure handles:

• Map tiles are served from our own tile service (with a public fallback for areas we haven't built yet). We keep aggregate request statistics — coarse 1° map cells and edge country — to know where the app is being used. No IP addresses are stored and requests are not tied to a device or person.
• Short-lived tokens for Group ride and tile access are minted by small Cloudflare Workers after a device-integrity check (Play Integrity / App Attest). The token request does not contain your name, email address, GPX tracks or precise riding location; it may carry technical information needed to verify that the request comes from a legitimate OffTrail installation. Integrity checks protect the service from abuse — they are not used to build a rider profile or for advertising.
• Device sync, when enabled, stores imported Home-track GPX files and small display metadata on OffTrail's sync relay so your paired device can mirror them. The relay is protected by the same device-integrity token, opaque group/device ids, TLS and rate limits. Recordings, Track-to routes and settings are not synced.

What stays on your phone

• Imported tracks (.gpx files) — up to five tracks at a time, kept in the app's private storage (Documents/Tracks on iOS, the app's private directory on Android). Each track has a stable per-slot colour on the map. If you enable device sync, those imported tracks are also uploaded to OffTrail's sync relay for your paired device.
• Recorded rides (.gpx + sidecar JSON) — kept under Documents/Recordings. The History screen lists the last 30 days; older files are pruned automatically.
• Offline map tiles — kept in MapLibre's local cache (auto-cached as you browse, plus any country regions you explicitly download from the Maps screen).
• Preferences — units (metric / imperial), app language override, rider display name, the "have you been prompted to leave a review" flag. Stored in UserDefaults via @AppStorage; never transmitted.

You can back any of this up the way you'd back up any iOS app's local files (Files app, iCloud Drive backup, Finder sync). OffTrail does not provide account-based recovery.

Location

OffTrail asks for "When in Use" location permission so the user dot can render on the map and the rider can be tracked along an imported route. With your permission we keep listening to location updates while the app is in the foreground — that's how recording survives screen-lock and pocket use. Recording is suspended when the app moves to the background, to save battery. iOS shows its standard blue status bar while location is in use; Android shows the location icon in the status bar.

Your location is used in real time to render the map and write entries into your own ride recording. It is not transmitted anywhere — except during a Group ride session, when you share a live-location follow link with family (both sent to our own servers), or when you build a Track to route, where your position and destination are sent to a routing service. Each is described below.

Group ride (opt-in)

When you start or join a Group ride from Settings → Group ride, OffTrail shares your live position with the riders in your session over a realtime connection to OffTrail's own servers (a Cloudflare Durable Object — a small, single-session server instance). There is no third-party messaging provider, no OffTrail account, and no long-term storage — and it works the same between Android and iPhone riders. Specifically:

• You join by typing the host's short 6-character session code — no QR code, no camera, no Apple ID or iCloud sign-in.
• While the session is live, your rider name (the display name you set in Settings) and your live coordinates are sent over a WebSocket to that session's server instance, which relays the riders' names and positions back to draw their dots on your map. Updates are throttled (roughly every 30 seconds, and when you've moved a meaningful distance).
• This data is not stored long-term. The session instance keeps only the current roster (each rider's latest position) for the live session, so a dropped signal doesn't make you vanish; when you leave — or the session ends or expires — it is discarded. The service runs on infrastructure provided to OffTrail by Cloudflare, which processes the technical data needed to provide it under its applicable data-protection terms. OffTrail does not make the session public or share it with unrelated third parties.
• To open the realtime connection, a small Cloudflare Worker hands out a short-lived, single-session token. The Worker only ever receives the join request — the session code, the name you chose, the platform, and a device-integrity check — and does not receive or store your location.
• To curb abuse of that endpoint, the app attaches a platform device-integrity attestation (Google Play Integrity on Android, Apple App Attest on iOS). These confirm the request comes from a genuine app install; they do not carry your name, tracks or location, and are not used to identify you, build a rider profile, or track you.
• Nothing happens until you explicitly enter the Group ride flow. Riding solo never publishes your location anywhere.

Family Follow — "Share live location" (opt-in)

When you tap Share live location from the Home menu, OffTrail creates a private link (like offtrailapp.com/follow/<code>) that anyone who has it can open in a web browser — no app, no account — to watch your position move on a map while you ride. It is meant for family and friends who aren't riding with you. Specifically:

• You choose how long it stays live (2, 4 or 8 hours). It stops on its own at that time, and you can stop it at any moment; after that the link no longer shows anything.
• The link contains a long, random, unguessable code — that code is the only key. Anyone you send it to can see your live location while sharing is on, so only share it with people you trust. These links are marked noindex, so search engines are told to ignore them.
• While it's live, your rider name (the same name as Group ride and Settings) and your live coordinates are sent — roughly once a minute — over a realtime connection to OffTrail's own servers (a Cloudflare Durable Object), which relay them to the browsers watching the link. Those viewers are read-only: they can only watch, never publish.
• Because the viewers are ordinary browsers with no app, this is not end-to-end encrypted: the connection is encrypted in transit (TLS), but our relay and anyone holding the link can see the shared location while the session is active. Your last known position stays visible to link-holders until the session stops or expires — deliberately, so a lost signal or a dead phone doesn't erase where you last were.
• The data is not stored long-term: the session keeps only your latest position and a short recent breadcrumb (about the last 30 minutes) for the live view, and discards it when the session stops or expires. The service runs on infrastructure provided to OffTrail by Cloudflare, which processes the technical data needed to provide it under its applicable data-protection terms. OffTrail does not list the link publicly or share it with unrelated third parties.
• Creating a session is gated by the same platform device-integrity check (Google Play Integrity / Apple App Attest) as Group ride, which does not include your name, GPX tracks or location and is not used to build a rider profile. Nothing is shared until you explicitly start it, and the app only publishes your location while it is in active use (in the foreground, or with CarPlay / Android Auto) — never as a silent background tracker.

Network requests we make

The app loads basemap tiles online when you're connected, so the map keeps looking fresh in places you haven't pre-cached. Tile requests go to:

• Our own tile service (tiles.offtrailapp.com, on Cloudflare) for the Base and Off-road styles — OpenStreetMap-based maps we build and host ourselves, with OpenFreeMap as a public fallback for areas we haven't covered yet. See "What we collect on a server we operate" above for the aggregate statistics this produces.
• Esri World Imagery for the optional Satellite style. Satellite tiles are pulled live every render — there is no offline cache for satellite. The Esri terms require us to display the attribution string "Source: Esri, Maxar, Earthstar Geographics, and the GIS User Community" whenever satellite is on screen, which OffTrail does in the bottom-right caption above the MapLibre attribution.
• Open-Meteo for the live weather chip on the Ride screen (current temperature + condition icon, e.g. sun 24°C / rain 10°C). Before any request leaves the device, your GPS coordinates are coarsened to two decimal places (≈1.1 km at the equator, less at higher latitudes) so the upstream sees an approximate location, not your exact dot. Open-Meteo is free, requires no API key, and is only queried while you have a network connection — the chip simply doesn't render offline.

These flows differ. OffTrail's own tile service serves the Base and Off-road styles, and for areas it hasn't built yet it proxies tiles from OpenFreeMap; it keeps the aggregate request statistics described in "What OffTrail infrastructure handles" above (coarse map cell and edge country — no IP stored, not tied to a device or person). The Esri and Open-Meteo requests, by contrast, go directly from your device to those providers under their own privacy policies — OffTrail does not intercept, log, or proxy those. If you are fully offline, the app falls back to what you have cached (or, for satellite, surfaces a "Satellite needs network" banner; for weather, the chip just hides).

Routing & place names (Track to, off-road split)

Two features send coordinates off the device, because the work can't be done offline on the phone:

• Our routing service (routing.offtrailapp.com) — routing. When you use Track to (or the round-trip planner), your current position and the destination are sent to our routing service to build an off-road route. The same service works out the off-road / on-road split shown on a track's preview: the track's coordinates are sent so each stretch can be matched to a road or trail. These are your exact coordinates — routing needs the precision, so they are not coarsened the way the weather request is. The service runs on Cloudflare and currently forwards the route computation to BRouter, a free public routing engine; requests to our service carry the same short-lived device-integrity token as the tiles (which carries no name, email, GPX tracks or precise location of yours, and may include technical information needed to verify the installation). OffTrail computes a track's split automatically when you import it (and when you open a preview that doesn't have it yet), if you're online; the result is then cached on your phone, so it isn't re-sent each time. Track to falls back to a straight line and sends nothing when you're offline.
• Apple — place names. To label a generated route "{start} → {destination}", the two endpoint coordinates are sent to Apple's reverse-geocoding service to look up the nearest place names. Apple is the data controller for that lookup; their privacy policy applies.

What our routing service keeps. Coordinates are never logged, and no IP address is stored. We keep aggregate statistics in the same spirit as the tiles: request counters (route type, success/failure, coarse 1° map cell of the route's midpoint, edge country) and — for generated routes only — an anonymised "popular corridors" heatmap: a sparse sample of the computed route's geometry, rounded to a ~1 km grid, with the first and last 500 m of every route discarded so neither your start point nor your destination is ever retained. Surface-split (map-match) requests carry your own recorded track, so they are excluded from the heatmap entirely. Nothing links any of this to a device or person.

OffTrail Route Planner

The web-based OffTrail Route Planner lets you plan before a ride. Your GPX files are processed in your browser; the route geometry is sent transiently to build your route and is never stored. OffTrail does not keep your tracks. The temporary route request is used only to build the route you asked for. The Planner is free and does not require an account.

External links from inside the app

The About screen has two opt-in outbound links: Share OffTrail (system share sheet seeded with the App Store URL + a short pitch) and Follow on Instagram (deep link to @offtrailgpx, falls back to Safari if Instagram isn't installed). Both open in their respective destinations and are subject to those services' policies. OffTrail does not collect anything before, during, or after the tap.

Review prompt

After three saved recordings on the same install, OffTrail asks the platform to surface its native review sheet (SKStoreReviewController on iOS, Play In-App Review on Android). The sheet runs entirely inside the system frame; we do not see your review or rating. Apple's own throttle limits this prompt to at most three appearances per rider per 365 days across the whole device; Google applies a comparable quota. We additionally store a one-shot flag locally so OffTrail itself doesn't re-prompt within the same install.

Analytics & crash reports (Google Firebase)

Since v1.14.1 (iOS) / v0.83 (Android), OffTrail uses Google Firebase for two things, on both platforms:

• Crashlytics — when the app crashes, a crash report (stack trace, device model, OS version, app version) is sent so we can find and fix the bug.
• Analytics — pseudonymous usage events such as "a ride was started", "a GPX was imported", or "the round-trip planner was used", plus the standard Firebase dimensions (device model, OS version, app version, country). This tells us which features matter and where the app struggles, so we can improve it.

What is never sent to Firebase: your GPS coordinates, your tracks or recordings, track names, routes, or anything that says where you ride. Events are feature counters, not location data. There is no OffTrail account, and Firebase does not receive an OffTrail rider profile; Firebase may use a per-install or technical identifier to group events. Google/Firebase processes this information under its applicable data-protection terms (see Firebase privacy). This data is used only to improve OffTrail, never for advertising.

No ads, no ad tracking. OffTrail has no ad SDKs, no cross-app tracking, and nothing is shared or sold for advertising.

Cookies & website analytics (this site only)

This website uses Google Analytics to understand visits — which pages are read, from which countries, on which devices. It only runs after you accept the cookie banner; decline (or simply ignore it) and no analytics cookie is ever set. This applies to offtrailapp.com only — the app sets no cookies and is covered by the Firebase section above.

• What it collects: page views, approximate location (country/city), device and browser type. IP anonymisation is on. No names, nothing linked to you.
• No ads: no advertising cookies, no remarketing, no cross-site tracking. Analytics only.
• Change your mind: click here to reset your cookie choice — the banner will ask again.

Aside from this opt-in analytics cookie, the site sets none. Your banner choice itself is stored locally in your browser (localStorage), not on a server.

Route Planner usage (cookieless). Separately, the Route Planner keeps aggregate usage statistics so we can see which steps people complete and where routing fails — in the same spirit as the routing service above. It sets no cookie and stores no persistent or cross-site identifier, no coordinates, no search text, and no IP address. To join the steps of a single visit into one funnel it uses a throwaway session tag: a random value held only in your browser tab's sessionStorage (per-tab, cleared when you close the tab), and never linked to any other identifier or to you. What we keep is aggregate — which planner step was reached; whether a route generated, downloaded, or failed (with a coarse reason); and rough dimensions (vehicle style, desktop/mobile, edge country) — kept as aggregate statistics under the analytics platform's standard retention (Cloudflare Analytics Engine, around 90 days by default). Because it sets no cookie and is designed not to directly identify you or persistently recognise your browser, it runs without the cookie banner, on the basis of our legitimate interest in understanding how the planner is used so we can improve it. To keep these counts honest (and not inflated by bots), before a session is counted the planner asks Cloudflare Turnstile for an invisible anti-bot check — a privacy-preserving alternative to a CAPTCHA that sets no tracking cookie; if it can't validate silently it simply skips the analytics rather than ever showing you a challenge.

Send to OffTrail (Route Planner transfer)

When you choose Send to OffTrail in the Route Planner, the adventure you generated — a route, which is location data — is uploaded to a short-lived transfer service so the OffTrail app can import it with a short code. We store only the generated adventure (its route and a name): never the source GPX files you brought, your search text, or your planning session. The artifact is kept under a random, non-guessable code with no account and no identity attached. It is a shareable code: anyone you give it to can import the adventure in the OffTrail app until it expires — so treat it like sharing the route itself. It is deleted automatically after 5 days. It runs on Cloudflare, and creating a transfer uses the same invisible Turnstile check as above; the app fetches it with the same short-lived device-integrity token as the tiles and routing service. If you never use Send to OffTrail, nothing is uploaded — downloading the GPX stays fully on your device.

Why we process this data

• Providing features you request — Group ride, Family Follow, routing, device sync, Send to OffTrail and similar features process the data they need to work (legal basis: providing the service you asked for).
• Keeping OffTrail secure and reliable — limited technical information, device-integrity checks, crash reports and minimised usage statistics help us prevent abuse and fix problems (legal basis: our legitimate interests, balanced by data minimisation).
• Website analytics — Google Analytics on this website runs only after you accept the analytics cookie (legal basis: your consent).
• Contact — when you write to us, we use your message and email address to respond and deal with your request.

How long data is kept

• Local recordings and tracks — kept on your device until you remove them (the History screen lists the last 30 days and prunes older recordings automatically).
• Group ride — only for the active session; the roster is discarded when the session ends or expires.
• Family Follow — session data only (your latest position and a short recent breadcrumb, about the last 30 minutes); deleted when the session stops or expires. You choose how long a session runs (2, 4 or 8 hours).
• Send to OffTrail — the generated adventure is deleted automatically 5 days after you create the transfer.
• Device sync — synced GPX is kept on the sync relay only as long as needed for the pairing; when a paired group leaves, its files are dropped from the relay. It is a sync, not a backup.
• Planner analytics — aggregate statistics kept under the analytics platform's standard retention (around 90 days by default); no cookie and no persistent identifier.
• Firebase analytics and crash reports — kept for the period configured in Firebase.
• Contact messages — kept only as long as reasonably necessary to deal with your request.

Where our implementation doesn't set a fixed period, we say so rather than invent one.

Service providers

OffTrail relies on a small set of providers. Some supply infrastructure to OffTrail; some receive requests directly from the app or your device. They may process technical data required to provide their services, and their own terms and privacy practices may apply. OffTrail does not sell personal data.

• Cloudflare — hosts the website and Planner, and runs OffTrail's Workers, realtime relays (Group ride, Family Follow), sync relay, tile service and routing edge.
• Google Firebase — pseudonymous usage analytics and crash reports in the app.
• Esri — satellite imagery tiles for the optional Satellite style.
• OpenFreeMap — public fallback base-map tiles.
• BRouter — the routing engine our routing service forwards route computation to.
• Open-Meteo — the weather chip, queried with a deliberately coarsened position.
• Apple services — device-integrity (App Attest) and reverse-geocoding for route endpoint names.
• Google / Android platform services — device-integrity (Play Integrity) and platform functionality.
• Amazon Web Services (SES) — sending email, for example replies to your contact message.
• OVH — hosting for the mail server OffTrail uses for @offtrailapp.com email.

Where a provider processes personal data on OffTrail's behalf, this does not remove the responsibilities that applicable law places on OffTrail.

International transfers

Some service providers may process technical information in countries outside Portugal or the European Economic Area. Where privacy law requires safeguards for such transfers, OffTrail relies on the safeguards made available by the relevant provider, such as applicable contractual data-protection mechanisms.

Your privacy rights

Depending on where you live, privacy law may give you rights over personal data concerning you — including access, correction, deletion, restriction, objection and, where applicable, data portability or withdrawal of consent. Because OffTrail deliberately does not create user accounts, we may sometimes have very little information that lets us identify data as belonging to a particular person, and we will not collect additional personal data merely to identify you unless it is reasonably necessary to deal with your request. You can contact us at [email protected]. If you are in the European Economic Area, you also have the right to complain to a data-protection authority; in Portugal, the supervisory authority is the CNPD.

Privacy by design

The core stance is a product principle, not a phase: no OffTrail account · no public rider profile · no public route or activity feed · local-first · no advertising and no behavioural-advertising tracking · location sharing is always explicit · sharing sessions are short-lived · central retention is limited · session codes are random and non-enumerable.

Children

OffTrail is designed for general navigation and outdoor use and is not specifically directed at children. Features that share live location should only be used knowingly and voluntarily by the person whose location is being shared. Do not use OffTrail to track another person without their knowledge or permission. Where applicable privacy law requires parental or guardian consent for a child's use of a feature involving personal data, that consent must be obtained.

Changes to this policy

When we add a feature that changes what leaves your device, we say so plainly here and update the "Last updated" date. Material changes are also signalled in the app or in the release notes. Continued use of a feature is not treated as consent to every kind of processing; where processing relies on your consent, that stays separate.

Contact

Questions or pushback: [email protected].