The short version: local-first, explicit sharing.

Last updated: 12 October 2026

Who is responsible for your data

OffTrail is an independent project by Ricardo Costa, the data controller. Questions or requests: [email protected].

What leaves your phone, and why

Device sync (optional). Sends your imported Tracks, History, recordings and Track-to routes to your other device through OffTrail's relay: the GPX files (with the times and waypoints inside them), plus names, colours, favourites, collections and your device model (e.g. “iPhone 11 Pro Max”), so you can tell your devices apart. OffTrail uses the files only to run the sync. Files stay for 90 days at most, then are deleted automatically, also if you uninstall the app. They go sooner if you delete an item, or leave the sync (Device Sync → Leave sync), which ends the pairing for both devices. History and Track-to routes are also deleted after 30 days. Markers of deleted items and the pairing's small index (names, times, device models, no routes) can stay until someone leaves the sync. It is a sync, not a backup.

Group ride (optional). Your rider name and live position are shared with the riders in your session, through OffTrail's servers. You join with a 6-character code. Nothing is kept after the session ends.

Track to and off-road split. Your position and destination (or the Track's coordinates, for the off-road / on-road split) are sent, exactly, to OffTrail's routing service. Coordinates are never logged and no IP address is stored. We keep only aggregate counts and an anonymised heatmap of popular corridors, with the first and last 500 m of every route discarded. To name a generated route, its two endpoints are sent to a place-name service.

Place search. What you type and your position (to show nearby results first) are sent to OffTrail's search service. Neither is logged.

Map tiles and weather. Tiles come from OffTrail's own tile service, and from third parties for the optional Satellite style and some offline downloads. We keep aggregate request statistics (coarse 1° map cells and country; no IP address, nothing tied to a device or person). The weather chip uses your position rounded to about 1 km. Satellite and weather requests go straight from your device to those third parties, under their own policies.

Route Planner (website). Your GPX files are processed in your browser; the route geometry is sent transiently to build your route and is never stored. The Planner also keeps cookieless aggregate usage counts (steps reached, success or failure, vehicle style, desktop or mobile, country) for about 90 days, using a random tag held only in your browser tab, and a bot check.

Send to OffTrail. The adventure you generate (a route and a name) is uploaded under a random code so the app can import it. Anyone with the code can import it until it is deleted, automatically, 5 days after you create it.

Analytics and crash reports. Crash reports (stack trace, device model, OS and app version), pseudonymous usage events such as “a ride was started”, standard device dimensions, and the size and margins of your screen, including car displays. Never your coordinates, Tracks, recordings or where you ride. Used only to improve OffTrail. Kept for the period set in the analytics service.

This website. Website analytics run only after you accept the cookie banner (no advertising cookies). Change your choice: reset your cookie choice.

Genuine-app check. Group ride, Family Follow, tiles, routing and sync check that the request comes from a genuine OffTrail install. No name, Tracks or location are involved.

Emails to us. Your name, email address and message are kept as long as needed to answer you.

Family Follow — "Share live location" (opt-in)

When you tap Share live location from the Home menu, OffTrail creates a private link (like offtrailapp.com/follow/<code>) that anyone who has it can open in a web browser — no app, no account — to watch your position move on a map while you ride. It is meant for family and friends who aren't riding with you. Specifically:

• You choose how long it stays live (2, 4 or 8 hours). It stops on its own at that time, and you can stop it at any moment; after that the link no longer shows anything.
• The link contains a long, random, unguessable code — that code is the only key. Anyone you send it to can see your live location while sharing is on, so only share it with people you trust. These links are marked noindex, so search engines are told to ignore them.
• While it's live, your rider name (the same name as Group ride and Settings) and your live coordinates are sent — roughly once a minute — over a realtime connection to OffTrail's own servers, which relay them to the browsers watching the link. Those viewers are read-only: they can only watch, never publish.
• Because the viewers are ordinary browsers with no app, this is not end-to-end encrypted: OffTrail's servers and anyone holding the link can see the shared location while the session is active. Your last known position stays visible to link-holders until the session stops or expires — deliberately, so a lost signal or a dead phone doesn't erase where you last were.
• The data is not stored long-term: the session keeps only your latest position and a short recent breadcrumb (about the last 30 minutes) for the live view, and discards it when the session stops or expires. OffTrail does not list the link publicly or share it with unrelated third parties.
• Creating a session is gated by the same genuine-app check as Group ride, which does not include your name, GPX Tracks or location and is not used to build a rider profile. Nothing is shared until you explicitly start it, and the app only publishes your location while it is in active use (in the foreground, or with CarPlay / Android Auto) — never as a silent background tracker.

On your phone

Your imported Tracks (up to five), recordings and History (the History screen shows the last 30 days; older ones are deleted automatically), offline maps and preferences. They are not sent anywhere except through the features above.

Location

OffTrail asks for “When in Use” location permission to show you on the map, follow your Track and record your rides while the app is open. Your location leaves your phone only through the features described above.

Why we process this data

• To provide the features you ask for (Group ride, Family Follow, routing, device sync, Send to OffTrail): legal basis, providing the service you requested.
• To keep OffTrail secure and fix problems (genuine-app check, crash reports, usage statistics): legitimate interest.
• Website analytics: your consent.

Service providers

Cloudflare, Google, Apple, Esri, OpenFreeMap, BRouter, Open-Meteo, komoot, Amazon Web Services and OVH. Some process data outside Portugal and the EEA, under the safeguards each provider offers. OffTrail does not sell personal data.

Your privacy rights

You may have the right to access, correct, delete, restrict or object to the processing of your data, to take it with you, and to withdraw consent. Write to [email protected]. Because OffTrail has no accounts, we may have very little that identifies data as yours, and we will not collect more just to find it. You can complain to your data-protection authority; in Portugal, the CNPD.

Children

OffTrail is not directed at children. Only share your location knowingly, and never use OffTrail to track someone without their knowledge. Where the law requires a parent's or guardian's consent, it must be obtained.

Changes to this policy

If a feature changes what leaves your phone, we update this page and its date, and mention it in the app or the release notes.

Contact

Questions or pushback: [email protected].