ROUTEOGRAPH / PRIVACY POLICY

Effective 10 October 2026 · routeograph is operated by Westmidlanders LLC, a Wyoming (USA) limited liability company.

Who is responsible

The controller of your personal data is Westmidlanders LLC, a Wyoming limited liability company, at 30 N Gould St Ste R, Sheridan, WY 82801, United States. For anything about your data, including every right listed below, write to hello@routeograph.com. A person reads it.

The short version

A GPS route is precise location history. That is sensitive data, and we treat it that way. An indoor activity carries no route, and we take no health data from any file. Your uploaded file is processed and discarded, and the one job that has to hold it for a few minutes says so below. What we keep is the rendered poster and its statistics, which delete within 30 days, or sooner if you ask. We count visits in totals that name nobody. If you agree to it, we also use Google Analytics, which sets cookies and is the only third party that measures your visit. Decline and it never loads. A feedback button on every page is drawn by another company, which sees your IP address in order to serve it and learns nothing more unless you open it and write to us. We run no advertising and we never sell data.

What we process, and why

• Your activity file (GPX or FIT). Read in memory to compute the trace, elevation profile, and statistics, then discarded when the render finishes. A FIT may contain a heart rate. We do not read that field, and nothing we draw or keep is derived from it.
• One exception, and it is deliberate. Building the spinning video of an indoor run takes minutes rather than seconds, so it runs after your request instead of during it. That means your file is held until the video is built, rather than only in memory. It is stored under an unguessable name, it is read once, and it is deleted the moment the render ends, whether the video succeeded or failed. Nothing else works this way.
• Rendered artifacts. The poster (SVG/PNG), its statistics, and your settings are stored under an unguessable identifier so you can preview and download. Where the poster depicts where you went, we treat it as location data. An indoor activity has no route, and the sheet it makes shows none.
• Spin videos. Stored until you download them and deleted within 24 hours, which is far shorter than a poster because the file is large and you fetch it once.
• Server logs. Standard request logs (IP address, time, path, render timings) to operate and secure the service.
• Account data. With an account, we hold your email to sign you in and track your credit balance. You can sign in by emailed link, password, or Google. Passwords are handled by our auth provider (Supabase), and we never see them.
• Purchase records. For credit purchases, a ledger of credits bought and spent. For print orders, the order record (poster, product, status, tracking) and your email for updates. Card details go straight to Stripe. Your shipping name and address are collected by Stripe and shared with our print partner to make and ship the poster. We do not keep them.

Cookies and similar technologies

If you appear to be in Europe, none of the optional part applies to you. We switch analytics off rather than asking: no Google Analytics, no usage events, and no cookie banner. We work this out from your browser's own time zone, which never leaves your browser, so deciding not to track you sends nothing anywhere either.

We set no cookies of our own. What we use is your browser's local storage, which does the same job and is covered by the same rules. Cookies do get set on this site if you agree to analytics, but they are Google's rather than ours, described below. There are three categories.

Strictly necessary. Your unsaved draft, your sign-in, and display settings such as units and theme. These are required for the site to work: without them your work is lost on every reload. They stay on your device, identify nothing about you to us, and clearing your browser storage removes them. They cannot be disabled. One exception sits here: the bot check on the sign-in form (Cloudflare Turnstile, described under service providers) may store a short-lived entry while it runs, and only if you use that form.

Counts, which run for everyone. We keep daily totals of how many times a page was opened, a poster was drawn, or a checkout was started, and we keep some of those totals separately for phones and for computers. Which of the two you are on is read from the description your browser sends with every request, and that description is not stored. A total is all it is: no name, no account, no device identifier, and there is nothing written to or read from your device. These are counted on our server from requests it already handles and already logs, which is why they are not something we ask permission for.

Some of our links carry a campaign tag, a short name for the post, ad or email the link was in. When you arrive by one, the same totals are also kept per tag: how many visits that link brought, how many opened the studio, made a poster, started a checkout and finished one. The tag names the link, never you, and it is not stored on your device.

Analytics, which you choose. One answer covers two things. The first is a few more browser-side totals, such as finishing the introduction tour, still with nothing that identifies you. The second is Google Analytics, which we load only after you agree. It sets its own cookies and reports which pages you opened, your device, and your rough location. The full description, including the advertising features we switched off, is under service providers. The notice offers I decline, I agree, and a preferences panel. If you decline, the Google script is never fetched at all.

What we do not do. No advertising and no ad technology. We have turned off Google's advertising features, so your visit here does not feed an advertising profile. We do not sell your data or share it for anyone's advertising.

You can change your answer at any time: change my preferences.

Retention and deletion

Rendered posters and their job records delete automatically within about 30 days, except posters you exported with a credit, which we keep so your re-downloads stay free. You can delete any poster yourself at any time from its job. No account or form needed. The shared cache of public map data (map coordinates for an area) is not tied to you and is kept to speed repeat renders. Account and purchase records, including print-order emails and the credit ledger, are kept while your account exists and as long as tax law then requires. Server logs follow our host's standard rotation. Google Analytics data, if you agreed to it, is kept by Google for 2 months, which is the shortest window it offers.

Security

We protect your data with reasonable safeguards, including encryption in transit and access controls, and we limit who can reach it. No system is perfectly secure, so we cannot promise absolute security.

Service providers

We rely on a few processors to run the service. We never sell or share personal information for advertising, and disclose data only if legally compelled.

• Hosting: Render (render.com) runs the service and its short-lived storage.
• Storage and accounts: Supabase handles sign-in and stores your email, your posters, your job and purchase records, and a shared map cache, under unguessable identifiers.
• Terrain data: for terrain contours, we fetch public elevation tiles from the AWS Open Data Registry, sending only the tile coordinates for the poster's area. Your file never leaves our server.
• Street, water and place data: for the street map or place names, we fetch OpenStreetMap vector tiles covering the poster's area from OpenFreeMap, a free public tile service. Each request names a tile by zoom and position, so the service learns which few square kilometres a poster covers and nothing else: never your file or the traced line. Our earlier source, the public OpenStreetMap Overpass API (servers in Germany, Austria and France), remains as a fallback and receives the area's bounding box in the same way.
• Payments: Stripe processes card payments and collects your shipping address for prints. Card details go straight to Stripe, under its privacy policy.
• Prints: Prodigi, our print partner, receives your name, shipping address, and the poster artwork to make and ship a print you order.
• Email: Resend sends order receipts, print updates, and a one-time welcome message. Sign-in and password emails come from Supabase.
• Sign-in with Google: choosing "Continue with Google" lets Google sign you in and return your email and profile photo, under Google's privacy policy.
• Analytics: Google Analytics, and only if you agree to it. Google receives a random identifier stored in its own cookies, the pages you open, your approximate location derived from your IP address, your device and browser, and the site that referred you. Google Analytics does not store your IP address. We have disabled its advertising features, Google Signals, and ad personalization, so the data is not used to build an advertising profile or follow you across other sites. Google keeps it for 2 months and then deletes it. This runs under Google's privacy policy, and declining means the script is never loaded.
• Bot protection: the sign-in form uses Cloudflare Turnstile to check that a person, not a script, is creating the account. Cloudflare receives your IP address and some browser characteristics for that check, under its privacy policy. It runs only when you use the sign-in form, it is not used for advertising, and it does not track you across other sites.
• Feedback button: the tab marked "Feedback" on every page is served by Feedbaxster. Fetching it tells them your IP address and browser, which is unavoidable for anything loaded from another site, and a visit gives them nothing else: it sets no cookies here and writes nothing to your device. Opening it loads their form in a frame on their own site, where their cookies and their privacy policy apply, and what you write there reaches them and then us. Close it without writing and nothing is sent.
• Error reporting: if enabled, error reports go to Sentry, without your route data.

Where your data goes

We are in the United States, so running the service means most of your data reaches providers there. One notable exception: the Overpass servers we ask for street and water data are in Germany and Austria, inside the EEA, and we send them a bounding box rather than anything about you.

For providers in the United States we rely on the European Commission's Standard Contractual Clauses, and, where a provider is certified under it, the EU-US Data Privacy Framework. Which of the two applies depends on the provider. Write to us and we will tell you which covers a given one and send you the relevant clauses.

If you appear to be visiting from Europe, we do not load Google Analytics and record no usage events, so nothing about how you use the site is transferred anywhere (see Cookies and similar technologies).

Your rights

You can delete any poster yourself, at any time, and the file goes with it rather than just the listing. In your account panel, Download my data gives you everything held against your account as one file, and Delete account erases it without asking us. Deleting removes your posters and your sign-in, and cannot be undone. Any unused credits are lost, and the confirmation says how many before you agree. We email you once to confirm, with your deletion reference in it, and after that your address is gone from everything we hold.

Four things survive a deletion, each stripped of anything identifying you:

• Purchase and print-order records. They are financial records we are required to keep, held under a random reference instead of your name.
• Your record of accepting these documents. It is our evidence that you did, kept the same way.
• If you asked us not to send you marketing, the record that you asked, as evidence we honoured it. It does not follow your address: sign up again with the same one and you get a clean account, it included.
• A poster another buyer has also bought stays in their account. The file is the same file, and their copy is not yours to delete. It still leaves your list.

While a print is still in production, the poster it came from and the account that ordered it cannot be deleted: the print has to reach you first. Once it ships, both can go.

Email hello@routeograph.com for anything the buttons do not cover. In the EEA/UK we process to provide the service you request (Art. 6(1)(b) GDPR), for our legitimate interest in running it securely (Art. 6(1)(f)), and, for analytics only, on your consent (Art. 6(1)(a)), which you can withdraw at any time using the link above. Withdrawing does not affect what was collected before you did. You have rights of access, rectification, erasure, restriction, portability, and complaint to your supervisory authority. California residents have equivalent rights under the CCPA/CPRA. We do not sell personal information or share it for cross-context behavioral advertising as defined there.

A practical note on route privacy

Routes often begin and end at home. Consider trimming the start and end of an activity in your tracking app before turning it into a poster you will display.

Children

The service is not directed at children under 13 and we do not knowingly process their data.

Changes and contact

We update this policy as the service changes, revising the effective date above. Questions or deletion requests: hello@routeograph.com.