Privacy Policy

1. Who is responsible

The controller for the processing described here, within the meaning of Art. 4 (7) GDPR, is:

Arana is run by one person as a sole proprietor. No data protection officer has been appointed, because the thresholds in Art. 37 GDPR and § 38 BDSG are not met.

2. What we process, why, and on what legal basis

Only the categories below are processed. Where a purpose is not listed, the data is not collected.

Your account

The date the account was created, and whatever you sign in with: an email address and a hashed password if you signed up with those, or the OpenStreetMap identity described below if you signed in that way. An account created through OpenStreetMap holds no address and no password at all, unless you add them in your settings. This exists so that you can sign in and so that your saved routes belong to someone. Legal basis: Art. 6 (1) (b) GDPR — performing the agreement to provide you an account.

Signing in with OpenStreetMap

If you sign in with OpenStreetMap, or connect an OpenStreetMap account to one you already have, we receive your OpenStreetMap user ID and display name from the OpenStreetMap Foundation, and an access token that lets Arana act on your behalf. We keep that token, encrypted, because it is the only thing that can upload an edit as you; it is used for nothing else, and it is destroyed with your account. Any map correction you submit through Arana is uploaded to OpenStreetMap under your own OpenStreetMap account, where it becomes part of the public map history permanently — that is the point of the edit, and it cannot be withdrawn by us. Legal basis: Art. 6 (1) (b) GDPR.

Routes you plan and save

The waypoints you place, the resulting route geometry, its distance and elevation profile, the routing style used, and any name or description you give it. This is location data: a saved route frequently starts at your home. Saved routes are visible only to you. Legal basis: Art. 6 (1) (b) GDPR.

Rides you upload

If you upload a recorded ride, we store the GPS track with its per-point timestamps and elevations, the start and finish times, and the route matched onto the road network. A timestamped GPS track is a detailed record of where you were and when, so it is the most sensitive thing Arana holds. Uploaded rides are visible only to you. Legal basis: Art. 6 (1) (b) GDPR.

Roads you report

If you tell us you would rather not be routed down a road, we store which road it was, the routing style you were riding under, the direction you rode it in, and when you said so. Over time that is a record of roads you ride and roads you refuse, so it is kept with your account, and it goes when you delete the account. A report is also read by the person running Arana and used to tune how routes are chosen for everyone. Legal basis: Art. 6 (1) (b) GDPR for keeping your reports with your account; Art. 6 (1) (f) GDPR for reading them and using them to tune routes for everyone, which goes beyond what your own report needs. Our legitimate interest is routes that avoid roads people find unpleasant or unsafe. You can object to that use, see section 7.

Your home location

The point you set as home, so the map opens where you ride. With an account, it is stored with your account. Without an account, it is kept in your browser’s local storage under arana.home-location, never reaches our servers, and is removed when you clear your site data. It moves to your account if you later sign up. Legal basis: Art. 6 (1) (b) GDPR.

Your device’s location

When you press the locate button, your browser asks for permission and, if you grant it, gives the page your position so the map can centre on it. That position is used in your browser and is never transmitted to us or stored. Permission is granted to and revoked in your browser, not here.

Server logs

Our web server records each request with your IP address, the time, the address requested, the response status and your browser’s user agent. The address is recorded without its query string, which is where a shared route link carries its coordinates — so opening one does not write the route into the log next to the IP address that opened it. This is needed to run the service and to recognise attacks and faults. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is operating a working and secure service.

Sign-in records

Supabase, which handles authentication for us, records each authentication event — signing up, signing in or out, changing or resetting a password, renewing a session — with your account identifier, the time, your IP address and your browser’s user agent. Your active sessions carry the same IP address and user agent, so that a session can be recognised and revoked. This is needed to detect account takeover and password guessing. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is keeping accounts secure.

Visit statistics

To know how many people use Arana, each page view is counted by Umami, which runs on our own server at stats.arana.cc. It records the page address without its query string, the page title, the referring site, your browser, operating system, device type, screen size and language, and the country, region and city derived from your IP address. The IP address itself is not stored: it is combined with your browser’s user agent and a secret that changes every month to form a visitor identifier, so visits within one month can be counted as one visitor, and the same visitor is not recognisable in the next. No cookie is set and nothing is stored in your browser. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is knowing whether and how the site is used.

Error reports

When something breaks, a report is sent to Sentry so it can be fixed. It is sent through our own domain, and is configured not to include or store your IP address, cookies or request bodies. Route coordinates are stripped from addresses and referrers before the report leaves your browser. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is finding and fixing faults.

Maps and place names

Map images, terrain elevation and the style itself are requested by your browser from external providers, which therefore see your IP address and the map area you are viewing. To label a route, the coordinates of its start point are sent to MapTiler to look up a place name. Legal basis: Art. 6 (1) (b) GDPR — a route planner without a map is not the service you asked for.

Messages you send us

If you write to help@arana.cc, we process your email address, your message, any attachments and the time, in the mailbox hosted by Zoho, in order to answer you. Legal basis: Art. 6 (1) (b) GDPR if you are asking about your account or the service, otherwise Art. 6 (1) (f) GDPR; our legitimate interest is answering the people who write to us. When you exercise a right under section 7, we also keep a record of the request, what we did and when, so that we can show we complied (Art. 5 (2) GDPR). Legal basis: Art. 6 (1) (c) GDPR, and Art. 6 (1) (f) GDPR for defending ourselves against claims.

3. Who receives your data

The service providers below process data on our behalf as processors under Art. 28 GDPR, except OpenStreetMap, which acts as its own controller for the edits you publish there, and Mapterhorn, which serves terrain tiles to your browser directly under its own privacy policy. Where required, their processing is governed by a Data Processing Agreement.

• Supabase — authentication and database. Holds your account, routes, rides, road reports, home location and the sign-in records described above. Hosted in the EU (eu-central-1).
• Hetzner Online GmbH — the server that runs the application, the routing engine and the visit statistics. Germany.
• MapTiler AG — map tiles, map style and place-name lookups. Receives your IP address, the map area you view, and the coordinates sent for a place-name lookup. Switzerland.
• Mapterhorn — terrain elevation tiles. Receives your IP address and the map area you view, and keeps request logs for up to 30 days. It is an open-data project that does not work on our behalf, and we have no contract with it; its own privacy policy applies. Its tiles are delivered through Cloudflare.
• Sentry — error reporting, on its EU infrastructure, with the restrictions described above.
• Zoho — the mailbox behind help@arana.cc, so anything you write to us is processed there. Data centre in Germany.
• Resend — sends the account emails (signup confirmation, password reset) triggered by Supabase authentication. Receives your email address for that purpose. United States.
• OpenStreetMap Foundation — only if you sign in with OpenStreetMap or publish an edit. United Kingdom.

Route calculation runs on our own server, not on a third-party routing service, so the waypoints of a route you plan are not disclosed to anyone else. Your data is not sold, and it is not passed to advertisers or analytics providers, because there are none: the visit statistics run on our own server.

Arana is run by one person, who can read the road reports described above, because acting on a report means reading it. Nothing else you save is open that way: the database’s own access rules admit only you to your routes, your rides and your home location, and only administering the database itself would go around them.

4. Transfers outside the EU

Your account, routes and rides are stored in the EU, as is the mailbox behind help@arana.cc (Zoho, data centre in Germany). Some recipients nevertheless process data outside it:

• Switzerland and the United Kingdom — MapTiler and the OpenStreetMap Foundation. Both are covered by an adequacy decision of the European Commission under Art. 45 GDPR.
• Providers with a US parent company — Supabase and Sentry store your data in the EU, but their parent companies are American, so access from the US, for instance for support, cannot be ruled out. Resend processes the account emails in the United States. Zoho’s group also includes companies outside the EU. For all of these, processing is safeguarded by the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR, incorporated into their data processing agreements. Resend is in addition certified under the EU-US Data Privacy Framework.
• Mapterhorn — its terrain tiles are delivered through Cloudflare, a US company, so your IP address may be processed in the US when the map loads. We have no contract with Mapterhorn; the request is made by your browser, and terrain is needed to draw the map and show elevation.

You can ask us for a copy of the standard contractual clauses we rely on at help@arana.cc.

5. How long we keep it

• Your account and everything saved with it: until you delete it, or ask us to. Backups containing deleted data expire within 30 days.
• Server logs: the server keeps the most recent 250 MB of them and discards the oldest as new requests arrive. That is a limit on size rather than on age, so how far back they reach depends on how busy the site has been; they are not archived anywhere else.
• Sign-in records: the record of each authentication event is deleted after 30 days. The session records, with their IP address and user agent, go when you delete your account.
• Error reports: kept for 90 days, then deleted by Sentry.
• Visit statistics: kept for 24 months, then deleted. They hold no IP address, and the visitor identifier stops matching anyone at the end of the month it was formed in.
• Messages you send us: deleted 24 months after the conversation ends. The record of a rights request under section 7 is kept for three years from the end of the year in which we handled it. Deleting your account does not delete either, since we may still need to answer you or show that we complied; you can ask us to delete a message earlier.
• A home location set without an account: in your browser until you clear your site data.

6. Cookies and local storage

Arana sets two cookies. One keeps you signed in. The other is set only on accounts belonging to the project itself, and only to put such an account into the ordinary visitor’s view of the site; it is never set on anyone else’s. Both are strictly necessary to provide a service you asked for, so under § 25 (2) TDDDG neither needs consent — which is why you are not asked to dismiss a banner. There are no analytics, advertising or tracking cookies; the visit statistics described above work without one. The only other browser storage is the home location described above.

7. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• have processing restricted (Art. 18 GDPR);
• receive the data you gave us in a machine-readable form, or have it sent to another provider (Art. 20 GDPR);
• object to processing based on our legitimate interests — the server logs, sign-in records, visit statistics, error reports and the use of road reports to tune routes above — on grounds relating to your particular situation (Art. 21 GDPR);
• withdraw any consent you have given, with effect for the future (Art. 7 (3) GDPR).

Deletion you can do yourself, at any time, from your settings: the account and everything saved with it go at once. For every other right here — and for deletion too, if you would rather we did it — write to help@arana.cc, and we will confirm when it is finished.

8. Right to complain

You can complain to a supervisory authority, in particular in the member state of your residence, workplace or the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

9. Do you have to provide this data?

No. You can plan routes without an account. Creating one requires an email address and a password, or an OpenStreetMap sign-in, because without them there is nothing to attach your saved routes to and no way to let you back in — but the choice to create an account is yours, and there is no contractual obligation to do so.

10. Automated decision-making

There is none, within the meaning of Art. 22 GDPR, and no profiling. Arana estimates how rideable a road is from ratings that are stored without any link to the person who made them, so the model describes roads rather than riders, and no decision is made about you.

11. Changes to this notice

This notice is updated when what we do with data changes. The date at the top says when it last did. If a change materially affects you and we hold your email address, we will tell you rather than rely on you re-reading this page.

Who operates this site is set out in the imprint.