Privacy at Cicloruta

Cicloruta is designed to know as little about you as possible. This is what it actually does:

Your location

We use it only on your phone, to show you on the map, calculate the route and guide you. The route is calculated in the browser itself: your starting point and destination are not sent to any server.

Cyclists nearby

While you navigate or record a ride, your phone sends your position and heading every 15 seconds so other cyclists see an anonymous dot on the map. It carries a random identifier created for each trip: not your account, name or IP, and it cannot be linked to your previous trips. We keep only the latest position and delete it after 5 minutes (or when the trip ends): there is no history. Nothing is sent while the app is in the background. If you have an account and turn on invisible mode, your position is not sent; you still see the others.

What you search for

When you type a destination, the text travels to our server to find the address or place, together with a location rounded to about one kilometre (yours or the centre of the map), used only to rank nearby results first. We do not store searches: they are answered and forgotten, and since they travel in the body of the request they are not written to the server logs either. Offline, the search runs on your phone with the saved places.

Your rides

When you record a ride, it is stored in this browser’s storage (IndexedDB). We never receive it. If you clear your browser data or change phones, it is lost. You can export rides as GPX.

Road reports

When you report a pothole, roadworks or a car in the bike lane, we store the type, the point on the map and the time. Reports are visible to anyone using the app and expire on their own, or when other cyclists confirm they are gone.

To prevent duplicates and abuse we also store an encrypted fingerprint (a SHA-1 digest of your IP address, your browser type and a secret key). We do not store the IP. The fingerprint is deleted after 30 days. Since we do not know who you are, we cannot link a report to a person or answer an access request about it.

Your account (optional)

Cicloruta works without an account. If you create one, we store your email, the places you save as Home and Work (name and point) and whether invisible mode is on. To sign in we email you a 6-digit code that expires after 15 minutes; we keep only an encrypted digest and delete it once used. The session is a technical cookie (cr_sesion) sent only to our API; the server keeps an encrypted digest, not the token. We do not use your email for anything else: no newsletters, no advertising. You can delete your account from the menu → My account, and your email, places and sessions are deleted immediately. Your rides do not depend on the account: they stay on your phone only.

Diagnostic mode (off unless you turn it on). If you have an account and turn it on under My account, while you navigate or record your phone sends a technical log of the trip to your account: GPS positions with their time and accuracy, when the voice spoke and when the phone paused the app. It is used only to fix voice guidance with the screen locked; it is read by whoever maintains Cicloruta, shared with no one and deleted after 30 days (or when you delete your account). Turning it off stops sending immediately.

What there is not

No mandatory accounts, no analytics, no advertising and no third-party trackers. The only cookie is the session cookie, and only if you sign in. The map, fonts and street network are served from this same domain.

The browser keeps a few preferences (last map view, hidden layers, route type, voice on or off and, if you signed in, a copy of your places so they work offline). They are needed for the app to work the way you left it and never leave your phone.

Contact

Data is processed under Colombia’s Law 1581 of 2012 and, for people using Cicloruta from the European Union, under the General Data Protection Regulation: the report fingerprint is pseudonymous data processed on the basis of legitimate interest (preventing abuse) and deleted after 30 days; account data is processed to provide the service you asked for when creating it, and the anonymous “cyclists nearby” position is deleted after 5 minutes. For questions, complaints or to exercise your rights over personal data, write to helena.cortes@udea.edu.co.