Privacy Policy for the “Retrail” app

Last updated: 10 November 2026

1. Controller

Valeri Justus
c/o Online-Impressum 12451
Europaring 90
53757 Sankt Augustin
Germany
Email: retrail.app@proton.me

2. In short

• Retrail needs no account and no sign-in.
• Your rides, location data, profile and settings are stored only on your device. I do not receive them.
• There are no ads, no analytics or tracking services, and no data is shared or sold.
• The app only loads map data from the internet and checks whether you are online (sections 4 and 5).

3. Data on your device

The app stores locally, in its own storage area:

• Location data: while you record a ride or follow a saved route, GPS positions (latitude, longitude, time, speed) are collected. When recording, they are saved as the ride's route.
• Rides: date, duration, distance, speeds, activity type and, optionally, title, comment and favourite flag.
• Profile: the name you enter and, optionally, a profile photo.
• Settings: e.g. language, light/dark theme, last chosen activity type.
• Map images: preview images of your routes and a cache of map tiles.

The app does not send this data off your device. You can delete single rides in the app; all data is deleted when you uninstall the app.

Background location: so a ride keeps recording with the screen off, the app uses a foreground service with a persistent notification on Android and background location with a Live Activity on iOS. This happens only while a recording is running or while you follow a route.

Positioning: your position is determined by the operating system's location services (on Android possibly via Google Play services, on iOS via Apple). What they transmit to Google or Apple is governed by their privacy policies and your device settings.

4. Map service (OpenFreeMap)

To show the map, the app loads map data (“tiles”), map styles, fonts and icons from the free service OpenFreeMap (tiles.openfreemap.org, served through Cloudflare's network). This technically requires transmitting your IP address, app/device information (user agent) and the requested map area — which roughly shows which area you are looking at. Your recorded routes are not transmitted. According to OpenFreeMap, it uses no accounts and no cookies.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing a map). Delivery through Cloudflare may involve a transfer to the USA: Cloudflare, Inc. (USA) is certified under the EU-US Data Privacy Framework; the transfer relies on the European Commission's adequacy decision. OpenFreeMap's terms: openfreemap.org/tos.

5. Connectivity check

To detect when you are offline (and show a notice, for example), the app regularly sends a short, empty request to clients3.google.com/generate_204 (Google Ireland Limited) while in use. Google receives your IP address and technical connection data. Legal basis: Art. 6(1)(f) GDPR. Google's privacy policy: policies.google.com/privacy.

6. Navigation and links

• Navigate to the start: when you tap it, the app passes the start point's coordinates to the maps app you choose (e.g. Google Maps or Apple Maps). Their privacy policies apply from then on.
• Map credits: tapping a map credit opens its page in your browser.

7. Camera, photos and notifications

The app accesses the camera or your photos only when you choose a profile photo; the photo is stored only on your device. Notifications (recording in progress) are created locally on the device; no push service is used.

8. Backups and app stores

If you have enabled device backup (Android: Google account, iOS: iCloud), the operating system may include the app's data in your backup. You control this in your device settings; it is governed by Google's or Apple's terms.

When you download the app from Google Play or the App Store, the store operators process data under their own terms (e.g. installs, crash reports). I only receive aggregated, non-personal statistics.

9. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection. As I store no data about you, these rights mainly concern the data on your device, which you manage yourself. For questions, email me at the address above. You also have the right to lodge a complaint with a data protection supervisory authority.

10. Hosting of this website

This website is served via Firebase App Hosting by Google (Google Cloud, Europe-West region). When you visit, the service technically necessarily processes your IP address, the date and time of the request, the requested page, and browser and operating system information, for example in server logs. The website sets no cookies and uses no analytics or tracking tools. Server logs are kept for 30 days and then deleted automatically.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in running the website securely and reliably). Google processes the data as a processor; transfers to third countries, such as the USA, are possible and rely on standard contractual clauses or the EU-US Data Privacy Framework. Google's privacy policy: policies.google.com/privacy.

11. Changes

If the app changes so that other data is processed (e.g. an additional service), I will update this policy. The version published here applies.