The short version. WayRound plans and records circular routes, so it needs your location. You can use the entire app without an account, and if you never sign in, nothing you create is stored anywhere but your phone. The app still sends the requests it needs to work — map tiles, route calculation, place search and place names, elevation and wind — to the services listed under Services the app talks to. Those requests carry locations or search text, never your name or account.
We do not sell your personal data, we do not show advertisements, and we do not use advertising identifiers or tracking analytics SDKs.
Who we are
WayRound is developed and published by TheScarlet.nl, an independent software development entity based in the Netherlands. In data protection terms, TheScarlet.nl is the data controller for the personal data processed by the WayRound mobile application.
| Data Controller | TheScarlet.nl |
|---|---|
| Country | The Netherlands |
| Chamber of Commerce (KvK) | 42178846 |
| Contact Email | privacy@wayround.app · info@thescarlet.nl |
What the app collects
Location
WayRound requests precise location permission from your operating system and uses it to display your current position on the map, generate circular routes starting from where you are, provide turn-by-turn navigation guidance, and record your route tracks. On Android, GPS tracking continues during a ride via a foreground service with a persistent system notification so tracking is never interrupted when your screen turns off. The app does not access or record location when you are not actively planning, navigating, or recording a ride.
Planned routes and recorded activities — including the full sequence of GPS coordinates comprising the track — are stored locally on your device. If you optionally sign in, this data is synchronized to our cloud database (see If you sign in).
Account information
Creating an account or signing in is completely optional. WayRound is fully usable in guest mode. If you choose to sign in, authentication is provided by Google Sign-In or Apple ID. We store a user profile containing your user ID, email address, display name, and the URL of your profile photo provided by your sign-in provider. We do not receive, process, or store your passwords.
Diagnostics
Released production versions of the app report crash diagnostics through Firebase Crashlytics to help us diagnose and fix bugs. Crash reports include stack traces, device model, operating system version, app version/build commit, a random Crashlytics installation identifier (a pseudonymous ID that is not linked to your account), and recent diagnostic app log lines (for example, "route generation failed"). These log lines never contain location coordinates or ride tracks.
We do not link crash reports to user accounts: Crashlytics user identifiers (setUserId) are not set. Diagnostic crash reporting is retained by Firebase for up to 90 days and is disabled during local development.
What the app does NOT collect
- Photos and camera: The app does not request camera or photo-library permissions on Android or iOS and does not upload pictures. The only image URL handled is the profile avatar URL provided by Google or Apple sign-in.
- Advertising identifiers: No Google Advertising ID (GAID), Apple Identifier for Advertisers (IDFA), ad networks, or commercial ad SDKs are included in the app.
- Product analytics & behavioral tracking: No analytics SDKs (such as Google Analytics or Firebase Analytics) are present. We cannot observe which screens you visit or how you interact with the app.
- Contacts, calendar, microphone, or health sensors: The app requests none of these permissions and collects no such data.
If you sign in
Signing in syncs your data to Google Firebase (Firestore) so your saved routes and recorded trips survive device replacements and can be accessed across devices. Cloud data storage is partitioned per user and strictly enforced by server-side security rules, not merely client-side application logic:
| Data | Contains | Access permissions |
|---|---|---|
Profile (users/{uid}) |
User ID, email, display name, profile photo URL | Restricted to the account owner. Never public. |
Saved routes (roundtrips/{id}) |
Route name, travel mode, arc center point, radius, bearing, route geometry, timestamps | Restricted to the account owner. The app has no option to make a route public. |
Completed rides (completedTrips/{id}) |
Recorded GPS track coordinates, distance, duration, elevation ascent, timestamps, explorer tile stats | Restricted to the account owner. Cannot be accessed by other users. |
On your device, cached data is partitioned by account, ensuring complete data isolation when switching accounts or using guest mode.
Services the app talks to
WayRound relies on open mapping and geospatial infrastructure. Network requests are sent directly from your device to the following services. Each service receives only the parameters necessary to fulfil the request. The map, routing, search, elevation and weather services never receive your name, email or account ID; only Google Firebase and your sign-in provider (Google or Apple) handle identity data, as the table and If you sign in describe:
| Service | Operator & Location | Purpose | Data received |
|---|---|---|---|
| BRouter | TheScarlet.nl (our own server, on a virtual private server rented from a hosting provider that processes the data on our behalf under a data processing agreement; United Kingdom) | Primary circular route generation and routing calculations | Origin, waypoint coordinates, and travel profile. The server's logs record your IP address and the request, including those route coordinates; they contain no account ID, name or email and are deleted within 5 weeks. |
| OpenRouteService | HeiGIT (Heidelberg University, Germany/EU) | Fallback route calculation if primary BRouter is unreachable | Route waypoint coordinates. |
| OpenFreeMap | OpenFreeMap (EU/Global) | Vector map tiles, fonts, and map rendering styles | Map tile coordinates corresponding to your viewed map area. |
| Nominatim / Photon | OpenStreetMap Foundation (United Kingdom) & Komoot (Germany) | Place search and reverse geocoding (naming locations) | Search query text or coordinates being resolved to names. |
| Open-Meteo | Open-Meteo (Germany/EU) | Elevation profiles and wind forecasts for planned routes | The coordinates of points along the route (elevation) and a single location (wind). |
| Google Firebase | Google Ireland Ltd / Google LLC (EU/US) | Authentication, encrypted cloud sync (Firestore), and crash diagnostics (Crashlytics) | User credentials, profile, synced routes/trips, and crash reports (not linked to your account). |
| Google / Apple Sign-In | Google LLC / Apple Inc. | Federated user authentication | Authentication tokens; returns name, email, and avatar URL to the app. |
Because network requests connect directly over the internet, each provider receives your device's IP address as an inevitable technical part of standard HTTP/HTTPS transmission.
Legal basis under GDPR
Under the European General Data Protection Regulation (GDPR, Article 6), we process your data on the following legal bases:
- Consent (Art. 6(1)(a)): For access to device location, which you grant via the operating system prompt and can revoke at any time in system settings.
- Performance of a contract (Art. 6(1)(b)): To provide account authentication and cloud backup services that you explicitly request by signing in.
- Legitimate interests (Art. 6(1)(f)): To maintain application stability, detect software defects, and secure routing services, balanced against the limited, pseudonymous nature of server logs and crash diagnostics, neither of which is linked to your account.
Data retention
- On-device data: Remains on your device until you delete the route/ride or uninstall the application.
- Cloud synced data: Stored until you delete individual items or request account deletion.
- Crash reports: Retained by Firebase Crashlytics on its standard 90-day retention schedule.
- Routing server logs: Rotated weekly on our server and deleted within 5 weeks.
Your choices and rights
- Location access: You can withdraw location permission in your device's system settings at any time. Route calculation and recording will be disabled, but you can still view previously saved trips.
- Guest mode: You can use WayRound without creating an account or signing in.
- Deleting your data: You can delete saved routes and completed rides inside the app at any time.
- Deleting your account: You can delete your account and all associated cloud data directly within the app (Profile → Settings → Delete Account) or via our public deletion portal: WayRound Account Deletion Portal. You can also email a deletion request to privacy@wayround.app or info@thescarlet.nl.
Under GDPR and applicable data protection legislation, you also have the rights of access, rectification, erasure, restriction of processing, data portability, and objection.
Supervisory authority
You have the right to lodge a complaint with your local data protection supervisory authority. In the Netherlands, our lead supervisory authority is the Autoriteit Persoonsgegevens:
| Authority | Autoriteit Persoonsgegevens |
|---|---|
| Website | autoriteitpersoonsgegevens.nl |
| Address | Bezuidenhoutseweg 30, 2594 AV Den Haag, The Netherlands |
International transfers
Certain infrastructure providers (such as Google Firebase) operate servers internationally, including in the United States. Data transfers outside the European Economic Area are safeguarded through EU Standard Contractual Clauses (SCCs) and participation in the EU-US Data Privacy Framework. Our BRouter routing server is hosted in the United Kingdom, and reverse geocoding requests go to the OpenStreetMap Foundation in the United Kingdom; both are covered by the European Commission's adequacy decision for the United Kingdom.
Children's privacy
WayRound is not directed to children under 16 years of age, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.
Changes to this policy
If we update this privacy policy, we will revise the date at the top of this page. For material changes affecting your rights or how personal data is handled, we will provide prominent notice within the application.
Contact
For privacy inquiries, data subject requests, or questions regarding this policy, please contact us at:
Email: privacy@wayround.app or info@thescarlet.nl
Data Controller: TheScarlet.nl (KvK 42178846), The Netherlands