Legal
The controller responsible for data processing on this website within the meaning of the GDPR is:
Felix Witte
Erbhof 9
44791 Bochum, Germany
Email: info@goraadv.com
No Data Protection Officer is required for this operation (fewer than 20 people regularly involved in processing; no systematic large-scale or special-category data processing).
We only process data that is technically necessary to provide the service or that you actively provide to us.
When you visit GoraAdv, our hosting provider (Hetzner) automatically logs standard web server data:
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in maintaining server security and diagnosing technical errors.
Retention: 7 days, then automatically purged.
You may object to this processing under Art. 21 GDPR; however, doing so would make it impossible to serve the website to you.
If you create an account, we store:
If you sign in with Apple or Google instead of a password, we store the identifier that provider gives us for you, and no password.
Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract (providing the account-based features you signed up for).
Retention: Until you delete your account. You can delete it yourself
from your profile page, which removes the account and everything attached to it in one
step, or email info@goraadv.com.
If you save a route, we store:
Legal basis: Art. 6(1)(b) GDPR — necessary to provide the "save routes" feature you explicitly used.
Retention: Until you delete the route or your account.
We use your browser's localStorage — not cookies — for two purposes:
| Item stored | Purpose | Legal basis |
|---|---|---|
| JWT authentication token | Keeps you logged in between page loads | TDDDG §25(2) No. 2 — strictly necessary to provide the authentication service you requested |
| "Beta notice seen" flag | Prevents the one-time welcome notice from reappearing | TDDDG §25(2) No. 2 — strictly necessary for the intended usability of the service |
No tracking cookies, no advertising cookies, no analytics cookies are used. You can clear localStorage at any time via your browser settings — this will log you out.
If you subscribe to country launch notifications or the GoraAdv newsletter (via the countries page, the registration form opt-in checkbox, or any other sign-up form), we store:
Double opt-in. Typing an address into a form does not put it on the list. We send one email to that address asking for confirmation, and only the click in that email adds it — which is also our record that the owner of the mailbox agreed. If somebody enters your address by mistake or on purpose, doing nothing is enough: the address never receives a newsletter and is deleted 30 days after we asked. If you ticked the newsletter box while registering, the click in your account verification email confirms both at once; that email says so explicitly.
Legal basis: Art. 6(1)(a) GDPR — your consent, evidenced by the
confirmation click.
Retention: Until you unsubscribe, or 30 days after an unanswered
confirmation request. Every email we send contains a one-click unsubscribe link. You can
also email info@goraadv.com to be removed at any
time, and we will action it within 5 business days.
After downloading a GPX file you may send a share invite to up to 10 friends. When you submit the share form we receive: your chosen sender name (display name for the invite), an optional personal note (max 200 characters), and the recipient email addresses.
Recipient email addresses are not stored. We use them solely to send the one-time invite email and then discard them from memory once the send is complete. They are not written to the database, not added to any mailing list, and not used for any purpose other than the single invite.
We keep only the following, in aggregate:
Recipients open the share link without logging in; we do not set any identifying cookies on their browser and do not track who downloaded which file. A per-token counter simply enforces the 50-download cap.
Legal basis:
Art. 6(1)(b) GDPR for processing the buyer's data (providing the sharing feature you used);
Art. 6(1)(a) GDPR for sending the invite to the recipient (you confirm via the consent checkbox that the recipient has agreed to receive the invite — the recipient's legal basis is the consent you obtained from them).
Retention: The share link and aggregate consent log are retained until the buyer deletes the share (from their account) or deletes their account. Recipient email addresses: not stored at all.
GoraAdv offers a public API and a Claude AI integration via the Model Context Protocol (MCP), allowing users to plan routes directly from Claude. The following explains what data is processed when you use the API or the Claude integration.
Data collected per API request:
Route data lifetime: Routes calculated via the API are stored in the api_routes table for 1 hour to allow GPX download and save operations, then automatically deleted. If you explicitly save a route (via goraadv_save_route or the planner), it is retained under the terms of section 2.3 above.
Rate limit logs: API request timestamps and endpoints are logged per API key for rate limiting enforcement. These logs are retained for 7 days and then purged.
Geocoding via Nominatim: Place name searches (e.g. "Pau, France") are forwarded to the OpenStreetMap Nominatim service operated by the OpenStreetMap Foundation. The query and your IP address may be transmitted to OSMF servers. OSMF's privacy policy applies: osmfoundation.org/wiki/Privacy_Policy
No data shared with third parties: Route data, API keys, and rate limit logs are not shared with any third party other than the hosting provider (Hetzner, acting as data processor under a DPA) and OSMF for geocoding queries.
Legal basis: Art. 6(1)(b) GDPR — necessary to provide the API service you requested.
Retention: API route data deleted after 1 hour; rate logs after 7 days; API keys until revoked or account deleted.
If you upload a track file to edit it in the planner, the file is parsed on our server and the resulting track (coordinates, elevation, track names) is stored so the editing tools can work on it. The original file itself is not kept.
Legal basis: Art. 6(1)(b) GDPR — necessary to provide the editing
feature you used.
Retention: 24 hours without an account, 30
days with an account, then deleted automatically. Access is limited to the
device that uploaded the file (via a capability token stored in that browser) or, if you
were signed in, to your account.
We count page views using Umami, analytics software we run on our own server. No data is sent to any third party, no cookies are set, and nothing is read from your device.
What is recorded per page view: the page URL, the referring page, your browser and operating system, screen size, and the country derived from your IP address. To tell one visit apart from another, Umami calculates a short identifier from your IP address and browser details; the IP address itself is not stored. There is no profile, no cross-site tracking and no advertising use.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in
understanding which parts of the site are used, in order to develop it. Because no
information is stored on or read from your device, the consent requirement of § 25
TDDDG does not apply. You may object under Art. 21 GDPR at
info@goraadv.com, or send a Do Not Track signal,
which we honour.
Retention: aggregated statistics are kept indefinitely; they contain no
identifying information.
To stop automated abuse we count recent requests per visitor for a handful of actions: GPX downloads, sign-in attempts, registration attempts, newsletter sign-ups and feedback messages. Each counter row holds an identifier for the requester, the action, and a timestamp — nothing about the content of the request.
The identifier is a salted hash of your IP address, never the address itself, for every one of these counters. The hash cannot be turned back into an address, and it is used for nothing but comparing one request against another.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in protecting
the service against automated abuse and password guessing.
Retention: these rows are short-lived and removed automatically; they
are of no use once the time window they measure has passed.
If you send us feedback from the feedback page, we store only the title and the text you wrote, plus the time it arrived. We deliberately store nothing about where it came from: no IP address, no account, no page, no route. If you want an answer you have to put your address in the text yourself.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in improving
the service.
Retention: until the point it raises has been dealt with.
Everything above applies to the app as well, because it talks to the same server. The app can additionally access your location, and this section says exactly when and what leaves your phone.
The app asks your phone's operating system for permission before it uses your location, and you can withdraw that permission at any time in your device settings. Location is used for three things:
Background location. While a recording is running, the app keeps receiving your position with the screen off and the app in the background — otherwise the recording would have a hole in it every time you pocket the phone. Your phone shows this permission separately and asks for it explicitly. Background location is used for nothing else: no advertising, no profiling, no sharing, and it is never collected when you are not recording or navigating.
Legal basis: Art. 6(1)(a) GDPR — your consent, given through the operating system's permission dialog and withdrawable there at any time.
If you record a ride and then choose to save it, the recorded track — the sequence of positions with times and elevations — is stored on our server under your account, so it is there on your other devices. A recorded track shows where you were at what time. We do not analyse it, share it, or use it for anything except showing it back to you, exporting it as a file, and reopening it in the planner.
Legal basis: Art. 6(1)(b) GDPR — necessary to provide the recording
feature you used.
Retention: until you delete the ride or your account. A recording you
do not save never leaves the phone.
If you join a group ride, your position, speed and direction are sent to our server every few seconds and shown to the other members of that group — that is the entire point of the feature. The same is true of theirs, shown to you. Nobody outside the group can see any of it.
A group ride also carries an alarm: if you press the help button, your position at that moment is sent to the group.
Legal basis: Art. 6(1)(a) GDPR — your consent, given by joining a
group with a code you were handed.
Retention: positions are kept only as long as the group ride is live
and are deleted with it, at the latest 24 hours after it was created.
You can leave a group at any time, which stops the sharing immediately.
From the app you can report that a track is blocked. The report holds the coordinates of the spot, whether it looked temporary or permanent, the time you observed it, an optional note you write, and an identifier for the reporter — your account, or a salted hash of your IP address if you were not signed in. The identifier exists so that a series of wrong reports can be reversed together; it is never shown to anyone.
An accepted report changes routing for everybody: we route around that spot, and permanent ones are built into our map data at the next rebuild. Other riders never see who reported it, and reports are shown to month precision only.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in not sending
other riders down a track that is closed.
Retention: a temporary report expires by itself after 180
days. A permanent one stays until it is rejected, because it describes a fact
about the terrain rather than about you.
Our server is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes server log data on our behalf as a data processor under Art. 28 GDPR. A Data Processing Agreement (DPA) is in place. All data remains within the EU. Hetzner's privacy policy: hetzner.com/legal/privacy-policy
Place name searches use Nominatim, the OpenStreetMap Foundation's (OSMF) geocoding service, which receives the search text or coordinates you enter in the planner together with your IP address. The OSMF tile CDN (tile.openstreetmap.org) is also contacted in two cases: as a fallback if our default map style fails to load, and on the page that shows a shared route. In those cases your IP address is transmitted to OSMF to fetch the map images. OSMF is based in the UK (adequacy decision applies). OSMF privacy policy: osmfoundation.org/wiki/Privacy_Policy
The "Support GoraAdv" button is a plain external link to ko-fi.com. No Ko-fi scripts or trackers are loaded on GoraAdv. When you click the link and visit Ko-fi, their own privacy policy applies: more.ko-fi.com/privacy
We send account-related emails (verification links, password reset, share invites) through an SMTP relay operated by our hosting provider. Your email address and the message content are transmitted to the SMTP server to deliver the message. No email contents are stored beyond the time required to deliver them. For friend-share invites specifically, see Section 2.6 — recipient addresses are not retained after sending.
The default map you see in the planner and while navigating is served by OpenFreeMap (tiles.openfreemap.org), a free map tile service. Every time the map loads or you pan and zoom, your IP address and the coordinates of the map section you are looking at are transmitted to OpenFreeMap in order to fetch the tiles. We do not send your route, your account, or any identifier along with it. OpenFreeMap's privacy information: openfreemap.org
If you switch the map to the satellite or topographic layer, those images are served by Esri (server.arcgisonline.com). As with any map service, your IP address and the coordinates of the section you are viewing are transmitted in order to fetch the images. While navigation is running and one of these layers is active, this happens continuously as the map follows you. Esri is based in the United States, so this transfer leaves the EU; it takes place only while you have chosen one of these layers. Esri's privacy policy: esri.com/en-us/privacy/overview
The standard map layer (Section 3.5) does not involve Esri. Switching back to it stops these requests.
In the app you can hand a point over to an external navigation app (for example Google Maps or Waze) from a point of interest. This only happens when you tap that button, and it transmits the coordinates of that single point to the app you chose. Their own privacy policy applies from that moment. We do not send anything to those services unless you tap the button.
Under the GDPR you have the following rights regarding your personal data:
To exercise any of these rights, email info@goraadv.com. We will respond within 30 days.
You have the right to lodge a complaint with the data protection supervisory authority responsible for your place of residence, or with the authority responsible for us:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf
ldi.nrw.de
A list of all German supervisory authorities is available at bfdi.bund.de.
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
This website is served exclusively over HTTPS (TLS encryption). Passwords are stored as bcrypt hashes, and password-reset tokens are stored hashed as well. There is no payment of any kind on GoraAdv, so we neither transmit nor store any payment data.
We may update this privacy policy when we add new features or third-party services. The date at the top of this page reflects the last update. Significant changes will be noted in the app.