Privacy Policy

1. Who is responsible

The controller for the processing described here, within the meaning of Art. 4 (7) GDPR, is:

Arana is a private, non-commercial project run by one person. No data protection officer has been appointed, because the thresholds in Art. 37 GDPR and § 38 BDSG are not met.

2. What we process, why, and on what legal basis

Only the categories below are processed. Where a purpose is not listed, the data is not collected.

Your account

The date the account was created, and whatever you sign in with: an email address and a hashed password if you signed up with those, or the OpenStreetMap identity described below if you signed in that way. An account created through OpenStreetMap holds no address and no password at all, unless you add them in your settings. This exists so that you can sign in and so that your saved routes belong to someone. Legal basis: Art. 6 (1) (b) GDPR — performing the agreement to provide you an account.

Signing in with OpenStreetMap

If you sign in with OpenStreetMap, or connect an OpenStreetMap account to one you already have, we receive your OpenStreetMap user ID and display name from the OpenStreetMap Foundation, and an access token that lets Arana act on your behalf. We keep that token, encrypted, because it is the only thing that can upload an edit as you; it is used for nothing else, and it is destroyed with your account. Any map correction you submit through Arana is uploaded to OpenStreetMap under your own OpenStreetMap account, where it becomes part of the public map history permanently — that is the point of the edit, and it cannot be withdrawn by us. Legal basis: Art. 6 (1) (b) GDPR.

Routes you plan and save

The waypoints you place, the resulting route geometry, its distance and elevation profile, the routing style used, and any name or description you give it. This is location data: a saved route frequently starts at your home. Saved routes are visible only to you. Legal basis: Art. 6 (1) (b) GDPR.

Rides you upload

If you upload a recorded ride, we store the GPS track with its per-point timestamps and elevations, the start and finish times, and the route matched onto the road network. A timestamped GPS track is a detailed record of where you were and when, so it is the most sensitive thing Arana holds. Uploaded rides are visible only to you. Legal basis: Art. 6 (1) (b) GDPR.

Roads you report

If you tell us you would rather not be routed down a road, we store which road it was, the routing style you were riding under, the direction you rode it in, and when you said so. Over time that is a record of roads you ride and roads you refuse, so it is kept with your account, and it goes when you withdraw the report or delete the account. Unlike everything else you save, a report is read by the person running Arana — reading it is how it gets acted on — and it is used to tune how routes are chosen for everyone rather than to change your own next route. Legal basis: Art. 6 (1) (b) GDPR.

Your home location

The point you set as home, so the map opens where you ride. With an account, it is stored with your account. Without an account, it is kept in your browser’s local storage under arana.home-location, never reaches our servers, and is removed when you clear your site data. It moves to your account if you later sign up. Legal basis: Art. 6 (1) (b) GDPR.

Your device’s location

When you press the locate button, your browser asks for permission and, if you grant it, gives the page your position so the map can centre on it. That position is used in your browser and is never transmitted to us or stored. Permission is granted to and revoked in your browser, not here.

Server logs

Our web server records each request with your IP address, the time, the address requested, the response status and your browser’s user agent. The address is recorded without its query string, which is where a shared route link carries its coordinates — so opening one does not write the route into the log next to the IP address that opened it. This is needed to run the service and to recognise attacks and faults. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is operating a working and secure service.

Visit statistics

To know how many people use Arana, each page view is counted by Umami, which runs on our own server at stats.arana.cc. It records the page address without its query string, the page title, the referring site, your browser, operating system, device type, screen size and language, and the country, region and city derived from your IP address. The IP address itself is not stored: it is combined with your browser’s user agent and a secret that changes every month to form a visitor identifier, so visits within one month can be counted as one visitor, and the same visitor is not recognisable in the next. No cookie is set and nothing is stored in your browser. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is knowing whether and how the site is used.

Error reports

When something breaks, a report is sent to Sentry so it can be fixed. The report is configured not to include your IP address, cookies or request bodies, and route coordinates are stripped from addresses and referrers before the report leaves your browser. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is finding and fixing faults.

Maps and place names

Map images, terrain elevation and the style itself are requested by your browser from external providers, which therefore see your IP address and the map area you are viewing. To label a route, the coordinates of its start point are sent to MapTiler to look up a place name. Legal basis: Art. 6 (1) (b) GDPR — a route planner without a map is not the service you asked for.

3. Who receives your data

The service providers below process data on our behalf as processors under Art. 28 GDPR, except OpenStreetMap, which acts as its own controller for the edits you publish there. Where required, their processing is governed by a Data Processing Agreement.

• Supabase — authentication and database. Holds your account, routes, rides, road reports and home location. Hosted in the EU (eu-central-1).
• Hetzner Online GmbH — the server that runs the application, the routing engine and the visit statistics. Germany.
• MapTiler AG — map tiles, map style and place-name lookups. Receives your IP address, the map area you view, and the coordinates sent for a place-name lookup. Switzerland.
• Mapterhorn — terrain elevation tiles. Receives your IP address and the map area you view.
• Sentry — error reporting, on its EU infrastructure, with the restrictions described above.
• Zoho — the mailbox behind help@arana.cc, so anything you write to us is processed there.
• Resend — sends the account emails (signup confirmation, password reset) triggered by Supabase authentication. Receives your email address for that purpose. United States.
• OpenStreetMap Foundation — only if you sign in with OpenStreetMap or publish an edit. United Kingdom.

Route calculation runs on our own server, not on a third-party routing service, so the waypoints of a route you plan are not disclosed to anyone else. Your data is not sold, and it is not passed to advertisers or analytics providers, because there are none: the visit statistics run on our own server.

Arana is run by one person, who can read the road reports described above, because acting on a report means reading it. Nothing else you save is open that way: the database’s own access rules admit only you to your routes, your rides and your home location, and only administering the database itself would go around them.

4. Transfers outside the EU

Your account, routes and rides are stored in the EU. Two recipients sit outside it and both are covered by an adequacy decision of the European Commission under Art. 45 GDPR: Switzerland, for MapTiler, and the United Kingdom, for the OpenStreetMap Foundation. For US-based providers offering services on EU infrastructure (such as Supabase, Sentry and Resend), processing is safeguarded by the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR, incorporated directly into their agreements.

5. How long we keep it

• Your account and everything saved with it: until you delete it, or ask us to. Backups containing deleted data expire within 30 days.
• Server logs: the server keeps the most recent 250 MB of them and discards the oldest as new requests arrive. That is a limit on size rather than on age, so how far back they reach depends on how busy the site has been; they are not archived anywhere else.
• Error reports: kept for as long as Sentry’s retention period allows.
• Visit statistics: kept without a fixed deletion date. They hold no IP address, and the visitor identifier stops matching anyone at the end of the month it was formed in.
• A home location set without an account: in your browser until you clear your site data.

6. Cookies and local storage

Arana sets two cookies. One keeps you signed in. The other is set only on accounts belonging to the project itself, and only to put such an account into the ordinary visitor’s view of the site; it is never set on anyone else’s. Both are strictly necessary to provide a service you asked for, so under § 25 (2) TDDDG neither needs consent — which is why you are not asked to dismiss a banner. There are no analytics, advertising or tracking cookies; the visit statistics described above work without one. The only other browser storage is the home location described above.

7. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• have processing restricted (Art. 18 GDPR);
• receive the data you gave us in a machine-readable form, or have it sent to another provider (Art. 20 GDPR);
• object to processing based on our legitimate interests — the server logs, visit statistics and error reports above — on grounds relating to your particular situation (Art. 21 GDPR);
• withdraw any consent you have given, with effect for the future (Art. 7 (3) GDPR).

Deletion you can do yourself, at any time, from your settings: the account and everything saved with it go at once. For every other right here — and for deletion too, if you would rather we did it — write to help@arana.cc, and we will confirm when it is finished.

8. Right to complain

You can complain to a supervisory authority, in particular in the member state of your residence, workplace or the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

9. Do you have to provide this data?

No. You can plan routes without an account. Creating one requires an email address and a password, or an OpenStreetMap sign-in, because without them there is nothing to attach your saved routes to and no way to let you back in — but the choice to create an account is yours, and there is no contractual obligation to do so.

10. Automated decision-making

There is none, within the meaning of Art. 22 GDPR, and no profiling. Arana estimates how rideable a road is from ratings that are stored without any link to the person who made them, so the model describes roads rather than riders, and no decision is made about you.

11. Changes to this notice

This notice is updated when what we do with data changes. The date at the top says when it last did. If a change materially affects you and we hold your email address, we will tell you rather than rely on you re-reading this page.

Who operates this site is set out in the imprint.