Privacy Policy

AnyMap is made by Tech10 UG (haftungsbeschränkt), Mailänder Platz 11, 70173 Stuttgart, Germany, represented by Yannik Simon. We are responsible for your data (the "controller" under the GDPR).

Questions about your data: hello@anymap.bike. We have not named a data protection officer: the law does not ask it of a company our size.

• You can use AnyMap without an account. Then your data stays on your phone.
• With an account, we keep your rides, workouts and profile on our servers at Cloudflare, so they reach all your phones.
• Other riders see your name, color, power and weight while you ride, and your chat messages.
• No ads. No tracking. No analytics. We do not sell data.
• You can delete your account and its data at any time, in the app.

As a guest, your rides, workouts, weight, FTP, settings and paired devices stay on your phone. The app makes a random guest id and a name like "UllrichE16B50" for you.

When you ride in the world, our server gets your guest id, guest name, color, weight and power while you ride (see "Riding with others"). It forgets you a minute after you leave.

Signing in

You sign in with your email address and a 6-digit code we send to it. There is no password. We store your email address and the code in a protected form (a hash). The code works for 10 minutes. To stop abuse, we limit sign-ins by IP address; we do not store the IP address. Your phone keeps a sign-in token in its secure storage (Keychain or Keystore). A sign-in ends after 180 days without use.

What your account holds

• Your email address, username, color, short bio and profile picture.
• Your weight and FTP, and your workout categories.
• Your workouts, the ones you build and the ones you change.
• Your rides: a summary (time, distance, average power, energy) and the recording, one sample a second, with power, heart rate, cadence, speed and the distance along the route. Rides hold no GPS position: you ride on a virtual road.
• The routes you add, and the races you take part in.
• Your chat messages.
• Your Premium status (see "Premium").

Why: to run the service you signed up for, and to bring your data to every phone you use (Art. 6 (1) (b) GDPR).

Heart rate, and weight with it, can tell something about your health. The GDPR protects such data in a special way (Art. 9). We use it only for what you see in the app: your zones, your W/kg, your ride graphs, and how fast you go in the world.

We store heart rate in your account only with your explicit consent (Art. 9 (2) (a) GDPR). The app asks for it before your first heart rate strap connects. You can take your consent back at any time: in the app's settings, under Heart rate data, or by removing the strap. Without your consent, the app uses no heart rate at all, also none that a trainer passes on. Without an account, no heart rate reaches our servers. Taking your consent back does not make earlier processing unlawful.

AnyMap is one shared world. While you ride, your phone sends your power to our server twice a second. Your heart rate and cadence stay on your phone. The server works out your speed and the draft, and sends other riders near you:

• your name and color, and your rider id;
• where you are on the route, your speed and your power;
• your weight (the app shows W/kg);
• in a race: your place and your finish time.

Our server can also list the riders on the road to anyone who asks it, with the same details. Race results stay for a day. The server forgets your ride a minute after you leave the world.

Your profile shows your username, color, bio and picture to everyone. Your profile picture can be loaded from its web address without signing in. Your email address, weight setting and FTP are never on your profile.

Why: riding together and racing is the service (Art. 6 (1) (b) GDPR).

With an account you can write in the chat. Everyone in the chat sees your message with your name and color. We check every message by machine for links, spam and insults. A message that breaks the rules may be refused, or hidden from others.

You can report a message. We store reports, bans and what our moderators do, to keep the chat safe. Muting a rider happens only on your phone.

We keep chat messages and reports as long as your account exists. When you delete your account, we delete your messages and the reports about them.

Why: the chat is part of the service (Art. 6 (1) (b) GDPR), and we have a legitimate interest in a safe chat without abuse (Art. 6 (1) (f) GDPR).

When you draw a route or send in a file (KML or KMZ, from Google My Maps or Google Earth), we keep your drawing and build the route from it. A route you add is there for every rider, with its name. A "private" route is hidden from the lists, but it is not secret: anyone who knows its address can load it.

Routes stay in the world when you delete your account, without your name.

You buy Premium in the App Store or on Google Play. Apple or Google take your payment; we never see your payment details. Your phone makes a random buyer id and sends it with the purchase. Our server then asks Apple or Google if the purchase is valid, and keeps: the store, the purchase id, the plan, until when it runs, and whether it renews. Apple and Google also tell our server about renewals and refunds; we keep these messages for 90 days.

Why: to give you what you paid for (Art. 6 (1) (b) GDPR), and to meet our duties under tax and commercial law (Art. 6 (1) (c) GDPR). Purchase records stay when you delete your account, without a link to it, as long as these laws ask (up to 10 years).

• Bluetooth: the app connects to your trainer, heart rate strap and Zwift Click. It keeps their names on your phone to connect again. They do not leave your phone.
• Location: only when you draw a route, and only if you allow it, the app reads your location once to open the map where you are. We do not store it.
• Photos: only the photo you pick as your profile picture. The app cuts it to a square before it sends it.
• Notifications: race reminders are set on your phone. No server is involved.
• Your settings, favorite routes and recent place searches stay on your phone.

We do not use ads, analytics or tracking services. These services help us run AnyMap:

• Cloudflare (Cloudflare, Inc., USA) runs our server, database, file storage and this website, and sends our sign-in emails. It processes your data for us, under a data processing agreement. Cloudflare logs requests to our server for a short time (at most 7 days), to help us find faults.
• Apple and Google sell Premium and confirm purchases to our server.

When you draw a route, your phone talks directly to these services. They get your phone's IP address and what they need for the task:

• Place search: Photon, by komoot GmbH (Germany), gets what you type and the middle of the map you look at.
• Finding the roads: Valhalla, run by FOSSGIS e.V. (Germany), gets the points you tap.
• Heights: elevation tiles from Amazon Web Services (USA) show which area you look at.

Why: to draw and build your route (Art. 6 (1) (b) GDPR). Map data © OpenStreetMap contributors.

Cloudflare, Apple, Google and Amazon may process data in the USA. They take part in the EU-US Data Privacy Framework, which the EU Commission found safe (Art. 45 GDPR). Where that does not cover a transfer, we use the EU standard contractual clauses (Art. 46 GDPR).

This website sets no cookies and uses no analytics. Its fonts come from our own server. To show you a page, Cloudflare processes your IP address and the page you ask for (Art. 6 (1) (f) GDPR: our interest in a safe, working website).

• Your account and its data: until you delete your account.
• Live ride data in the world: a minute after you leave. Race results: a day.
• Messages from Apple and Google about purchases: 90 days.
• Purchase records: as long as tax and commercial law ask, up to 10 years.
• Server logs: at most 7 days.

Deleting your account deletes your email address, profile, picture, rides, workouts, chat messages and sign-ins, on every phone. Routes you added stay, without your name. See Delete your account.

You have the right to:

• know what data we have about you (Art. 15 GDPR);
• have wrong data corrected (Art. 16);
• have your data deleted (Art. 17);
• have its use limited (Art. 18);
• get your data in a common format (Art. 20);
• object to processing that rests on our legitimate interest (Art. 21);
• take back a consent at any time, for the future (Art. 7 (3)).

Write to hello@anymap.bike. Many things you can do yourself in the app: change your profile, or delete your account.

You can also complain to a data protection authority. Ours is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Stuttgart.

AnyMap is for people aged 16 and over. We do not knowingly keep data of younger children.

When AnyMap changes, this page changes with it. The date at the top tells you when it last changed. If a change matters for you, we tell you in the app.