Privacy policy

1. Who is responsible

Omvej is a cycling route planner operated by Anders Nissen Mosegaard, the controller responsible for the personal data described here. For privacy questions or requests, email anders@ankjaers.net.

2. Information we handle

• Your account: email address, display name, account status, sign-in timestamps and, where provided by a connected service, profile picture. We store a password hash, not your readable Omvej password.
• Your planning: starting locations, route geometry, distances, elevation, names, notes, course points, areas to avoid and map preferences. GPS coordinates can reveal sensitive places, including your home.
• Connected activities: when you connect Strava, account identifiers, permission scopes and connection tokens, plus activity information such as names, types, dates, duration, distance, elevation and GPS traces. The permission requested includes private activities; these are not automatically excluded from import.
• Operation and security: request paths, status codes, timing, account identifiers, error and administrative records, and protected identifiers used to limit abusive requests. Our own usage records include route generation, saving and export events, their distance and time.

We use activity traces to show roads you have ridden and to personalise route planning. Account, route and preference data provide the features you request; operational records help keep the service reliable and secure and understand whether its features are being used.

3. Why we process it

Our legal basis for the account and planning data needed to provide the service you request is performance of our agreement with you (GDPR Article 6(1)(b)). For proportionate security, troubleshooting and first-party usage measurement, we rely on our legitimate interests in operating and improving a reliable service (Article 6(1)(f)), balanced against your rights.

Connecting an activity account is optional. You choose whether to authorise access and can stop future imports by disconnecting it. A provider's authorisation screen controls that provider's permissions; it is not permission for unrelated uses of your information.

4. Garmin: current and planned features

Official Garmin integration is planned, not currently available. Omvej currently lets you download routes as FIT course files for transfer to a compatible device. This does not connect Omvej to your Garmin account or automatically upload a course.

We are applying for official access to import authorised Garmin activities for ridden-road history and route personalisation, and to send routes you choose as Garmin courses. This statement is not a claim of Garmin approval or current partner access. Before enabling that integration, we will update this policy to describe the actual data, permissions, recipients and deletion behaviour.

5. Service providers and other recipients

Omvej uses OVHcloud hosting and an SMTP email-delivery service for invitations, password resets and account-security messages. Our database and route engine run as part of the hosted Omvej service.

Depending on the features you use, information is also sent to:

• Strava: authorisation and activity requests, and map bounds for segment searches.
• Mapbox: map tiles and fonts; tile requests reveal the map areas being viewed.
• MapLibre demo maps (demotiles.maplibre.org): fallback map resources when Mapbox maps are unavailable.
• Photon (Komoot): address-search terms, location bias and coordinates for reverse geocoding.
• Google Maps / Street View: locations you inspect; Google also serves fonts used by the app.
• Open-Meteo: coordinates needed for wind forecasts.
• Overpass API operators: geographic areas and road or point-of-interest queries.
• unpkg: delivery of the app's map library.

Services contacted directly by your browser receive network information such as your IP address and browser details. These providers have their own privacy notices and may process information outside the European Economic Area. Contact us for information about the providers and applicable transfer arrangements.

The current application has no third-party advertising or analytics SDK and no AI-analysis feature. It does have the first-party usage records described above. This privacy page itself loads no external fonts, maps, scripts or analytics.

6. Cookies and browser storage

Omvej uses cookies for sign-in and temporary authorisation state. A sign-in session normally lasts seven days. Local browser storage remembers preferences such as your starting location, map style and theme; it has no automatic expiry. You can clear it through your browser. Blocking necessary cookies prevents sign-in.

7. Keeping and deleting information

Account, saved-route and imported-activity data remain until they are deleted. There is currently no fixed automatic deletion period for inactive accounts, usage events, application-error records or audit records. Technical container logs rotate by size, not by a guaranteed number of days.

You can delete individual saved routes. To request deletion of your Omvej account or imported data, email anders@ankjaers.net. An administrator handles permanent account deletion from the live database, including the account's stored routes, imported activity data, preferences, credentials and connection tokens. Self-service account deletion is not currently available.

Encrypted database backups are retained as seven daily, four weekly and four pre-migration copies. These are copy limits, not a guaranteed maximum age. Existing backups are not rewritten when an account is deleted. Restoring a backup can reintroduce deleted data. Live-database deletion therefore does not mean immediate erasure from every backup or historical log.

Disconnecting Strava does not delete already imported activities: it removes Omvej's local connection tokens and stops further imports. Deleting your Omvej account does not delete your Garmin or Strava account, activities held by those services, or files you have already downloaded to your own devices.

8. Your rights and choices

Subject to applicable law, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it without affecting earlier lawful processing. Contact anders@ankjaers.net; we may need to verify your identity before acting on a request.

You can complain to the Danish Data Protection Agency, Datatilsynet, or the supervisory authority where you live or work.

9. Changes to this policy

We will update this page when the service or its data handling changes. The date above identifies the latest version. Material changes, including an official Garmin connection, will be described before the new processing is enabled.