Privacy policy

Last updated: 22 October 2026

Controller

The controller for the processing of personal data on this site, within the meaning of the General Data Protection Regulation, is:

Operator: Marcel Steinmetz
Address: Lüdemannstr. 66, 24114 Kiel
Email: kontakt@openxtrail.com

openXtrail is not required to appoint a data protection officer. Art. 37 GDPR requires one for public authorities, for organisations whose core activity is large-scale monitoring of people, and for large-scale processing of special categories of data; § 38 BDSG requires one from twenty people upwards who are constantly engaged in processing. None of that applies here — openXtrail is a private project run by one person. Questions about data protection therefore go to the same address as everything else.

Hosting

openXtrail runs on a dedicated root server at Strato in Germany, under Proxmox VE 9, and has been reachable there since 27 August 2026. Everything this site produces — accounts, tours, messages, the map data — sits on that one machine. There is no second copy at another provider. Where another company is involved at all, this policy says so further down: under sending mail, under the newsletter, and — once it is set up — under signing in with Google.

Strato provides that server and can therefore reach the data technically, but processes it solely for us and never for its own purposes. That is processing on our behalf; Art. 28 GDPR requires a contract between us and Strato for it, binding the company to our instructions and to confidentiality.

The legal basis is Art. 6 (1) (f) GDPR — no server, no site — and, once you have an account, Art. 6 (1) (b) GDPR as well.

Server logs and abuse protection

Every request to this site leaves a line in the web server's log: the IP address the answer went to, the date and time, the address requested, the status code, the size of the response, and — when the browser sends them — its own identifier and the page you came from. We replace the secret part of a shared link or of a link to a contact request before the line is written; it does not appear in the access log. Only when a request fails because a service is not answering can the full address appear in the same server's error log.

That is the usual extent of a web server log, and it is there for operations: to see whether the site is answering, and to follow up a fault somebody reports. Those lines stay on the same server and go to nobody. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest is a service that runs and whose faults can be found.

The same address also limits how often in a row anybody can sign in, register or ask for a mail — otherwise passwords could be guessed one after another, or somebody else's mailbox buried in confirmation mails. For that the IP address goes into a counter's key in Redis — the application's cache — and into no table in the database; the counter expires with its window, so after minutes to hours. The email address, which is counted against as well, is there only as a SHA-256 digest.

The address itself comes from the last entry of the X-Forwarded-For header. That is where our own web server writes down which sender it saw; what a caller puts into that header does not count, or the rate limit would have an off switch.

No fixed deletion period has been set up for these log files yet; they sit on the server until the service is deployed again. That is written down because it is the case: claiming a period that is configured nowhere would be the more comfortable sentence and the wrong one.

Your account

You need an account for everything that is yours: your own tours, saved routes, your own settings. For that we store:

Email address: How you sign in, and how we reach you — confirming a registration, a new password, an answer to a question.
Password: Never in clear text. Only a hash is stored, and the password cannot be computed back out of it; somebody reading the database could not sign in with what they found.
Display name: The name you appear under on the site. You type it in yourself when you register; on an account created through Google the first one is derived from the part of the address before the @. You can change it at any time afterwards under Settings › Profile.
Profile picture: Only if you upload one. It is re-encoded to 256 × 256 pixels and kept as WebP in the database, not as a file somewhere beside it.
Favourite sports: Which sports you are interested in; preselections and suggestions follow from them.
Home: A point on the map with a label, if you set one — the usual starting point for planning. Optional, and removable at any time.
Settings: Language, units, profile visibility, whether you can be found by name and — only if you switch it on — by email address, notifications, and the map's label size, which sits under Accessibility.

Technically these sit in the tables users, identities, user_avatars and user_sports. The legal basis is Art. 6 (1) (b) GDPR: without them there is no account, and the account is what you asked for.

Two more tables only keep the sign-in working: refresh_tokens for the sessions, and email_tokens for the time-limited links in confirmation and password mails. What is short-lived in them is the tokens themselves — one that has been signed out or has expired opens nothing any more. The row stays behind: for a session as a note that it existed and when it ended, for a link as a note that it was redeemed. At the latest when you delete your account they go entirely.

With each session we keep a short device name such as “Firefox · Windows”, read from your browser's identifier when you sign in. It lets you see under Settings › Account where you are signed in, and sign out a device you do not recognise on its own. We do not store the full browser identifier or your IP address for this. The legal basis is Art. 6 (1) (f) GDPR: you should be able to tell whether somebody else is signed in to your account.

A seventh table comes into play only if an administrator of this site opens your account in the administration or changes something about it: admin_actions records who did what and when — your account viewed (see below), a role changed, an account disabled or enabled again, a profile or an email address changed, newsletter consent set or cleared, a confirmation or password mail triggered. Most of them carry a short note in English saying what changed — for an address change, the previous address. Viewing, disabling, enabling and the two mails leave it empty, because the kind of entry already says everything there is to say. A password cannot appear there — this application has no way to set somebody else's password. The legal basis is Art. 6 (1) (f) GDPR: being able to trace what was done to an account that is not your own is the point of a log like that.

If an administrator opens the administration view of your account — to look into a report, a support request or a suspicion of abuse, for example — they see your account regardless of your privacy settings: name, email address and whether it is confirmed, role and status, sign-in methods, newsletter consent, language and units, when it was created and last used, your profile details, and how many tours, routes, trips and followers you have and how many reports against you there are — but not your password, your start point or the content of messages. Every such opening is recorded in admin_actions. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is running the platform safely and free of abuse.

Name, gender and birthday

When you sign up we also ask for these details, each for a purpose of its own:

First and last name: For invoices, once there is something to pay for on openXtrail. Neither is shown anywhere — on the site you appear under your display name.
Gender: For performance values such as calories and heart-rate zones, which we plan to introduce and which depend on it. openXtrail does not calculate any yet.
Birthday: For the same planned performance values, and because an account requires you to be 16 or older. From that age you can consent to the processing of your data yourself in Germany (Art. 8 GDPR).
When you agreed: The moment you confirmed having read this privacy policy. We have to be able to show such consent (Art. 7 (1) GDPR).

The legal basis is Art. 6 (1) (b) GDPR. If you signed in with Google, or made your account before we asked for these details, we ask for them once on your next visit. We take nothing from Google for this — all we ask Google for is your email address.

Signing in with Google

There is a “Continue with Google” button on the sign-in page. Today it leads to an error message: no access for openXtrail is registered with Google, so the server refuses the request and the page says that signing in with Google is currently unavailable. For as long as that is the case, pressing the button sends nothing to Google.

Once that access is set up, the button will do what it promises: your browser is sent to Google, you sign in there and confirm that openXtrail may learn your identifier and your email address. We do not ask for your name: the scope requested is “openid email”. Google then returns a signed token, and we read no more about you out of it than the identifier, the address, and a note of whether Google has confirmed that address itself. The display name is derived here, from the part of the address before the @, and you can change it at any time under Settings › Profile. The account is matched by the immutable identifier (“sub”) rather than by the address — an address at Google can change hands, and whoever got it next would otherwise land in somebody else's account.

The recipient is then Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google also processes sign-in data in the USA; the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework covers that. The legal basis is Art. 6 (1) (b) GDPR — you want to sign in — and nothing is sent anywhere until you press the button.

For the few minutes that redirect lasts, openXtrail will then set a third cookie that secures the way back. Today, with no access set up, that redirect never happens at all. What the cookie holds and how long it lasts is on the cookie page at /en/cookies.

Cookies

openXtrail sets cookies for signing in and for nothing else: two for as long as you are signed in, and a third for the few minutes of a sign-in through Google, once that is possible. They keep you signed in and do nothing more — they hold neither your name nor your address, and nothing about your tours.

Unless you sign in, this site sets no cookie at all, which is why there is no cookie banner either. The names, lifetimes and attributes of all three — and the draft the route planner keeps in the browser — are set out in full on the cookie page at /en/cookies. The legal basis for storing anything on your device is § 25 (2) no. 2 TDDDG, because all of it is strictly necessary and therefore needs no consent; for the processing behind it, Art. 6 (1) (b) GDPR.

Tours, routes and location data

This is the part that deserves an explanation. Somebody who saves tours is saving movement data, and that says more about a person than an email address does.

Recorded tours (table record_trails): the line you rode or walked, with altitude and time at every point, plus the tour's name, the starting time, duration, distance, ascent, sport, the nearest settlement and the platform it came from — together with that platform's own id for it, so the same tour cannot arrive twice.
Planned routes (planned_routes): the waypoints, the profile, the pace you chose and the name you give it.
Trips (trips, trip_stages, trip_covers, trip_members, trip_checklist_items, trip_stage_rides), bike tours and camper tours alike: name, description, status, dates, direction, start and finish and your notes; per stage a copy of the linked route (line, waypoints, profile, figures), title, overnight stop, accommodation, notes, stops and times; a cover image if you upload one, as WebP of at most 1600 pixels on the long edge; your checklist (with the name of whoever ticked an item); whom you invited as travel partners, with which role and whether they accepted; and per stage the ridden tour you link to it. Notes, accommodation and the checklist are visible only to you and your travel partners; a shared link never shows them. Only you see the tours you link to stages – not even your travel partners. If someone invites you to a trip, they see your display name, your profile picture, your role and whether you accepted; once you accept, the other travel partners see your name, picture and role too. We keep your membership of someone else's trip until you leave it, are removed, one of you blocks the other or the trip is deleted. Places along the route (accommodation, water, stations) are looked up on our own server from our own OpenStreetMap data; nothing goes to a third party.
Vehicles (vehicles, vehicle_photos): name, type, height, width, length and gross vehicle weight, and if you like a number plate and a photo (as WebP of at most 1600 pixels on the long edge). We use the dimensions to plan camper tours your vehicle fits through. On a camper tour your travel partners see the vehicle's name, type and dimensions, never the number plate or photo; a shared link does not show the vehicle at all. Deleting your account deletes your vehicles too.
Saved places (saved_places): a point with a label you choose yourself — home, work, a car park at the edge of a wood.
Uploaded GPX files: a file is read when you upload it and stored as a recorded tour. We do not keep the file itself.
There are tables for collections (tours) and published routes (trails), but nothing in the interface fills them yet; today they hold nothing.

What a recording like that gives away we would rather say plainly: where you set off and when, how often you go round the same loop, and — if you start at your front door — where you live. That is exactly why everything is private when it is created, and exactly why all of it goes when you delete your account.

Every tour and every route is private until you set it to “public” yourself — one at a time or several at once. Under Settings › Privacy you choose whether new tours and new planned routes start private or public; the default is private. A public tour is seen only by people who may also read your profile — who that is, the next section says.

The legal basis is Art. 6 (1) (b) GDPR: saving tours is what this account is for.

To bring tours over from Komoot or Garmin, the “Connections” page opens a second window at that platform, where you are signed in yourself. We send nothing there: your browser collects the tours and hands them on to openXtrail. Our server never talks to either platform.

Profiles, following and blocking

Signed-in people can find each other, look at profiles and follow each other. Anybody not signed in sees none of it.

Search: by display name when “Findable by name” is on, and by the exact email address only when you have switched on “Findable by email”. The address itself is never shown to anybody.
Profile: a public profile can be read by every signed-in person, a private one only by people who follow you and whom you accepted. Others see only the name and the picture of a private profile. Only tours and routes you made public are shown — without where the file came from and without the link to your planned routes.
Following: a public profile is followed at once, a private one by a request you accept or decline. We tell nobody about a declined request or a follower you removed. If you make your profile public, open requests count as accepted.
Blocking: afterwards you no longer see each other — no profile, no search, no following. Existing follows end, and each of you leaves the other's trips. On a third person's trip you both stay members and still see each other there. The blocked person is not told. The list is under Settings › Privacy.
Notifications: you are told under the bell about a follow request, a new follower, an accepted request and an invitation to a trip. We delete read entries 7 days after they were read, unread ones after 180 days at the latest; you can also delete them there yourself. An invitation to a trip also arrives as a push notification if you have switched push on. Requests and new followers also come by email unless you switch that off under Settings › Notifications — every such email also carries a link that unsubscribes from it. The link works for twelve months. For it to work we store, for every link sent, a fingerprint (a hash from which the link cannot be worked out), your account and the kind of email. We delete that record after the twelve months, and at once when you delete your account. Whether such an email could be delivered is counted for the statistics.
New rides: the people who follow you see your public rides under “New rides”, ordered by the time a ride first became public. We store that time with the ride; it stays even if you make the ride private again. Your followers get one entry about it under the bell (“… published 3 new rides”), deleted like every notification 7 days after it was read, unread after 180 days at the latest. That you opened “New rides” is counted with your account for the statistics.
Likes, comments and reports: likes and comments on a ride are visible to everybody who may read the ride. We keep them until you withdraw or delete them, until the ride is deleted, or until your account is deleted; if you block each other, we remove them between the two of you. The ride's owner is told under the bell, and by email for comments unless that is switched off under Settings › Notifications. A report is stored with your account; the reported person is not told who reported. We keep reports as evidence; if you delete your account, we remove the link to you. If we remove a post, we send the person concerned a statement of reasons. The legal basis is Art. 6(1)(b) GDPR for the features and Art. 6(1)(f) GDPR for reviewing reports (our interest in keeping the platform free of illegal and abusive content).
Screenshots on a report: you can attach up to three screenshots to a report. We store them so that we can judge the report, and only the people who handle reports for us see them. On upload we re-encode every image and remove all metadata, such as the location, the device and the time it was taken. We keep a report's screenshots until the report is decided, and delete them one year after the decision. If you delete your account, or the reported person deletes theirs, the screenshots are still kept until that period ends; only the link to you is removed. Where unlawful conduct is suspected, we secure a report and its screenshots as evidence so that it can be prosecuted; while that hold lasts we delete none of it, even beyond the one year. If a ride was reported, the same holds for it: while the hold lasts we do not delete the ride with the account, and only the people who handle reports see it; once the hold ends, we delete it. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in reviewing reports and having unlawful conduct prosecuted) and, where the law obliges us to keep it, Art. 6(1)(c) GDPR.
Shared links: for one of your own rides, routes or trips you can create a link — valid for 7 days, 30 days or without expiry. Whoever has it sees the ride, route or trip with its map, figures and your display name, even without an account and whether or not it is public, until the link expires or you revoke it under Settings › Privacy. It does not become public. We count how often a link was opened — without any reference to the person who opens it. If you delete your account, your links stop working.
Push notifications: you turn push on for each device separately under Settings › Notifications; your browser asks for permission first. We then store, for that device, the address your browser's push service assigns, the keys that go with it, a device label from the browser identifier, and when a notification was last sent — until you remove the device, sign out in that browser or on all devices, the browser unsubscribes, or you delete your account. Each notification goes encrypted to the push service of the browser vendor (Google, Mozilla, Apple or Microsoft), which passes it on to your device; it learns your device's address but not the content. A notification holds a title, one line and a link — no coordinates and no comment text. You can switch off each kind of notification that arrives as push. The legal basis is your consent under Art. 6(1)(a) GDPR, given through the browser's permission and the switch, which you can withdraw at any time.

We keep who follows whom and who blocked whom until it is undone or one of the two accounts is deleted. The legal basis is Art. 6 (1) (b) GDPR: it is the feature you use.

Maps

The map comes from our own server. The style, the tiles, the glyphs and the icons all sit under /tiles/ on the same host as this page; the map data comes from OpenStreetMap and is built into finished tiles here.

In practice that means no map provider — not Google, not Mapbox, not OpenStreetMap's own servers — receives a request when you move the map. Which part of it you are looking at is known to nobody except the server your account is on anyway.

One exception is yours to make: if you drag the Street View bike in the planner onto the map, we open Google Street View at that spot in a new tab. Google then receives the coordinate and, as on any visit there, your browser's data; Google's privacy policy applies. In the same way, “On Google Maps” on a place along a trip opens Google Maps at that place's coordinates in a new tab, only once you click it; Google's terms apply then too. Before that, this site loads nothing from Google.

Route planning

Routes are computed by our own BRouter instance, running as a container in the same stack as everything else. The start, the destination and the points in between go to that service and to no other; they do not leave the server.

The road and path network they are computed on is downloaded beforehand: the routing data from brouter.de and the OpenStreetMap extract the map is built from as well. That happens once per data version; no visitor's request triggers it, and it has nothing to do with yours.

The place search in the planner asks nobody either: what you type is matched against our own osm.places table, from that same OpenStreetMap extract. An outside geocoder was the alternative and was rejected — every single keystroke would have gone to another service.

The legal basis is Art. 6 (1) (f) GDPR for the computation itself, which works without an account, and Art. 6 (1) (b) GDPR once you save a route.

Usage statistics

So that we can see how the planner is used and why a route takes long, we record individual events: a computed route with its profile, length, number of legs, outcome and how long the computation, the cache and the display took; a saved route; a GPX download; an import; a sign-up, a sign-in, a failed sign-in and an account deletion; a people search — only that somebody searched, never for what — and the opening of somebody else's profile, without recording whose. Where you plan is never in it — no place, no coordinate.

While you are signed in and your account exists, such an entry is linked to your account; failed sign-ins and deletions never are. Only administrators can see it. The purpose is running the planner, finding slow spots and spotting abuse; the legal basis is Art. 6 (1) (f) GDPR. There is no fixed deletion period. If you delete your account, every entry is detached from you and remains only as an anonymous count.

When you import a ride we also check whether it follows one of your planned routes and note that on the ride. You see the note yourself; in the administration it appears only as a number.

Contact form

You can write to us at /en/contact, with or without an account. What is stored is your name, your email address, the subject, the category, the text of the message and the images you attach — in the tables contact_threads, contact_entries and contact_attachments.

Every case gets a number and a link where you can read the exchange and reply; the link carries a token of which only a digest is kept here. If you simply reply by mail instead, your answer arrives through the same mailbox and lands in the same case.

A case that is waiting on you closes itself after 30 days without movement, counted from the last activity in it; you are told when it does. A case nobody here has answered never expires — it stays open until somebody replies.

The legal basis is Art. 6 (1) (b) GDPR where the matter concerns your account, and otherwise Art. 6 (1) (f) GDPR: somebody who writes would like an answer.

Sending mail

Every mail openXtrail sends — confirming a registration, a new password, an answer to a question, the newsletter — goes through all-inkl's mail server (ALL-INKL.COM – Neue Medien Münnich, Germany). The sender is noreply@openxtrail.com, with kontakt@openxtrail.com as the reply address.

Incoming mail to kontakt@openxtrail.com sits in a mailbox at all-inkl too. openXtrail collects replies from there and files them under the matching contact case.

In doing so all-inkl processes the recipient's address and the content of the message, and does so only for us. That too is processing on our behalf; Art. 28 GDPR requires a contract between us and all-inkl for it.

Deletion and retention

You can delete your account yourself, at /en/account/delete. It takes two steps: you request the deletion, receive a mail with a link, and only the button on the page behind that link actually deletes. That way no mail program that opens links in the background can dissolve an account by accident.

If a report against your account is still open when you confirm the deletion, we do not delete your account at once but deactivate it: you can no longer sign in, your profile and your content are no longer visible to anyone, and shared links stop working. Your data is kept until the review is complete, so that we can handle the report properly (legitimate interest, Art. 6(1)(f) GDPR, and where applicable legal obligations, Art. 6(1)(c) GDPR). As soon as the last report against you is decided, we delete your account and your data automatically; what is secured as evidence is kept as described above. The deactivation and the deletion that follows cannot be withdrawn. We tell you about this by email.

On that page we ask for a reason for the deletion, with a short note if you like. We keep the reason and the note without a reference to your account – no account, no address, the day rather than the time – and only if you actually delete. They serve only to improve openXtrail (Art. 6(1)(f) GDPR). Please write nothing in the note that identifies you.

What is then deleted, in one go:

the email address, the password and the record that the address had been confirmed
the first and last name, the display name and the profile picture
the gender, the birthday and the moment you agreed to this policy
home, saved places and favourite sports
every recorded tour, every planned route and every trip with its stages and cover image, your membership of other people's trips and the tours you linked to their stages
the link to Google, every session — the long-closed ones included — and every mail link, redeemed ones included
any consent given for marketing mail

What remains is a row with a number and the name “Gelöschter Nutzer” — deleted user, in the one language the database writes it in. Everything on it that names you is emptied; the profile's visibility is set to private and its discoverability by name and by email address switched off. What stays are three settings that name nobody — language, units and the map's label size — along with the account's role, its active flag and the row's timestamps. What stays beside the row is in the next paragraph. The reason for the row is not thrift: later on, comments and ratings should be able to hang from an author who stays while the person goes.

What it does not delete we would rather say as well. A contact case stays — it carries the name and the address you gave there, and closes under the rule further up. The delivery log of newsletters already sent stays, because it shows what went to whom and when. If an administrator viewed your account or changed something about it, that entry in admin_actions stays too, with its note and so, after an address change, with a former email address. Otherwise a deletion would take with it the very record of what happened to the account. Your entries in the usage statistics stay as anonymous counts, detached from you. Ticks you set in other people's checklists stay, just without your name. Routes you added as stages to other people's trips stay there as copies with their line and name, even after you leave the trip, are removed from it or delete your account. And the server logs stay as they are. Mail already sent cannot be recalled in any case.

A newsletter subscription belongs to an address rather than to an account: the unsubscribe link is the way out of it, and it is in every issue. Individual routes, on the other hand, have a bin — a deleted route sits at /en/routes for 14 days and can be taken back out during that time. A deleted trip likewise sits in the bin at /en/trips for 14 days, and a deleted checklist entry in the bin under its list for 14 days. There is no bin for the account; deleting it is final.

No tracking, no advertising, no third parties

This list is a description rather than a statement of intent: none of it is built into this application.

No analytics, no audience measurement, no visitor counting — neither through a third-party service nor with one of our own.
No advertising, no retargeting, no advertising identifiers, no profiling.
No social media plugins and no like or share buttons.
No external web fonts.
No content delivery network and no content embedded from somebody else's server.
No consent management platform, and therefore no cookie banner either.

That is not a claim you have to take on trust. This site's interface uses five third-party libraries at runtime — maplibre-gl and pmtiles for the map, Next.js, React and React DOM for the page itself — and not one of them calls out anywhere; all of them are delivered from our own machine.

The other companies openXtrail sends data to are involved exactly where it says so above, and nowhere else: Strato provides the server, all-inkl sends and receives the mail, DeepL translates the text of a newsletter issue, and Google would join them once signing in with Google is set up. None of those companies learns who opens this site or what they look at on it. Komoot and Garmin are therefore not on that list even though they appear further up: openXtrail sends them nothing — your own browser opens a window at a platform you are signed in to yourself.

Your rights

You have the following rights in relation to us:

access to what data we process about you (Art. 15 GDPR)
rectification, where something is wrong or incomplete (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
a copy of your data in a common format, including for transfer to another provider (Art. 20 GDPR)
objection to processing based on a legitimate interest (Art. 21 GDPR)

Separately on the right to object, because Art. 21 (4) GDPR asks for it separately: you have the right to object at any time to the processing of your data wherever we rely on a legitimate interest. In this policy those are: serving the site at all, the server logs with their abuse protection, the administration view of your account and the administration log admin_actions, route planning without an account, and a message through the contact form that has nothing to do with an account. A plain sentence to kontakt@openxtrail.com is enough, and you do not have to give reasons. After that we stop processing that data — unless we can demonstrate compelling legitimate grounds that override your interests.

Consent — today that is only the newsletter — can be withdrawn at any time with effect for the future (Art. 7 (3) GDPR), without making the processing up to that point unlawful.

Much of this is quicker without us: you can change your account and your settings yourself, delete tours and routes yourself, dissolve the account yourself, and unsubscribe from the newsletter with one click. For anything else, write to kontakt@openxtrail.com — an answer comes within one month (Art. 12 (3) GDPR).

Right to lodge a complaint

If you believe we are not handling your data properly, you can complain to a data protection supervisory authority — the one where you live, or the one responsible for us. Ours is:

Authority: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
Address: Holstenstraße 98, 24103 Kiel

That right is in Art. 77 GDPR and exists alongside every other remedy. A complaint there costs nothing, and asking us first is not a condition for it — although we would prefer the shorter way.

Authoritative version

The German version of this privacy policy is the binding one. This English version is a convenience translation; where the two differ, the German text applies.