Privacy

What is stored

When you create a plan: your name, the plan details you enter and an optional route. Name, title, note, meeting area, time, distance and pace are visible to anyone with the link. The exact start and the route are shown only to you and people who join, and are stored encrypted.

When you respond: the name you give, your choice and the language of the page, for messages about the plan. Your name is stored encrypted and shown to the host, and to the other participants if you join. If you ask to join, your optional note to the host is stored encrypted too, shown only to the host and deleted once the host decides.

After a plan, participants and the host can add comments and links to its recap. They are stored encrypted, shown only to participants and the host, and deleted with the plan. Links are shown as plain links; nothing is loaded from them.

After a plan, participants can rate it with a thumbs up or down and an optional note. Only the host sees ratings, once the recap has closed and only for plans with at least 3 participants; notes show their author’s name. Ratings are stored with the note encrypted and deleted with the plan, the response or your data.

If a host chooses “Keep as repeatable template” or saves a template, the plan’s details, including the host’s name, are kept as a template; never its responses, participants’ names, recap or ratings. The exact start and route are kept only if the host includes them, and then encrypted. A template is deleted after 90 days without being repeated or edited.

Nearby uses the place you search from only for that search. A spot from the map or your location is rounded to about 2 km by your browser before it is sent, and again by the server. A typed place is looked up like place search above, and the search continues from its rounded spot; without JavaScript the typed place is in the address of that first request. Nothing of it is stored or written to this site’s logs. The rounded spot is in the address of the results page, so it can stay in your browser history and in the access log of a web server in front of this site.

Reports: if you report a plan, the instance admin gets the reason, your details and copies of any recap comments you attach, without who wrote them. Reports do not say who sent them and are deleted with the plan.

There are no accounts, no analytics and no advertising.

You can see, export and delete everything linked to your browser yourself, at any time: My data on this device

How long

Each plan is deleted with all responses, names and its route on the date shown on the plan page: 1 to 30 days after the run, as the host chooses. The host can delete it earlier, and you can withdraw your response at any time. Deleted data is overwritten in the database.

The link between your browser and your plans or responses is deleted 30 days after its last use once nothing is linked to it anymore, and in any case after 365 days without use.

Automatic database backups made before software updates are deleted after 7 days.

Who can access the data

The operator of this site can technically access everything stored here, including encrypted data. Encryption protects data in leaked database backups when the key is kept separately, but not against the operator.

Cookies

• A device cookie, only once you create a plan, respond or open a private link: a random value that links this browser to them, kept for 400 days.
• A session cookie that protects forms against forged submissions. Browsers delete it when you close them, unless they restore your previous session.
• Language and units cookies, only when you choose a language or units at the bottom of a page, kept for 400 days.

No other cookies, and none from other sites.

Other services

• Maps are loaded by your browser directly from tile.openstreetmap.org. That service sees your IP address and which map area you look at.
• For the weather forecast on plan pages, this server asks api.open-meteo.com about the rough meeting area and the start time. Nothing about you is sent. Forecasts are kept in this server’s memory for up to 60 minutes.
• “Use my location” asks your browser for your position and only fills in the form; it is sent only when you submit the form. With maps on, the map then moves to your position, so your browser loads map images of that area from the map service.
• If you turn on notifications, your browser’s push service (from Google, Mozilla, Apple or Microsoft) delivers them. The messages are encrypted; the service only sees that one was sent. To send them, this server stores your browser’s push address and keys, encrypted, and deletes them when you turn notifications off, or with the plan or your response.
• If you create a calendar link, your calendar app’s server fetches it. That server sees the public details of your plans and that you responded to them.
• WhatsApp is contacted only when you use its share link.
• When a plan link is shared in a chat app, the app fetches the plan’s title, time, meeting area, distance, pace and a preview image. Chat apps may keep this preview after the plan is deleted.

Logs and abuse protection

The software logs which kind of page was requested and whether it worked, never names, private links, exact locations or IP addresses.

To prevent abuse, the server counts requests per IP address (for IPv6, per network) in memory only, for at most about an hour.