Privacy

Last updated: 19 October 2026

This policy covers the Pedalglobe app for iPhone and iPad. Visits to this website, pedalglobe.de, are covered by section 13. This policy tells you which data goes where and when. In short: Pedalglobe does not collect data about you.

This is a translation. If the German and English versions differ, the German version applies.

1. Summary

• You don't need an account. There are no ads, no analytics and no tracking. We run no server that receives your data.
• Your routes, trips and settings are stored on your device and, unless you turn sync off, in your private iCloud. We can't see them.
• Place search, climate values, country information and bike routing are computed on your device. Search terms, places and routes don't leave your device for this.
• The app sends your location to no one. It does load the map tiles around it online, though (sections 6 and 7).
• The app loads maps online from free map services and, when you ask for them, routing regions from our storage at Cloudflare. These parties see your IP address and which map area or region you load (sections 7 and 8).
• Purchases are handled by Apple alone. We don't learn who you are.
• We only receive something from you if you write to us (section 12), if you test pre-release versions (section 11) and from Apple as crash reports if you allowed sharing with app developers in iOS (section 10).

That is why the App Store shows “Data Not Collected” for Pedalglobe.

2. Controller

Burkhard Naumann
Katharinenstr. 15, 01099 Dresden
Germany
Email: kontakt@posan.de

“Posan” is the developer name under which Pedalglobe is published. More details are in the legal notice. No data protection officer has been appointed because there is no obligation to do so (section 38 of the German Federal Data Protection Act, BDSG).

3. Data on your device

What: routes and trips (places, stages, connections, notes), the current planning draft, your settings (for example passport for entry rules, bike, pace, climate thresholds), recent place searches, the app's UI state, the status of your Pedalglobe Pro purchase, the app's data packs (climate, places, countries, world overview map), downloaded routing regions and a cache for map tiles.

Where: in the app's storage on your device. We have no access to it, and the app doesn't send this data to us.

Device backups: If you back up your device with iCloud Backup or your computer, the app's data is part of that backup according to your settings.

Deleting: You delete routes and trips in the app. Deleted items stay under Recently Deleted for 30 days, where you can restore them or remove them for good. If you delete the app, iOS removes all of its data on that device. Data in your iCloud is not affected (section 4).

Storing and reading information on the device: The app only stores and reads what the features you use need (section 25(2) no. 2 of the German TDDDG). It uses no cookies and no identifiers that would let us recognise you.

4. Sync via iCloud

What: If you are signed in to iCloud with your Apple Account on the device and haven't turned sync off, the app stores your routes and trips (with places and notes) in the private CloudKit database of your iCloud (container iCloud.de.posan.pedalglobe). Selected settings (appearance, bike and pace, passport for entry rules, climate thresholds, how points are added, last release notes read) are kept in the iCloud key-value store. Not synced: the planning draft, recent searches, UI state, Recently Deleted, data packs, routing regions and map tiles.

Purpose: to keep your data the same on all your devices and restore it after reinstalling.

Legal basis: Art. 6(1)(b) GDPR (use of the app). Sync is a feature you can turn off at any time.

Recipient: Apple only. Apple processes the data on our behalf (Art. 28 GDPR) under the Apple Developer Program License Agreement, Attachment 4 (iCloud). The storage counts towards your iCloud storage. We can't see your data.

Encryption: Data in iCloud is encrypted in transit and on Apple's servers. In addition, the app puts all content of your routes and trips into CloudKit's encrypted fields (encryptedValues): the document with places, stages and notes, the name, dates, number and length of sections, a trip's references to its routes and the name of the device that made the last change. CloudKit encrypts these fields on your device. Large routes are stored as a file that the app first encrypts itself with AES-GCM (256-bit), and the key goes into an encrypted field. Who holds the keys depends on your iCloud setting: with Advanced Data Protection for iCloud, only you do. Only technical details without content remain readable: record type, random identifiers, timestamps, format version and encoding. The app doesn't add its own encryption to the settings in the key-value store. Apple's iCloud encryption applies to them.

Notifications: So that changes reach your other devices quickly, iCloud may use silent notifications via Apple's push service. Apple manages the token for this. We don't receive it.

Transfers outside the EU: Apple may store the data outside the EU, including in the USA. In the agreement named above, Apple has committed to transfer personal data from the EEA only to countries with an adequate level of protection or on the basis of the EU Standard Contractual Clauses.

Turning it off and deleting: In the app, go to More › iCloud Sync and turn off Sync with iCloud. Your data then stays on the device only. On the same screen, Delete Data in iCloud… removes everything from Pedalglobe in your iCloud. Everything stays on your device. A route or trip you delete in the app is also deleted in iCloud. Otherwise the data stays in iCloud until you delete it.

5. Backup file

Under More › iCloud Sync, Export All Data… creates a .pedalglobe-backup file with all routes and trips. It is created on your device, and you decide where it goes via the share sheet. Import Data… reads it back. We don't receive the file.

6. Location

• The app asks for your location only when you use a feature that needs it, and only while you are using the app (“While Using the App”).
• Purpose: to show your location on the map and to plan a route from there with Route here.
• Your location is processed on your device only. The app sends it neither to us nor to anyone else. It is only saved when you plan a route with Route here: then as its starting point, like any other place in a route (and therefore also encrypted in your iCloud, section 4).
• Note on the map: The app loads the map around your location online (section 7). From the requested map area, the map service can therefore infer your approximate area, even though the coordinate itself is not sent. The text iOS shows when asking for permission says so too.
• You can change or withdraw permission at any time in iOS Settings under Privacy & Security › Location Services › Pedalglobe. Everything keeps working without it. You then find places with the search.

7. Maps from the internet

What happens: A coarse world overview of the map (zoom levels 0 to 5) is built into the app and needs no network. For everything more detailed, the app loads the map style, the tiles for the visible area, fonts and icons online from the service of the chosen map type. It only loads other map types and the relief once you turn them on in the map picker. The cycle network is switched on there by default.

Which data: your IP address, the requested addresses (they reveal map area and zoom level), the time and technical details of the request. As an identifier, the app only sends its name, version and map engine, in the form Pedalglobe/<Version> (<Build>; iOS) MapLibre Native. The app sends no routes, no location coordinate, no name and no device identifier.

Delivery networks: The services may distribute their tiles through content delivery networks (CDN), OpenFreeMap, by its own account, for example through Cloudflare. These then process the connection data too, partly in data centres outside the EU.

Purpose: to show you the map you chose.

Legal basis: Art. 6(1)(b) GDPR, because the map is a core feature of the app that you use. Alternatively Art. 6(1)(f) GDPR: our legitimate interest is to show you a current, worldwide detailed map. It is too large to ship completely inside the app.

Our role: We decided which services the app contacts. The services decide on any further processing of the connection data themselves, under their privacy policies (links in the table).

Transfers outside the EU: OpenFreeMap, the BKG and EOX are based in the EU. For the United Kingdom, the European Commission has adopted an adequacy decision. Where delivery networks or Apple transfer data to the USA, they state that they rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

Cache: The app keeps tiles it has already loaded on your device for as long as the services allow. It doesn't prefetch tiles.

If you don't want this: Use the app without a connection, for example in Airplane Mode, or turn off mobile data for it in iOS Settings. Climate, place search, country information, downloaded routing regions and your routes keep working. The map then only shows the built-in world overview.

8. Routing regions from tiles.posan.de

What happens: The app calculates bike routes on your device. It downloads the routing data for this region by region when you ask for it (for example with Download region) from https://tiles.posan.de/. Only static files are stored there. There is no server logic and no account. The app also loads the cycle network, the relief and the satellite imagery from the same address (section 7). This section applies to those requests too.

Recipient: The files are stored in the R2 storage service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, in a bucket with EU data location. Cloudflare stores and delivers them on our behalf (Art. 28 GDPR). The agreement is part of Cloudflare's terms and includes the EU Standard Contractual Clauses. Cloudflare is also certified under the EU-US Data Privacy Framework.

Which data: your IP address, the requested file (which reveals the region you download), the time and technical details of the request. As an identifier, the app only sends its name, version and Routing. It sends no routes, no location and no device identifier.

Logs: We set up no access logs of our own and don't analyse the requests of individual people. Cloudflare may keep logs that are technically necessary, for example to deliver the files and fend off attacks. This is governed by Cloudflare's privacy policy. Delivery runs through Cloudflare's worldwide network. If you are travelling outside Europe, your request may therefore pass through data centres outside the EU.

Purpose and legal basis: to provide routing data for use without a connection, Art. 6(1)(b) GDPR.

Downloaded regions stay on your device and are not synced via iCloud.

9. App Store and purchase of Pedalglobe Pro

• Downloads, purchases, payment, refunds and Family Sharing are handled by Apple (in the EU: Apple Distribution International Ltd., Ireland) under Apple's terms and Privacy Policy and under Apple's own responsibility.
• Pedalglobe Pro is a one-time in-app purchase (de.posan.pedalglobe.pro) that you can share with Family Sharing. The app checks on your device with Apple's purchase system (StoreKit) whether you bought it. There is no server of our own for this, and the app sends no receipts to us or anyone else.
• We receive no name, email address or payment details. Apple gives us sales figures and payouts.

10. Crash reports via Apple

• The app contains no analytics or crash reporting tools of its own.
• If you allowed iOS to share analytics with app developers, Apple passes crash reports and statistics on to us. According to Apple, it only shares them in a form that doesn't identify you.
• We use them to find and fix bugs. Legal basis: Art. 6(1)(f) GDPR (our interest in an app that works).
• We delete downloaded crash reports once the bug is fixed, at the latest after 12 months.
• To turn this off: iOS Settings › Privacy & Security › Analytics & Improvements › Share With App Developers.

11. Pre-release versions via TestFlight

Only for anyone who tests pre-release versions through Apple's TestFlight:

• We see the email address we invited you with. If you test via a public link, you stay anonymous to us unless you give an email address with your feedback.
• We see what you send via TestFlight: comments, screenshots, crash reports and details about the app, device and operating system. Apple's privacy policy for TestFlight applies as well.
• Purpose: to improve the pre-release version. Legal basis: Art. 6(1)(b) GDPR (taking part in the test).
• We delete feedback at the latest 6 months after the test ends.

12. Contact by email

• If you write to us, we process your email address, your name (if given), the content of your message and what you include (for example app version or device).
• Purpose: to answer your request. Legal basis: Art. 6(1)(b) GDPR if it concerns the app or your purchase, otherwise Art. 6(1)(f) GDPR (our interest in answering requests).
• The email service we use (DomainFactory GmbH, Neuturmstrasse 5, 80331 München) processes messages on our behalf (Art. 28 GDPR).
• We delete your message 6 months after the request is closed, unless we have to keep it longer, for example for tax reasons.
• Please don't send us routes or other personal data we don't need for the answer.

13. The website pedalglobe.de

This section applies to visits to the website pedalglobe.de and all its pages. Technically it has nothing to do with the app: the app sends nothing to this server.

• No cookies, no analytics, no third-party content. The pages are plain static files. They set no cookies, use no tracking, need no JavaScript and load nothing from other services (no external fonts, videos, maps or social network buttons). The video is on our server and only loads when you play it.
• Hosting: The website is on a server that we rent and manage ourselves from Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany. The server is located in Deutschland. Contabo acts on our behalf (data processing, Art. 28 GDPR).
• Access logs: Each time a page or file is requested, the web server (Apache) writes your IP address, date and time, the requested address, the status code, the amount of data, the referrer (if your browser sends it) and your browser identification to its log. Errors are additionally noted with IP address and time in an error log. Purpose: to deliver the pages, find errors and fend off attacks and misuse. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation). We build no profiles from them and do not combine them with other data. The logs are deleted automatically after 14 Tagen, entries about a specific attack are kept until the incident is closed. Without this connection data the server technically cannot deliver the pages. You can object to processing under point (f) as described in section 17.
• Encryption: The website is only reachable over HTTPS. Third parties cannot see which pages you open.
• Links: Links to other sites, such as the App Store, posan.de or OpenStreetMap, lead to whoever runs them. Your browser only connects there once you follow a link. Their privacy rules apply there.

14. Sharing, exporting and links

The app creates GPX files, backup files, calendar files and PDFs on your device. You decide where they go via the share sheet. Anyone who receives them applies their own privacy rules. If you tap a link in the app (for example to an official travel advice page), it opens in your browser, and that site's privacy policy applies.

15. No selling, no ads, no automated decisions

We don't sell data, show no ads, build no profiles and make no automated individual decisions within the meaning of Art. 22 GDPR.

16. Retention at a glance

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Write to us at kontakt@posan.de.

Data that is only on your device or in your iCloud is in your own hands: you can view, change, export (backup file, GPX) and delete it in the app. We have no access to it and therefore can't provide information about it.

You can withdraw permissions you gave in iOS (location, analytics for app developers) at any time in iOS Settings.

18. Complaint to a supervisory authority

You can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Maternistraße 17, 01067 Dresden, Germany, datenschutz.sachsen.de.

19. Do you have to provide data?

No. You don't have to give us any data. Without an internet connection, the app loads no detailed map and no new routing regions. Without location permission, it doesn't show your location. Everything else works without either.

20. Changes

We update this policy when the app gets new features or the law changes. The version published here applies.