Privacy

What Vamoto stores, and who else sees it.

Datenschutzerklärung.

Last updated 2026-09-04.

What stays on your device

On the web, planned routes, imported GPX rides, saved places, your POI selection, the device id and the browser's session token live in localStorage under vamoto.* keys. Clearing this site's data removes all of it.

In the app, the region packs, the basemaps, your routes, your recorded rides and every setting are stored on the phone. Routing runs on the phone itself, offline. Online features (place search, map downloads, sign-in and sync, sharing and friends) send data as described below.

What we store when you sign in

The sync server is a Cloudflare Worker with a D1 database, running on Cloudflare's network. These are the records it keeps about you:

• Sign-in identities: the provider (Apple, Google, GitHub, e-mail or passkey), your id at that provider, and the verified e-mail address the provider returns. That address is used for two things only: as the key that merges your sign-in methods into one account, and to send login codes.
• Account: your handle, your display name, and whether your rider page is public.
• Sessions: device name, platform, when the session was created and when it was last seen. You can revoke any of them on the Account page.
• Routes and rides: the planned routes and ridden tracks you sync. The geometry is the data: it says where you rode and when.
• Shares: the token of every share link you create, and a privacy seed per share (see below).
• Synced settings: your home and work places, your starred places, the hide-home flag, the rides map layer and the planner's target distance.
• Entitlement: the end date of your trial.
• Invites: Vamoto is invite only, so the allowlist of e-mail addresses and GitHub logins the owner entered is stored on the server.
• Passkeys: the public key and the label of each device you registered.
• Login codes: a hashed 6-digit code with a 10 minute lifetime, plus short-lived hashed rate-limit keys.
• Home zone: Your home zone syncs with your account. When home hiding is on, parts of shared rides inside it are hidden, including the start and end. You can change its shape under Settings > Privacy. Your own rides stay complete.
• Feature grants: which optional features are unlocked for your account.

Deleting your account (Account > Your data > Delete account) removes all of it on the server, with no undo.

How you sign in, and why there is no password

You sign in with Apple, with Google, with GitHub, with a passkey, or with a 6-digit code we e-mail you. The code is valid for 10 minutes and allows 5 attempts; it is delivered by Resend from login@vamoto.app.

Vamoto has no password of its own for you to reset. If you have linked only one sign-in provider, you may be unable to sign in when it is unavailable. In the Vamoto app, add another method to the same account under Account > Sign-in methods. On the website, you can review and remove linked methods.

Public share links and your home

When home protection is enabled and your home has been synced, we hide the parts of publicly shared rides that lie inside your home zone, including the start and end. You can change the zone's shape under Settings > Privacy.

This is the setting privacy.hide_home, enabled by default. Your own stored data and exports remain complete; only the public version is trimmed. Without a synced home address, there are no affected sections to hide.

Live position

While you use "route via my phone", your phone posts {lat, lon, accuracy_m, t_ms} through a relay so the browser can draw where you are. It is relayed, not archived.

Friends

A friendship is a pair of account ids and nothing else. You add a friend by their friend code, either by scanning it in the app or by opening the link vamoto.app/f/<code>, which sends a request the other rider accepts or declines. Either of you can remove the friendship at any time, and removing it ends it for both.

While a ride is active or the app's map is in the foreground, and you have position sharing on, accepted friends can see roughly where you are: your position is rounded before it is stored, visible for 15 minutes, and shown only to friends within 200 km of you. This is the setting friends.share_position. With privacy.hide_position_near_home on, positions near home still reach the server, which does not publish them. With home protection on and no home place set, nothing is published at all.

Hazard reports

A hazard report is public to every other rider and carries no name: its type, its position, the road it sits on and when it was filed and expires. Your account id is stored with it so a pattern of abuse can be acted on; it is never shown to anyone else and it goes when the report goes. Reports expire by their type and are deleted seven days after that.

Invitations

Vamoto is invite only for now. When you sign up through an invite link, we record which link you used and therefore who invited you, so the person who invited you can be credited. Opening a link changes nothing; only signing up does.

Beta applications

If you apply, we store your email, phone platform and any model you provide, nearest town or city and approximate coordinates, expected riding distance, riding types, navigation setup, apps and motorcycles. We also record the form language, referral source, consent, application status and relevant dates. We use this information to select a varied group of testers and send application confirmations and invitations.

Only the Vamoto admin reviews your application. Cloudflare Turnstile checks that the form is sent by a person; Cloudflare acts as a processor. Resend delivers the emails. We do not share your application beyond the service providers needed to operate the form and send its emails, and we do not sign you up for a newsletter.

We delete new or declined applications 90 days after the last change, and invited applications 90 days after the invitation. We also delete your application on request or when you delete the Vamoto account using that email address. To request deletion, write to support.

Recorded rides

A recorded ride is stored twice: a small preview of a few hundred points that lists and maps the ride, and the full recorded trace, which is what a GPX export and the detail charts are built from. Both hold position and time, and, where your phone measured them, speed, altitude and lean angle. They stay yours until you delete the ride or the account.

A ride becomes readable without an account only through a share link you create, and only that ride. A public read carries no top speed and no lean angle, on a shared ride and on your rider page alike. The trimming described above applies to a shared track too.

Routing on a server

The app computes routes on your phone. Guests see only a precomputed web preview. Administrators and accounts with explicit server-routing access may send a route request through Vamoto's Cloudflare Worker to our routing service; ordinary signed-in users need their phone connected and have no automatic server fallback. The service receives the request's waypoints and settings, but not your Vamoto account identity. Vamoto does not log request geometry.

Third parties

Online place searches, waypoint names and the places layer use Vamoto’s own search service via our sync server. Depending on the request, we send the search text and map centre, waypoint coordinates or the visible map area. These requests do not go to third-party geocoders.

Your browser or app talks to:

• GitHub (github.com): your handle, to fetch your avatar, only if you signed in with GitHub.
• Google: Google sign-in and Android system services, including location support. Depending on your device settings, these services may contact Google even when you do not use Google sign-in. See Google’s privacy policy.
• Apple: on supported Apple devices, features using Apple system services are subject to Apple's privacy policy and your system settings. If you use Sign in with Apple, Apple confirms your identity to Vamoto and may pass on your name and an e-mail address, which can be a private relay address.
• Cloudflare: this site, the sync API, the live-position relay, and the region packs and map tiles under tiles.vamoto.app.
• Cloudflare Turnstile: checks that beta applications are submitted by a person; Cloudflare processes technical browser and connection data for this check.

Our server talks to:

• Resend: to deliver your login code.
• Apple, GitHub and Google: the token exchange while you sign in.

Vamoto does not add advertising networks or product-analytics trackers. Fonts are bundled or served from this site. This does not exclude the platform and SDK diagnostics described above.

Depending on the platform, enabled feature and system settings, Google or Apple services may process account, device, technical or location-related data in their datacentres, including outside the EU/EEA. The providers describe the purposes, locations and applicable international-transfer safeguards in their privacy policies. Local route computation does not mean that sign-in, platform services or optional online features never contact a provider. This notice is not consent to unrelated processing.

The app

Vamoto for Android and iPhone calculates routes on your phone with installed map data. Map and region downloads contact Vamoto storage operated by Cloudflare; this sends your IP address and requested resource. Updates come through Google Play and the App Store. With your permission, a serious app failure may send a bounded crash report containing only the rounded hour, app version/build, platform, failure kind, Vamoto source-frame identifiers and a fingerprint. It never includes an error message, breadcrumbs, coordinates, routes, rides, screenshots, logs or account identity. Support operators may read or delete these privacy-minimized reports; they are retained for 30 days. Vamoto adds no advertising or product-analytics trackers. Spoken directions use your phone's text-to-speech engine; a network voice chosen in the phone's settings may send the spoken text to its provider.

Retention

• Login codes: valid for 10 minutes; deleted by the nightly cleanup, at the latest about a day after creation.
• Sessions: until you revoke them or delete the account.
• Routes, rides, shares, settings, passkeys: until you delete them, or until you delete the account.
• Hazard reports: they expire by their type and are deleted seven days after that, together with the account id stored with them.
• Live positions shared with friends: visible for 15 minutes; deleted by the nightly cleanup.
• After account deletion: your released handle and account id are kept for 30 days so a bookmarked rider page cannot pass to someone else; then deleted.
• Sign in with Apple: the token needed to revoke Vamoto's access at Apple is kept encrypted until Apple confirms revocation, at most 30 days after account deletion.
• Technical logs on the routing server: they rotate.
• Privacy-minimized crash reports: 30 days; they are not stored with an account or IP address.

Delete your account

App: Settings > Account & sync > Delete account. Web: Settings > Account > Delete account. Type your handle to confirm. If your account uses Sign in with Apple, deletion first asks for one more confirmation with Apple. Deletion is immediate and irreversible: all server data is removed, including routes, rides, shares, friends, settings, sign-in methods, sessions and passkeys, except your handle and account id (30 days) and the encrypted Apple revocation token (until revoked, at most 30 days). Uninstall the app to remove phone-only data.

Apple sign-in: we revoke access; deletion waits for your confirmation with Apple. You can also remove Vamoto in Apple ID settings under “Sign in with Apple”. Crash reports have no account link and expire after 30 days. Cannot sign in or no longer have that Apple ID? E-mail support from your signup address for deletion.

Your rights (DSGVO / GDPR Art. 15-21)

Access, correction, deletion, portability: "Export my data (JSON)" and "Delete account" on the Account page do the first and the third yourself, right now. For anything else, write to the contact below.

You can also complain to a supervisory authority. For Vamoto that is the Austrian Datenschutzbehörde, dsb.gv.at.

Lost access?

There is no password, so there is no password reset. If you can no longer use any of your sign-in methods, write to support from the e-mail address you signed up with. Once we have established that it is you, we attach a new sign-in method to your existing account. Your routes and rides stay where they are.

Contact

Name

Mario Roither

E-mail

Show e-mail address