Privacy Policy

In short

Who is responsible

ScoutRoute is developed by Marco Lüthi, the controller responsible for data processing under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Marco Lüthi
Gutstrasse 172
8055 Zürich
Switzerland
hi@luthi-mar.co

Data stored on your iPhone

The routes you save, the rides you record (tracks, ride summaries and place names), the rider name you enter and your app settings are stored locally on your iPhone. They are not sent to the developer or to any server. They may be included in your iPhone backups, depending on your own iCloud or computer backup settings. Deleting the app deletes this data.

Location

With your permission (“While Using the App”), ScoutRoute uses your precise location to show where you are on the map, to guide you along a route and to record the rides you choose to save. While you navigate or record, location continues in the background so guidance and recording work with the screen locked. You can change this permission at any time in the iOS Settings app.

Apple Maps and Apple Weather

To calculate routes, search for places and gas stations, show place names and check the forecast along your route (Rain Watch), ScoutRoute uses Apple's MapKit and WeatherKit services. For this, the relevant locations and search terms are sent directly from your iPhone to Apple. The developer does not receive this data. Apple processes it under its own privacy policy: apple.com/legal/privacy.

Group rides

Group rides are optional. When you start or join one, ScoutRoute shares the following with the other riders in that group:

• the name you enter and a random rider ID generated by the app,
• your position, course, speed and the time of the update,
• the route you are navigating (so others can use Ride Along), and
• any requests you send, such as “Need Fuel” or “Pull Over”.

This data is transmitted through the app's database in Apple iCloud (CloudKit). It is end-to-end encrypted (AES-GCM) with a key that exists only in the group's invite link or QR code. Without the invite, neither the developer nor Apple can read it. To find the right records, the database also stores a one-way hash of the group key. To share your own position you need to be signed in to iCloud on your iPhone. iCloud attaches an app-specific identifier to the records you create; it does not reveal your Apple Account, name or email to the developer.

When you leave a group ride, your records are deleted from the database. Riders who haven't sent an update for an hour are no longer shown, and a group ride session ends after 24 hours. If a ride ends without you leaving it, for example because the app was deleted during the ride, your last encrypted record may stay in the database. It stays unreadable to anyone without the invite link.

Anyone you give the invite link or QR code can join the group and see the shared data, so only share it with people you ride with.

Sharing routes

When you share a route as a link, QR code or GPX file, the route itself is packed into that link or file. It is not uploaded anywhere. It goes only to the people and apps you choose in the iOS share sheet. Files you import (GPX) are read on your iPhone.

Legal basis

Where the GDPR applies, the processing described above is necessary to provide the features you use (Art. 6(1)(b) GDPR). Location access and group rides are based on your choice to enable them, which you can withdraw at any time by changing the location permission or leaving the group ride. Under the Swiss FADP, we process personal data only as described here and in line with its principles.

What ScoutRoute does not do

• No account, sign-up or login.
• No advertising, analytics, crash-reporting or tracking SDKs.
• No tracking across apps or websites, and no selling or sharing of data with data brokers.

This website

This website is a static site without cookies, analytics or tracking. Fonts are served from this website itself, so your browser does not contact third-party font services. When you visit a page, the website's hosting provider (hosted in Switzerland or the EU) automatically records technical access data in server logs: your IP address, date and time, the requested page, referrer and browser type. This is needed to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). The logs are deleted after a short period. Links to the App Store take you to Apple, where Apple's privacy policy applies.

Your rights

You have the right to request access to your personal data and to have it corrected or deleted, to object to or restrict processing, and to data portability. Because the apps store your data on your device and do not identify you, the developer usually holds no personal data about you. Most of it you can delete yourself by deleting the app.

To exercise your rights, email hi@luthi-mar.co. You can also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the data protection authority of your country.

International transfers

Apple may process data in the United States and other countries. Apple describes the safeguards it uses for these transfers, such as the Data Privacy Framework and standard contractual clauses, in its privacy policy.

Children

ScoutRoute is a navigation app for adults and is not directed at children.

Changes to this policy

If the app starts handling data differently, this page will be updated before the change ships, and the date at the top will change.