RouteGems
← All legal documents

Privacy Policy

Last updated: 9 November 2026

In simple terms: we collect what we need to run RouteGems: your account details, your routes and your subscription status. We don't sell your data, we don't run advertising, and we delete your data 180 days after your account becomes inactive. If you delete your account yourself, everything that identifies you goes at once; the only thing we keep is the reason you gave for leaving, if you gave one, with nothing that links it to you.

RouteGems Limited ("RouteGems", "we") is the data controller for personal data processed through routegems.cc and the RouteGems app for iOS and Android, registered with the Information Commissioner's Office under registration reference ZC196421. Contact us about privacy at support@routegems.cc.

1. What we collect

Account data: email address, password (stored only as a secure hash), your real name, country, and whether and when you consented to marketing. We record when your email address was verified. If you ask to change your email address, we hold the new address you asked for, alongside a hashed one-time token, until you confirm it or the link expires (24 hours).

Device connections: if you choose to connect a device platform account (for example Wahoo), we store the connection tokens needed to act on your behalf (encrypted at rest) and a record of the routes you send.

Profile and preferences: optional public username, riding speed, default stop types and search radius, units, and similar planner preferences.

Routes and activity: routes you create or upload (including GPX/TCX/FIT files), stops, notes, projects, and snapshots. Route data is location data: your collection of routes can reveal where you ride from and to. We treat it as personal data and protect it accordingly.

Subscription and payment data: your subscription tier and status, and who bills it. On the website, payments are handled by Stripe; in the app, by Apple (App Store) or Google (Google Play). We never see or store your full card details. For a plan bought in the app we receive, through RevenueCat (section 3), the plan, its status and renewal dates, and the store's reference for the purchase; not your Apple or Google account details, and not how you paid.

AI Assistant queries: if you use the AI Assistant, the text you submit is processed to answer your request (see Section 4). We do not build advertising or training datasets from your queries.

Technical data: server logs (IP address, request details, timestamps) for security, rate-limiting and troubleshooting; approximate last-active time on your account.

Account deletion feedback: when you delete your account we ask, optionally, why you're leaving: a reason from a short list and a note of up to 500 characters. We store the answer with no account id, email address or anything else that links it to you, and we ask you not to put personal details in the note.

We do not use advertising trackers or third-party analytics cookies (see the Cookie Policy).

2. Why we process it (legal bases)

  • To provide the Service (contract): accounts, routes, subscriptions, support.
  • Security and abuse prevention (legitimate interests): logs, rate-limiting, email verification, fraud prevention.
  • Service emails (contract/legitimate interests): account verification, password resets, a notice when your password is changed, the confirmation link and notice when you change your email address, a confirmation when you delete your account, and subscription and trial notices. These are not marketing.
  • Marketing emails (consent): only if you opt in. You can withdraw consent at any time in Settings or via the unsubscribe link; we record when consent was given or withdrawn.
  • Legal obligations: tax and accounting records relating to payments.

3. Who we share data with (processors)

We use a small number of service providers to run RouteGems:

  • Stripe: payment processing on the website. Your payment details go directly to Stripe. See Stripe's privacy policy.
  • RevenueCat: manages subscriptions bought in the app. When you buy or restore a plan, the app sends RevenueCat the store's record of the purchase together with your account ID (a random identifier, not your name or email address); RevenueCat checks it with Apple or Google and tells us which plan is active. RevenueCat keeps that purchase history for us as part of our payment records.
  • Apple and Google: if you subscribe in the iOS or Android app, Apple (App Store) or Google (Google Play) takes the payment and handles billing, renewals, cancellation and refunds. They do this as independent controllers under their own privacy policies, and they do not share your payment details or account details with us.
  • Anthropic: powers the AI Assistant. Your query text is sent to Anthropic's API to generate a response. Anthropic does not use our API data to train its models. We do not send your account details with queries.
  • Google Workspace: sends our transactional email (verification, password resets, service notices).
  • Map, geocoding and data services: map tiles load in your browser, or in the app, directly from their providers (OpenFreeMap, which serves OpenStreetMap data; OpenTopoMap; Esri), which means those providers receive your IP address and the map areas you view, under their own privacy policies. Place-name search is proxied through our servers to the Photon geocoder, so the geocoder sees our server's address, not yours. Amenity data comes from the Overpass API via our servers.
  • Wahoo Fitness: only if you connect your Wahoo account. Connecting uses Wahoo's own sign-in (we never see your Wahoo password); we store the resulting access tokens encrypted, and use them solely to send routes you explicitly choose to send (route name, geometry, elevation and your chosen stops). What Wahoo does with routes in your Wahoo account is governed by Wahoo's own privacy policy. Disconnecting in your account settings deletes our stored tokens.
  • Hosting: the Service and its database are hosted on infrastructure in the United Kingdom.

We do not sell personal data, and we do not share it with advertisers.

4. AI Assistant

When you use the AI Assistant, the text you type is sent to our AI provider (Anthropic) to interpret your request. Results are generated from our own amenity and route data. We do not store your conversations server-side beyond normal short-lived logs, and our provider does not train on this data. Please don't include sensitive personal information about yourself or anyone else in queries; it isn't needed for any feature to work.

On the Ultra plan, exporting a ride sheet ("Export File") for one of your own routes also uses our AI provider, to write the sheet's briefing. For that, the details of that ride are sent to Anthropic: the route's name, length and climb, the start time and speed you chose, each stop's name, type and opening hours, and the weather forecast along the ride. Your notes on stops, your account details and your location are not sent, and a briefing is kept on our servers for a few hours so that the same sheet is not written twice.

5. The RouteGems app

The app for iOS and Android uses the same account and the same servers as the website, so everything in this policy applies to it. In addition:

  • Your location stays on your phone. If you allow it, the app uses your phone's location only while the app is open: to show where you are on the map and, in ride mode, how far you are along the route and from the next stop. Your location is not sent to us or to anyone else, and the app never asks for it in the background. How far you have got along a route is saved on your phone, so a ride can be picked up again, and nowhere else.
  • What is kept on your phone. Your sign-in is kept in the phone's secure storage (the iOS Keychain, or Android's Keystore), and routes you open are kept on the phone so they still work without signal. Signing out removes the sign-in; deleting the app removes everything it kept.
  • Files. A GPX, TCX or FIT file you open in the app is uploaded to make a route, as it is on the website. A route you export is written on your phone and handed to the app you choose to share it with.
  • No tracking. The app contains no advertising, analytics or crash-reporting code.
  • Permissions. Location, as above, and nothing else: no contacts, camera, microphone or photos.
  • Trying the demo. You can look round a demo route in the app without an account. We ask for nothing about you to do it and store nothing about you. Like any request it reaches our servers from your IP address (see Technical data above), and we count how often the demo is used as a total, with nothing that identifies you or your phone.
  • Subscriptions. A plan bought in the app is paid to Apple or Google, and RevenueCat confirms it to us (section 3). Manage or cancel it in your Apple or Google account's subscription settings; deleting the app does not cancel it.

6. International transfers

We aim to keep personal data in the UK/EEA. Some providers (for example Stripe, RevenueCat and Anthropic) may process data in the United States; where they do, transfers are protected by UK-recognised safeguards such as the UK Extension to the EU-US Data Privacy Framework or the ICO's International Data Transfer Agreement / EU Standard Contractual Clauses.

7. How long we keep data

  • Active accounts: for as long as your account exists.
  • Inactive accounts: when your subscription ends, your account becomes inactive. We keep it for 180 days so you can reactivate, then delete the account, routes, files and profile. Records we must keep by law (for example payment records for tax) are kept for the legally required period.
  • Verification, password-reset and email-change tokens: short-lived (hours; email-change links 24 hours) and single-use; only hashes are stored. Asking for a new email-change link retires the previous one.
  • Sign-in (refresh) tokens: one row per signed-in browser or app, holding a hash of the token, which kind of client it is ("web" or "mobile"), when it was issued and when it expires, but never the token itself. Each is single-use: using it replaces the row with a fresh one, so a session is a short chain rather than one long-lived key. A sign-in you asked us to keep lasts up to 90 days at a time and at most a year in total; one you didn't expires within a day of your last visit and at most a week in total. Signing out, changing your password and deleting your account all end them immediately, and spent or expired rows are deleted automatically (spent ones within a week).
  • Server logs: kept for a short rolling window for security and troubleshooting.
  • Marketing consent records: kept as evidence of consent while your account exists.
  • Device connection tokens: deleted immediately when you disconnect the platform, and with your account. Routes already sent to a platform remain in your account there (they're yours), under that platform's terms.
  • Deletion feedback: the anonymous reason and note, if you gave one, are kept after your account is erased, indefinitely, because they contain nothing that identifies you. We keep them to understand why riders leave.

You can delete your account and data sooner at any time, yourself, in Settings → Privacy & sharing, without needing to ask us. We email a confirmation to the address on the account, and we ask (optionally) why you're leaving; that answer is kept without anything that links it to you.

8. Your rights

Under UK data protection law you have the right to access your data, correct it, delete it, restrict or object to processing, take your data elsewhere (portability), and withdraw consent.

Two of these are self-service, in Settings → Privacy & sharing: *Download my data* gives you everything we hold about your account as a ZIP (every route as a GPX file, plus a readable summary of your profile, stops and projects), and *Delete my account* erases everything linked to you and sends a confirmation to the address that was deleted. In the app, *Delete my account* is under Settings. The only thing that remains is the anonymous reason described in section 1, if you gave one. (You can also export any individual route as GPX or FIT from the planner.)

For anything else, email support@routegems.cc. We will respond within one month. If you're not happy with our response, you can complain to the Information Commissioner's Office (ico.org.uk).

9. Security

Passwords are stored only as strong one-way hashes. Access to the Service is over HTTPS. Reset, verification and email-change tokens are stored hashed, expire quickly, and are single-use. Changing your password signs you out of every other device. Changing your email address takes effect only when you confirm the new address from a link sent to it, and we tell the old address that it is happening. Access to production systems is restricted and logged.

10. Age limit

RouteGems is for adults: you must be 18 or over to create an account, and we do not knowingly collect data from anyone under 18. If you believe someone under 18 has created an account, contact us and we will delete it.

11. Changes

We will post changes here and update the date above. For significant changes we will notify you by email or in the Service.

RouteGems Limited, company number 17318079, ICO registration ZC196421. Registered office: 3 Bellibone Gardens, Old Buckenham, Attleborough, NR17 1SX. Contact: support@routegems.cc