Privacy Policy
Serpavo works without an account and keeps your location, rides and routes on your iPhone. This policy explains what the app and this website process and why.
1. Controller
Dennis Donner
Eduard-v-Winterstein-Straße 11
14480 Potsdam
Germany
Email: app-support@donner.io
I am a sole proprietor and am not required to appoint a data protection officer.
2. Summary
- No account, no tracking: Serpavo has no sign-in, no analytics, no advertising and no crash-reporting SDK.
- On your iPhone: your location, the motion sensor readings, your routes and your recorded rides are processed and stored on your iPhone. I receive none of this data.
- Offline routing: place search, route calculation and navigation run on your iPhone with the map package you downloaded.
- The only network traffic of the app is downloading and updating map packages from Serpavo’s download server.
- Exports: a ride leaves the app only when you export or share it as a GPX file.
3. Data stored on your iPhone
| Data | Purpose | Where and how long |
|---|---|---|
| Recorded rides: track points with position, time, altitude, speed and lean angle; name, date and whether the ride was recorded or imported | Ride list, ride review, GPX export, riding it again | App container on your iPhone, protected by iOS file protection; until you delete the ride or the app |
| Saved routes: the calculated route, its title and date | Opening a planned route later, offline | App container on your iPhone, protected by iOS file protection; until you delete the route or the app |
| Settings: units, voice prompts, default route profile, night mode, map style while riding, Wi-Fi-only downloads, onboarding and safety notice confirmed | Remembering your choices | App settings on your iPhone; until you delete the app |
| Map packages and their download state, including the time of the last update check | Map, place search and routing without reception | App container on your iPhone, excluded from iCloud and computer backups; until you delete the region or the app |
If you use iCloud Backup or back up your iPhone to a computer, iOS includes rides, routes and settings in that backup. Apple processes iCloud backups under its own responsibility and according to your Apple account settings; I have no access to them. Map packages are not included in backups and can be downloaded again.
The legal basis for processing in the app is the performance of the contract of use (Art. 6(1)(b) GDPR), because these functions are what you use the app for.
4. Location
Serpavo asks for access to your location while using the app. It uses your precise position to show you on the map, as the start of a route or round trip, for navigation and rerouting, to record your ride and to calculate sunrise and sunset for the automatic night mode.
During a ride — from the moment you start navigation until you end it — Serpavo keeps receiving your position when the screen is locked or another app is in front, so guidance and recording continue. iOS shows this with the location indicator in the status bar. Outside a ride, location updates stop as soon as the app leaves the screen. Serpavo does not ask for “Always” access.
Your position is processed only on your iPhone and is never sent to me or to anyone else. iOS determines the position with GPS and, depending on your settings, Apple’s location services; Apple’s privacy policy applies to those.
5. Motion sensors and lean angle
During a ride and in the mount check, Serpavo reads the accelerometer and gyroscope of your iPhone to estimate the lean angle of your motorcycle. The estimate is shown live and stored with each track point of the recorded ride, so the ride review can show your maximum lean angle.
The sensor readings are processed only on your iPhone. Serpavo does not read activity, step or fitness data.
6. Navigation and voice prompts
Routes are calculated on your iPhone by the open-source route engine Valhalla, using the road data in the installed map package. Rerouting after a missed turn also happens on the device. The map is drawn by MapLibre Native from the same package.
Voice prompts are spoken by the speech synthesis built into iOS on your iPhone; their text is not sent anywhere. While a ride is running, the screen stays on, and voice prompts can lower other audio while they speak if you allow this in the settings.
7. Place search
The search for destinations — towns, villages, passes, peaks and other places — looks only in the place list contained in the installed map package. What you type stays on your iPhone.
8. Downloading map packages
Map packages are only downloaded when you install a region in Offline maps, and installed regions are kept up to date: at most once a day, the app checks whether a newer version of your installed packages is available and installs it. By default, downloads and updates only use Wi-Fi; you can allow mobile data in the settings. Downloads use iOS background transfers, so they can finish while the app is closed.
Packages are loaded over an encrypted HTTPS connection from Serpavo’s download server. To deliver them, the server necessarily processes your IP address, the date and time, the requested file (which reveals the region) and the user agent of the download. No account, device identifier or location is sent. The app verifies every package on your iPhone before installing it.
Legal basis: performance of the contract of use (Art. 6(1)(b) GDPR) for the download you request, and my legitimate interest in a secure and working delivery of updates (Art. 6(1)(f) GDPR). Server logs are kept only as long as needed for operation and security.
9. GPX export, sharing and import
When you export or share a ride, Serpavo creates a GPX file with the ride’s name and time and every track point’s position, altitude, time, speed and lean angle. You decide where it goes — for example to the Files app, AirDrop, another app or a person. From then on, the processing by that app or recipient is subject to their terms; Serpavo itself sends nothing.
When you import a GPX file, Serpavo reads it on your iPhone and stores it as an imported ride in your ride list.
10. What Serpavo does not do
- No account and no sign-in; there is no Serpavo cloud.
- No analytics, no tracking across apps or websites, no advertising identifiers and no advertising.
- No third-party SDKs that collect data and no crash-reporting service.
- No push notifications.
If you turn on Share With App Developers in iOS Settings → Privacy & Security → Analytics & Improvements, Apple shares crash reports and diagnostic data of Serpavo with me. This is controlled by Apple and by your iOS setting; I use these reports only to fix errors.
Apple distributes the app through the App Store. Apple processes the data needed for this, such as your Apple account and download, under its own responsibility.
11. Map data and open-source software
The map packages are built from OpenStreetMap data (© OpenStreetMap contributors, Open Database License), OpenMapTiles (CC BY 4.0), Natural Earth (public domain) and elevation data from the Mapzen Terrain Tiles (including SRTM by NASA and USGS). The packages themselves are made available under the ODbL.
The app uses open-source software including MapLibre Native (BSD-2-Clause), Valhalla and valhalla-mobile (MIT), Planetiler (Apache 2.0) to build the packages, Boost (BSL 1.0), Protocol Buffers (BSD-3-Clause), LZ4 (BSD-2-Clause), Abseil (Apache 2.0), RapidJSON, date and ankerl::unordered_dense (MIT) and the Noto Sans font (OFL 1.1). All of these run on your iPhone or on my build system; none of them sends personal data to their authors. The full list is in the app under Settings → Licenses.
12. Contact and support
If you email me at app-support@donner.io, I process your address, your message and whatever you include (for example your iPhone model and iOS version) to answer you. Legal basis: Art. 6(1)(b) GDPR for questions about the app you use, otherwise my legitimate interest in answering (Art. 6(1)(f) GDPR). Please do not send GPX files of your rides unless I ask for them to reproduce a problem.
13. This website
serpavo.donner.io is a static website. It sets no cookies, uses no analytics or tracking, has no forms or embedded content and loads fonts, images and scripts only from its own server. No cookie banner is needed for that reason.
When you click EN or DE, the site stores your choice under the key serpavo-lang in your browser’s local storage, and the English start page reads it (or your browser language) to show the German version. The value never leaves your browser; you can delete it with your browser data.
To deliver the pages, the web server processes your IP address, date and time, the requested address, the referring page and your browser’s user agent. Such server logs serve operation and security only and are deleted by the hosting configuration. Legal basis: my legitimate interest in a secure website (Art. 6(1)(f) GDPR). Links to the App Store lead to Apple, where Apple’s privacy policy applies.
14. Recipients
| Recipient | Purpose | Data |
|---|---|---|
| Apple Inc. / Apple Distribution International Ltd. (privacy policy) | App Store, iOS location services, iCloud Backup if you use it, crash reports if you share them | As described by Apple; crash reports and diagnostics only with your iOS setting |
| Hosting provider of the download server | Delivering map packages | IP address, time, requested file, user agent |
| Web host and email provider | Website delivery and support email | Server logs, emails |
The hosting and email providers act as processors under data processing agreements where the GDPR requires one. Apple acts under its own responsibility. Personal data is not sold.
15. Transfers outside the EU
Apple is or belongs to a US company, so access from the USA cannot be ruled out. Where a provider transfers personal data outside the EU, this relies on the EU–U.S. Data Privacy Framework where the company is certified, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).
16. How long data is kept
- On your iPhone: until you delete a ride, a route or a map region, or remove the app. Copies in your iPhone backups follow your backup settings.
- Logs of the download server and the website: only as long as needed for operation and security.
- Crash reports shared through Apple: only as long as needed to fix the error.
- Support emails: deleted when your request is closed, unless commercial or tax law requires them to be kept longer.
17. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw a consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where processing relies on legitimate interests, you can object at any time for reasons arising from your particular situation. Email app-support@donner.io.
Because there is no account and your rides stay on your iPhone, I hold no app data about you; you can view, export and delete it yourself in the app. You can also lodge a complaint with a supervisory authority, for example the one responsible for me:
Brandenburg Commissioner for Data Protection and Access to Information (Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg)
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany
18. Children
Serpavo is not directed at children under 16. I do not knowingly process personal data of children.
19. Permissions and how to revoke them
- Location (map position, navigation, recording, night mode): iOS Settings → Serpavo → Location. Navigation needs “While Using the App” and Precise Location.
- Mobile data for map downloads: Serpavo’s settings (Wi-Fi only) and iOS Settings → Serpavo → Mobile Data.
Revoking a permission only switches off the feature that needs it; your rides and routes are not affected. To delete a ride or a saved route, swipe it to the left in the list; regions are deleted in Offline maps. Deleting the app removes all its data from your iPhone.
20. Security
Rides and routes are protected by the data protection of iOS when your iPhone has a passcode. Map downloads use encrypted HTTPS connections, as does this website. Because your rides are not on a server, they cannot leak from one. Keep exported GPX files as safe as the rides themselves — they show where and when you rode.
21. Changes to this policy
I update this policy when the app or the legal situation changes, for example before the download server goes into operation with a named hosting provider. The current version is always available at serpavo.donner.io/privacy/.