Overview
Last updated: October 9, 2026
Data We Collect
PedalPilot handles the following data:
- GPS location — used in real time to show your position on the map, calculate routes, and provide turn-by-turn navigation. Route/search requests send only the coordinates needed for the requested action and are not linked to an account.
- Ride history — completed routes (distance, duration, elevation) are stored locally on your device to personalise your estimated travel times. If you enable Apple Health sync, completed ride summaries are written to Apple Health.
- Saved places — home address, work address, and favourite destinations you save are stored locally in the app's private storage on your device.
- Bike profile settings — bike type, width, and eBike status are stored locally to improve route suggestions.
- Usage and diagnostics — The versions listed below use minimal automatic error reports. Older versions can also send usage events and ride measurements. See the platform- and version-specific explanation below.
Third-Party Services
PedalPilot uses the following services to provide its core functionality. When you search for a destination or request a route, the necessary search text and coordinates may pass through the PedalPilot Cloudflare Worker proxy and the relevant provider:
- GraphHopper (graphhopper.com) — calculates certain cycling routes and route alternatives. Its API policy states that request bodies (including route coordinates), headers, IP addresses and timestamps are retained for up to five weeks. Privacy Policy
- BRouter (brouter.de) — calculates certain bike and trail routes. Its policy states that request logs, including routing coordinates and IP addresses, are kept for two weeks, with an additional ten days in hosting backups. Privacy Policy
- LocationIQ (locationiq.com) — powers place and address search plus reverse geocoding. Privacy Policy
- OpenFreeMap (openfreemap.org) — provides map styling and vector tile delivery directly to your device. Tile requests reveal the viewed map area and connection information. Its policy describes temporary IP logging during security incidents for up to 30 days. Privacy Policy
- UNPKG (unpkg.com) — delivers the MapLibre map software and stylesheets over Cloudflare’s network. These fixed asset requests include connection information, but do not contain your search text or route coordinates. Service information
- OpenStreetMap contributors — map data is © OpenStreetMap contributors, available under the ODbL license.
- Cloudflare (cloudflare.com) — hosts the PedalPilot API proxy used for provider key protection, caching, service reliability, and usage events from the older versions described below. Privacy Policy
- Sentry (sentry.io) — provides crash and error reporting so we can diagnose reliability issues. Privacy Policy
No PedalPilot account is required. Online requests include search text, relevant coordinates and routing options. Direct connections expose your IP address and technical request information to the receiving service. For requests sent through our proxy, upstream providers receive the necessary request content and technical connection information, which can include your IP address depending on the request path; an account-free app does not make these requests completely anonymous. Route and search results may be temporarily cached to improve response times and reduce repeated requests.
Our Cloudflare proxy uses configured cache lifetimes of 24 hours for search and reverse-geocoding results and 120 seconds for routing results. Cache entries can include search text and coordinates. These cache lifetimes are separate from provider request logs and other security or diagnostic records; they are not a promise that all request data is deleted at the same time.
PedalPilot sends these service requests to provide navigation and support reliability, not for advertising or advertising tracking. Service providers can retain request data as described above even though your saved ride history stays on your device.
Some providers also process request information for their own service quality and security purposes. GraphHopper uses retained API requests to detect misuse and improve its API; BRouter uses request logs to maintain service quality. LocationIQ records API usage statistics and IP addresses for abuse prevention. Cloudflare processes our request content on our behalf, while also processing network information such as IP addresses, request volumes and error rates for its own network operation, improvement and security. Removing app usage reports does not remove this service-side processing.
Location Permission
PedalPilot requests “While Using the App” location access so it can show your position, calculate routes, record rides, reroute, and provide turn-by-turn navigation. If you start navigation while the app is open, iOS may continue location updates in the background so route progress and voice guidance work while the screen is locked. This background session ends when you arrive or stop navigation. PedalPilot does not request Always location access and does not use background location outside an active route.
On Android, starting navigation while the app is visible starts a location foreground service with an ongoing notification. It maintains location updates during that ride, including while the screen is locked, and ends when navigation stops or you arrive. PedalPilot does not request the separate Android background-location permission.
You can revoke location permission at any time in your device Settings. Without location access the navigation features will not work, but the app can still display maps.
Apple Health
Apple Health sync is optional and off by default. If you enable it, PedalPilot writes completed cycling workout summaries such as distance, duration, and estimated energy to Apple Health. PedalPilot does not read your Apple Health data.
Data Sharing
We do not sell, rent, or share personal data for marketing or advertising. The app has no advertising SDK and displays no ads.
Your saved ride history, recorded GPS tracks, saved places and preferences are stored on your device. PedalPilot does not provide account-based cloud synchronization. If you export or share a route or backup, you choose its destination. Using a saved place for an online search or route sends the necessary request information to the relevant services.
Older versions: iOS 1.9.4 and earlier; Android 1.9.4 (build 35) and earlier
These versions automatically send limited usage events to our Cloudflare-hosted API, such as search performed, route preview loaded, navigation started or stopped, and rerouting results. Some events contain route distance, ride distance, estimated duration or moving time, as well as app preferences or result counts. These are measurements about a ride, even when rounded.
The usage-event payload excludes raw search text, precise GPS coordinates, destination names, route geometry and complete saved ride history. This is separate from the information required by online navigation requests.
These versions also use Sentry for crash and error reporting. Reports can contain app/device/operating-system information, error details and recent app events. Filtering reduces sensitive content, but we have not verified every native diagnostic field and do not describe these reports as completely anonymous. These versions have no in-app reporting switch. Apple Health permission is a separate choice.
Minimal reporting: iOS 1.9.5 (105), 1.9.6 (106), 1.9.7 (107–109) and 1.9.8 (110); Android 1.9.5 (38), 1.9.6 (39–40), 1.9.7 (41–43) and 1.9.8 (44)
These versions remove automatic product-usage events and ride measurements from reporting. This describes the version installed on your device, including test versions; it does not mean every listed build is publicly available. They retain minimal automatic JavaScript error reports containing the app version/build, platform, report identifier/time, a fixed error category and code location. The reporting filter excludes search text, coordinates, destinations, routes, ride measurements, account/device identifiers, free-text error details, activity breadcrumbs and attachments. Native crash reporting is disabled. These automatic error reports have no in-app reporting switch.
Online maps, search and routing continue to use the services listed above. Updating does not delete reports already received from an older version, and older installations continue to behave as described above. Minimal app error reports are separate from the connection and request information processed by online providers.
Hazard Reports
If you submit a hazard report through the app (e.g. a path closure or surface damage), the report is currently saved locally on your device only. Future versions may offer optional community sharing; this will always require your explicit consent.
Children's Privacy
PedalPilot is not directed at children under the age of 13. We do not knowingly collect data from children. If you believe a child has provided information through the app, please contact us and we will take appropriate steps.
Changes to This Policy
We may update this privacy policy from time to time. When we do, we will update the "last updated" date at the top. We encourage you to review this page periodically. This notice explains our practices; using the app does not itself provide consent to new data uses.
Your Privacy Choices and Rights
You control your saved rides, places and preferences on your device. Exported backups and shared files are separate copies. Deleting local app data does not delete reports already received by service providers.
Anyone can contact support@pedalpilot.app to request deletion of personal data we hold. We will explain what we can identify and delete, and any records that must be retained. We may need limited information to locate the relevant records. Local app data and records held by external providers may require separate steps.
Where the GDPR applies, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing where applicable. Where processing relies on consent, you may withdraw that consent. These rights depend on the circumstances. Contact support@pedalpilot.app with a privacy request. You may also complain to a competent data protection authority.
Privacy Contact
PedalPilot
If you have questions about this privacy policy or how PedalPilot handles data, please contact PedalPilot support at:
Email: support@pedalpilot.app
Related Pages
You can also review our Terms of Use and visit the Support page for help and contact information.