Privacy
Last updated 8 October 2026.
In short. No account, no cookies, no ads, and no third-party analytics: we only keep anonymous, aggregated counts of how the site is used. Your GPX file is analysed in your browser and is only stored on our server if you create a share link. Shared rides are deleted automatically 30 days after the ride date, and you can delete yours at any time.
1. Who is responsible
The controller under the EU General Data Protection Regulation (GDPR) is:
The operator of ridebriefing.com
Contact: info@ridebriefing.com
2. What we process and why
| When | What | Why and legal basis |
|---|---|---|
| Visiting the site | Your IP address and browser details, as part of every web request. | To deliver the pages securely (art. 6(1)(f) GDPR, legitimate interest). Our server logs do not record IP addresses. When you create a link, a salted hash of your IP address is kept in memory for at most one hour to stop abuse, and is never written to disk. |
| Analysing a GPX file | The file stays in your browser. To build the briefing, your browser sends points along the route (coordinates only) to the weather and map services listed in section 3, and loads map images. | To provide the briefing you asked for (art. 6(1)(f) GDPR). These services see your IP address, as with any website request. |
| Creating a share link | The route, ride name, start time and time zone, target average speed, stops, your note for the group, the computed summary (distance, climbs, a weather snapshot, surface), creation and update times, and a hashed edit key. | To host the ride and show it to the people you share the link with (art. 6(1)(b) GDPR, providing the service you request). Anyone with the link can see the ride. Shared pages tell search engines not to index them. |
| Link previews | A preview image of the ride, generated on our server. | So messaging apps can show the ride when you paste the link. Those apps fetch and may cache the image under their own policies. |
| Keeping previews up to date | In the 16 days before a shared ride, our server asks Open-Meteo for the forecast at a few points along the route, at most every three hours, when the link is opened. | So the preview shows the latest forecast (art. 6(1)(b) GDPR). Our server sends only coordinates and dates, never your IP address. |
| Usage statistics | Daily totals only: page views, briefings made, rides shared, calendar and GPX downloads, link previews per app, referring websites and phone or computer. To count unique visitors per day, a hash of your IP address and browser with a random key is held in memory for that day only; the key and hashes are discarded at midnight and only the total is kept. | To understand how the site is used and improve it (art. 6(1)(f) GDPR, legitimate interest). No cookies or identifiers, nothing that can single you out, and nothing shared with anyone. |
| Calendar and GPX files | The event and route files you download. | Created in your browser from the ride on screen. Nothing is sent to us or anyone else. |
| Your browser's local storage | The edit key for each link you created, your preferred map style, and your choice of light or dark theme. We do not use cookies. | Strictly necessary to let you update or delete your own ride and to remember a setting you chose, so no consent is required (art. 5(3) ePrivacy Directive). The edit key is only sent to us when you update or delete a ride, or open your organiser link. That link contains the key: anyone who has it can edit or delete the ride, so keep it private. You can replace it at any time, which makes the old one stop working. Clearing your browser's site data removes the key from your browser. |
3. Services we use
Fonts and the map library are hosted on our own server: no Google Fonts and no third-party scripts. Your browser contacts these services directly while you use the briefing:
| Service | Purpose | Data | Location |
|---|---|---|---|
| Open-Meteo | Weather forecast, and elevation if your file has none | Route coordinates, dates, and your IP address (our server's address for preview updates) | Switzerland / EU |
| Valhalla, run by FOSSGIS e.V. | Road surface and road type, matched to OpenStreetMap | Route coordinates, IP address | Germany |
| Overpass API (overpass-api.de) | Names of passes and summits, and road surface if Valhalla is unavailable | Map areas along the route, IP address | Germany |
| OpenStreetMap Foundation | Map tiles (Roads layer) | Visible map area, IP address | United Kingdom (EU adequacy decision), via a content delivery network |
| OpenTopoMap | Map tiles, only if you choose the Topo layer | Visible map area, IP address | Germany |
| netcup GmbH, Germany | Hosting this website and stored rides | Everything in section 2, under a data processing agreement | EU |
We do not sell data, show ads or use third-party analytics.
4. How long we keep it
- Shared rides and their preview images are deleted automatically 30 days after the ride date (or after the last update, if that is later).
- Rides can be planned at most a year ahead, so no ride is kept longer than 13 months after its last update.
- You can delete a ride immediately with Delete this ride, from the browser that created the link. The link stops working at once.
- Daily backups of shared rides are kept for 14 days, so a deleted or expired ride also disappears from the backups within 14 days.
- Rate-limiting hashes are kept in memory for at most one hour; daily visitor hashes until midnight (UTC).
- Aggregated usage statistics (daily totals, no personal data) are kept for up to 25 months.
- Nothing is kept for a GPX file you analyse without creating a link.
5. Your rights
You have the right to access, correct or delete your data, to restrict or object to its processing, and to data portability (articles 15 to 21 GDPR). There are no accounts, so we can only find a ride from its link: include it when you write to us at info@ridebriefing.com. You can also lodge a complaint with your data protection supervisory authority (article 77 GDPR).
6. Security
The site is served over HTTPS with a strict Content Security Policy. Edit keys are stored only as hashes, and shared rides use unguessable links that are not listed or indexed anywhere.