Privacy Policy

Information we collect

Account and profile information

When you create an account with email and password, Supabase processes your email address, password verifier, confirmation status, authentication records, and security events. Ruval Labs does not receive your plaintext password. If you choose Google or Apple sign-in, we receive account identifiers, your email address or Apple relay address, authentication records, and profile details the provider makes available. You may add a display name, home region, biography, and avatar to your AllRoutes profile.

Email preferences and communications

We store your choices for new-route messages, product news, and promotions. Those optional categories are disabled unless you turn them on. We also record whether an account welcome message was sent so that it is not repeatedly delivered. We may still send necessary messages about verification, password recovery, account security, material service changes, safety, and legal terms.

Routes, plans, and content you provide

We process the information needed for features you choose to use, including saved routes; list names, descriptions, items, and sharing settings; completed-drive dates, distance, duration, vehicle, and notes; vehicle names, types, makes, and models; ratings, road notes, visit dates, and private review photos; and route suggestions, source links, and descriptive details.

Location for nearby discovery

AllRoutes asks your browser or device for location only after you select Find routes near me. Before transmission, the website or app rounds latitude and longitude to two decimal places (approximately neighborhood-level precision). The rounded coordinates are sent to our Vercel-hosted API solely to calculate distance and sort routes. AllRoutes marks that response private and non-cacheable and does not store those coordinates in the application database. Your browser, device, network provider, Vercel, or ordinary server logs may still process technical request information such as an IP address.

Device storage, cookies, and service data

For signed-out visitors, AllRoutes uses browser local storage to remember saved routes and custom lists on that device and to migrate them if you later sign in. Supabase uses essential authentication cookies or tokens to keep you signed in and protect your session. We and our providers may process request timestamps, IP-derived logs, browser or device type, authentication events, error records, and security signals to operate and protect the service.

How we use information

• provide accounts, route discovery, nearby sorting, lists, saves, journals, reviews, uploads, and route submissions;
• sync your activity across devices and prepare compatible APIs for future AllRoutes applications;
• authenticate users, prevent fraud and abuse, troubleshoot errors, and secure AllRoutes;
• moderate, verify, and curate route information and user submissions;
• maintain, analyze, and improve service reliability and user experience;
• communicate about your account, verification, recovery, material service changes, safety, or policy updates;
• send new-route highlights, product news, or promotions only for categories you choose; and
• comply with law, enforce our agreements, and protect users, Ruval Labs, and others.

Legal bases where applicable

Where a law requires a legal basis for processing, we rely on the basis appropriate to the activity: performing our agreement with you to provide requested account features; our legitimate interests in operating, securing, and improving AllRoutes; your consent for optional access such as browser location; and compliance with legal obligations. You may withdraw consent for future processing at any time through the relevant browser, device, account control, or by contacting us.

How we disclose information

We disclose information only as reasonably necessary for the purposes described in this policy:

• Infrastructure and email providers. Supabase provides authentication, database, and private file storage services under its privacy policy. Vercel hosts and delivers AllRoutes and may process request and operational data under its privacy policy. Resend processes recipient addresses, message content, delivery events, and related technical data when it delivers AllRoutes email under its privacy policy.
• Google and Apple services. If you choose Google or Apple sign-in, that provider processes authentication under its own policies. Apple may provide a private relay address if you choose Hide My Email. When you open a route in Google Maps, route locations and waypoints are sent to Google and your use is governed by Google's terms and Privacy Policy.
• Other users. A list and its description become publicly accessible only when you explicitly mark that list as shared. Making it private again removes public access, subject to brief transmission and security-log retention. Current profiles, vehicles, completions, reviews, notes, and review photos are not public.
• Legal, safety, and business events. We may disclose information to comply with law or legal process; protect rights, safety, and service integrity; obtain professional advice; or complete a merger, financing, acquisition, reorganization, or sale, subject to appropriate safeguards.

We do not sell personal information, share it for cross-context behavioral advertising, or use third-party targeted advertising trackers in the current release.

Retention and deletion

We retain account, email preference, and feature data while your account is active and as reasonably necessary to provide AllRoutes. Delivery and suppression records may be retained by our email provider for reliability, security, and compliance. Content you delete may remain temporarily in backups, security records, or logs before routine deletion. We may retain information longer when necessary to comply with law, resolve disputes, prevent abuse, or enforce agreements. De-identified or aggregated information that cannot reasonably identify you may be retained.

Browser local-storage data remains on your device until you clear it, remove the applicable save or list, or your browser removes it. You can revoke browser location permission at any time through your device or browser settings.

Your choices and privacy rights

You can change optional email categories at any time from your profile. Transactional account and security messages cannot be disabled while they are needed to operate or protect your account. Promotional messages will also include a legally required unsubscribe method when sent.

You can edit profile information, remove saves, change list visibility, and delete supported lists, vehicles, completions, and road notes through AllRoutes. You may request permanent deletion of your account and associated application data, including uploaded review photos, by contacting us at the address below. You may also request access, correction, deletion, or a portable copy of personal information, or object to or restrict certain processing where applicable.

Email ruval.labs@gmail.com with the subject “AllRoutes Privacy Request.” We may verify your identity before completing a request and may retain information when an exception applies. Authorized agents should include proof of authority. We will not discriminate against you for exercising applicable privacy rights.

California disclosures

Depending on applicable thresholds and law, California residents may have rights to know, access, correct, delete, and obtain information about disclosures, and to limit certain uses of sensitive personal information. In the preceding 12 months, the categories described above may have been collected from you, your browser or device, sign-in providers, and your interactions with AllRoutes, and disclosed to the provider categories described above for business purposes. We have not sold personal information or shared it for cross-context behavioral advertising.

Do Not Track and Global Privacy Control

AllRoutes does not currently track users across third-party websites for targeted advertising, so browser Do Not Track or Global Privacy Control signals do not change the service's behavior. If that practice changes, we will update this policy and honor legally required controls.

Automated decision-making

AllRoutes does not use personal information to make solely automated decisions that produce legal or similarly significant effects. Route search, filters, and nearby sorting organize catalog results; they do not determine eligibility, access to employment, credit, housing, insurance, or another legally significant opportunity.

Security and international processing

We use administrative, technical, and organizational safeguards designed to protect information, including access controls and row-level database policies. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Information may be processed in the United States and other countries where our providers operate, which may have different data-protection laws.

Children

AllRoutes is a general-audience service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.

Changes and contact

We may update this policy as AllRoutes changes. We will post the revised effective date here and may provide additional notice through the service when a change is material. Questions, complaints, and privacy requests may be sent to ruval.labs@gmail.com.