Last updated: July 2026
The party responsible for data processing on this website is:
Tony Mueller
Matterhornstraße 15
81825 Munich
Germany
Email: support@velopin.bike
GPX files you load and edit in VeloPin are processed locally in your browser. As long as you don't use an account or save a route to the cloud, this route data is not transmitted to any server.
VeloPin stores the following on your device, among others:
wpb_license) — if you've unlocked VeloPin Provelopin_consent) — your analytics choiceYou can delete this data at any time via your browser settings.
When the website is accessed, the hosting provider (Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA) automatically stores access data (incl. IP address, time, page requested, browser type). Legal basis: Art. 6(1)(f) GDPR (secure, error-free operation).
If you create an account or sign in, we process your email address and a (hashed) password, plus the routes you save (GPX files and details such as name, distance, waypoints). Authentication, database and file storage are operated by Supabase (Supabase, Inc.) as a processor (hosting region: EU/Frankfurt, eu-central-1). Legal basis: Art. 6(1)(b) GDPR (contract / use of the feature). You can delete saved routes and your account at any time.
Ride history (saved rides). If you save a completed ride after navigating, we additionally process the recorded route (GPS track) and ride details (date, time, distance, duration, elevation, speed, estimated calories). Because this is location data, saved rides are access-restricted to your account — only you can see them. Saving requires you to be logged in, and recording only happens when you start a navigation. You can delete individual rides at any time, and deleting your account automatically removes all of your rides. Legal basis: Art. 6(1)(b) GDPR (use of the feature).
Instead of an email and password, you can create your account or sign in using Sign in with Apple or Google. If you choose one of these, the provider authenticates you and passes VeloPin only the details needed to set up your account — your email address and, where available, your name. We store no password for these accounts. The sign-in itself is carried out by the provider as an independent controller under its own privacy policy: Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland — apple.com/legal/privacy) or Google (Google Ireland Ltd., Dublin — policies.google.com/privacy). Both may process data in the USA and are certified under the EU-US Data Privacy Framework. With Apple you can use Hide My Email to share a private relay address instead of your real one. Social login is entirely optional — email/password sign-in remains available. Legal basis: Art. 6(1)(b) GDPR (creating and using the account you requested).
We send two kinds of email, on different legal bases. Whether a message needs your consent depends on its purpose, not on what we call it.
Service emails (no separate consent). To run your account we send essential, non-promotional messages: address confirmation, password reset, and notices you need in order to keep using VeloPin — for example security issues, material changes to these terms or to pricing, planned downtime, or changes to how your routes are stored or handled. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) (legitimate interest in operating the service). While you hold an account you cannot unsubscribe from these.
Product news & marketing (consent only). Optional emails — such as release notes, "what's new", getting-started and route-planning tips, and offers — are sent only if you actively opt in (an unchecked box at sign-up) and confirm your address afterwards (double opt-in). Legal basis: Art. 6(1)(a) GDPR (consent). Every such email contains an unsubscribe link, and you can withdraw your consent at any time with effect for the future — via that link, in your account settings, or by emailing us — without affecting your account or the service emails above. To document your consent we record the fact, time, version and IP address of it.
Email delivery (Brevo). Both kinds of email are sent through Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany) acting as a processor. To send you an email we transmit your email address — and, for the marketing list, your opt-in status — to Brevo; processing takes place within the EU and a data-processing agreement pursuant to Art. 28 GDPR is in place. We do not use Brevo to track your behaviour on the website.
When the map is displayed and for certain features, technically necessary requests are sent to third parties. At minimum your IP address — and, depending on the feature, the relevant position/route — is transmitted:
Legal basis: Art. 6(1)(b) and (f) GDPR (providing the requested feature / legitimate interest in a working map). Map and geo data come from OpenStreetMap contributors.
The "Strava" and "Komoot" buttons simply open a file upload: you upload a GPX file you previously exported from Strava or Komoot (or drag-and-drop it). That file is processed entirely in your browser. VeloPin does not connect to your Strava, Komoot or Wahoo accounts and sends no data to those services.
We use Google Analytics (Google Ireland Ltd., Dublin) for anonymous reach analysis. Google Analytics is only loaded after you have explicitly agreed in the cookie notice. Without consent, no analytics cookies are set and no data is sent to Google.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent). You can withdraw your consent at any time with effect for the future by deleting the stored website data/cookies in your browser (you'll then be asked again).
Transfer to the USA: data may be transferred to Google in the USA; Google LLC is certified under the EU-US Data Privacy Framework. More: policies.google.com/privacy.
On the website (velopin.bike), purchasing VeloPin Pro (a subscription with a 3-day free trial) is handled by Polar (Polar Software, Inc., 3500 South DuPont Highway, Dover, DE 19901, USA) acting as Merchant of Record. Polar is therefore your contracting party for the payment and handles processing as well as VAT. The payment itself is processed by Polar (technically via Stripe), where you enter your name, email and payment details. VeloPin itself stores no payment data — we only receive your email address and subscription status in order to unlock Pro. Legal basis: Art. 6(1)(b) GDPR. Subscription cancellation, renewal, invoicing and refunds are likewise handled by Polar; Polar's terms additionally apply.
In the iPhone/iPad app, VeloPin Pro is instead purchased through Apple's App Store as an in-app purchase — an auto-renewable subscription that starts with a 1-week free trial. Apple is your contracting party for these purchases and processes the payment; we do not receive your payment details. We receive only your subscription status and, if you are signed in, your email address, in order to issue your license key and unlock Pro (in the app and, with the same key, on velopin.bike). Purchase, cancellation, renewal, billing and refunds are handled by Apple under Apple's terms. To relay Apple's purchase events to our server we use RevenueCat (RevenueCat, Inc., USA) as a processor. Legal basis: Art. 6(1)(b) GDPR.
Your data is shared only with the service providers named above, to the extent necessary to provide the respective feature, and where legally required. Data-processing agreements pursuant to Art. 28 GDPR are in place with processors.
To exercise your rights: support@velopin.bike
When you publish a route to the community, we create a public, privacy-minimised copy (the track only, without waypoint enrichment). For privacy, the start and finish are automatically trimmed by a radius you choose, so the public track does not begin at your home address; your private original file is unchanged. The public file is regenerated from the coordinates and contains no metadata from the source app (e.g. creator details or activity IDs).
Your warranty. You may only publish routes you created yourself or are otherwise entitled to share. You represent that the route does not infringe any third-party rights (in particular copyright, database or trademark rights) and contains no other person's personal location data. By publishing, you grant VeloPin and the community a non-exclusive, revocable right to display, store and make the route available to other users to view, copy and download. You can withdraw your route at any time (“unpublish”).
Prohibited content. Routes that reproduce third-party content without permission, violate another service's terms (e.g. Strava, Komoot), expose other people's location data, or contain unlawful, dangerous or offensive content are not permitted.
Reporting & removal (notice-and-takedown). Use the “Report” button on any community route to flag content — including for copyright or personal data. You can also reach us at support@velopin.bike. We review substantiated reports and remove infringing or prohibited routes promptly. We may suspend accounts that repeatedly violate these rules.
We update this privacy policy when features or the services we use change. The current version is always available on this page. Last updated: July 2026.