Your privacy
Most apps ask who you are before they do anything. We built MotoNavigator so that question never comes up. Not out of politeness - out of architecture. The principle behind everything: as anonymous as technically possible. Here’s what that means, in plain words.
We don’t know who you are
No account. No registration. No email, no name, no profile photo, no “sign in with anything”. When you first open the app, your phone rolls a random ID - a long string of dice throws, a purely technical, quasi-anonymous identifier. That number names nobody - and most of our servers never even get to see it.
We couldn’t send you a newsletter if we wanted to. There’s no address to send it to - the app doesn’t hold one and never asks for one. If a form ever turns up here on the website and you put yourself into it, then you handed us the address. On our own we can’t reach you. If you ever write to support, you’ll have to tell us your ID yourself - the app shows it to you, because we can’t look you up. There is no directory you appear in as a person.
There’s one exception, and you build it yourself: your email. We hang on to it, the way any decent workshop hangs on to its job cards - and if your ID is in it, it sits there right next to your address. Don’t want that? Say so; then we delete the email, except where a law makes us keep it.
Paying doesn’t unmask you
Pro runs through your device’s app store, so we never see a card number. What we get is exactly one confirmation: “paid until date X”. The receipt behind it carries no name, no email, no Apple or Google account - the stores don’t hand such data to developers in the first place. What lands with us is the expiry date, in one row against your rolled ID. The same row holds when you first started the app and the day you last used it - no more than that. No name, no address, no card number. If you ever re-roll the ID, the receipt simply carries its date over to the new number - no further connection exists. Your money and your riding never sit in the same row.
Privacy zones: what’s never written can never leak
Draw a circle around home. Inside that circle nothing is recorded - not uploaded-then-hidden, not deleted-later. Never written in the first place, not even on your own phone. And not just the position: speed, course, altitude, lean, air pressure - every reading stays empty.
It doesn’t tear a hole, though: the ride runs on, the clock runs with it, only the values are missing. Whoever ever gets hold of one of your rides doesn’t see where it really ends - and otherwise only what was ridden: distance, speed, lean. No name, no address, no destination.
That holds against us too: in uploaded rides, the position inside your zone doesn’t exist either. We don’t know where in that circle your home is - and we can’t know. What doesn’t exist, nobody can take. Us included.
Your rides live on your phone
Every recording - GPS, sensors, lean - is written locally, raw, and stays there. Nothing leaves this phone unless you have said it may - and you can take that back any day. Your tour archive is yours the way your garage is yours.
Uploads are opt-in - and to us, just numbers
If you contribute recordings - track, sensor readings and whatever the app noticed along the way, plus your answer to it - the upload carries your rolled ID. Nothing more. Your ride lands on a stack with lots of others, and from that stack we learn: which corner puts a grin under the helmet, where riders meet up, what the app will spot better next time. Routes that flow. Maps you can trust. An app one step ahead. That’s our business, and we’d rather say so than keep quiet about it.
What we don’t do: analyze you individually. No report card on your riding, no speeders’ list, no points on your license. We care about the stack, not the single sheet in it. To us, your ID means exactly one thing: these rides come from the same device, those from another. There is no name, no email, no account the number would lead to. Tracing it back to a person is neither intended nor possible: the path simply doesn’t exist.
Each ride is additionally filed under its own random ID as the filename - your number sits inside the file, not in the shelf label. It’s the only thread between your rides, and it stays what it is: a number that names nobody.
When the app coughs: error reports only if you say yes
When something goes wrong in the app, it can send us an error report - but only if you’ve allowed it. You’re asked on first launch, with a question of its own, separate from the one about your rides: keep your rides to yourself and you can still allow reports, and the other way around. A no costs you nothing; the app works exactly the same. You can change your mind any time, in the settings under “Privacy”.
Think of a trouble code, not a trip log: what’s broken, when, how often - not where you rode. What’s in it: the type of error, where in the program code it happened, app version, platform, when and how often, a short technical message and - where available - the last few technical events before it (type and time only, no contents). Rides, routes, places, map areas, search text: nothing to report - the report is built from a fixed list. Being straight with you: the technical message of a program fault can, in individual cases, contain details like file names. The app replaces identifiers, coordinates and path prefixes in it with placeholders before sending; a guarantee that nothing ever points at you, we don’t give.
Unlike with your rides, your ID is written right on the report - in its header and in the filename - and it’s the same ID your rides carry. On purpose: an error with no device behind it is a mystery, and we want to see whether ten reports come from ten phones or from one. Pseudonymous, then, not anonymous (we’re picky about that - the reasons are in “Why we say ‘pseudonymous’ - not ‘anonymous’” further down). Reports are filed apart from your rides, in a directory of their own.
Reports go out automatically, only over Wi-Fi and only when there’s something new. They go to our own server in the EU - the same service that takes in your uploaded rides, just with a directory of its own. No crash service from a third party, no SDK that isn’t ours. A report stays with us for up to 90 days, then it’s deleted - and it’s used for exactly one thing: finding and fixing errors. No analyzing individual riders, no ads. Want your data deleted? There’s a form: dataremoval.motonavigator.app. Your ID in, send - your request is on our list that second. The app shows you the ID. Email works too: we copy the ID from your mail into the system ourselves. Inefficient for both of us, but it works. Everything else - what’s filed under your ID, corrections, objections - goes by email, as always.
Where all this sits
Your uploaded rides sit in the EU. Full stop - and so does everything we compute from them, as long as it still points at a device. The same goes for error reports, if you allow them; they carry your ID in the open.
The rest may sit closer to you. A map download or a group server on the other side of the world is technically a bad idea: every request takes the detour, and you notice it. Those servers never even get to see your rolled ID - the credential the app identifies with there doesn’t carry it. They know somebody wants map data. Not who.
They do see an IP address, like every server on the internet. It stays in the log for two weeks at most, in case someone makes trouble. After that, it gets kicked out. The statistics we pull from it know no IP addresses. The same goes for this website.
The fresh-start button
Deep in the settings you can throw your ID away and roll a new one. The old number ends there - whatever our servers had under it is orphaned for good. We’d rather you never need it. But it’s your handle, so it’s your lever.
No social network - on purpose
No feed, no followers, no likes, no “discover” tab, no profile to groom. That’s not a missing feature, it’s a decision: your routes and POIs are yours, and nobody earns money from you showing them off.
You can still share - the way you already do. A tour leaves as a file: forum, mail, messenger, USB stick, AirDrop or Quick Share at the fuel stop. The common exchange formats go in and out. And if you want more, there’s our own open format: it carries not just the track but the whole recipe - waypoint types, routing profile, POIs, entire collections. Openly documented, human-readable, no vendor cage. Either way: a file in your hand, not a link to our servers - without your ID in it, and without us ever learning that you shared. Community happens where you put it, not where an algorithm herds you.
And yes, we still have a profile on Facebook and Instagram. A shop window, not a clubhouse. If we link to it at all, it’s a plain link - no tracking pixel, no like button, nothing that sends data to Meta up front. Click through and you’re on Meta’s turf; what Meta counts about visitors there is in the formal version.
Group rides? There you don’t even need a file - the route comes automatically from the group’s planner, and when they change it, everyone has the new one. One QR code, valid for the tour, plus a display name. While you ride together, the group sees each other on the map - that’s what it’s for. And anonymity holds here too: the group runs on its own technical identifier that has nothing to do with your ID, and your display name is just a label on it. After the tour the code expires - nothing remains that points at anyone.
Why we say “pseudonymous” - not “anonymous”
A GPS track is a GPS track: where someone rode, and when. Researchers have shown that a handful of route points can be enough to tell one person’s pattern from another’s. That’s exactly why the architecture above exists - no name attached, privacy zones cutting out home, uploads leading to no person. We call your data “pseudonymous”, not “anonymous”, because that’s the truthful word. What we give back to the community - which corners flow, which passes are worth the detour - is aggregated across many riders until it points at no one at all.
The app talks only to us
MotoNavigator communicates exclusively with our own systems under motonavigator.app - maps, routing, uploads, error reports, group rides: everything runs against our servers. No analytics services, no ad networks, no third-party SDKs phoning home. When the app transmits, it transmits to us. Three exceptions: the in-app purchase naturally goes through your device’s app store, and so does the authenticity check the app asks your store provider for when it signs up with us. Your phone’s backup takes app data with it, like it does for every other app. And if you tap a gas station’s website or number, you’re over at theirs: that info comes from OpenStreetMap, not from us - and until you tap, nobody out there learns a thing.
The formal version with articles and paragraphs lives in the privacy policy. Same facts. More lawyers.
For the engineers among us: The “rolled ID” is a UUIDv7 - something like this: 01a0f3e8-4d2c-7b91-a6e4-9c825d13f7a2. The front part is a timestamp of the roll - so at most it tells when the app was first launched. The rest is 74 bits of cryptographically secure randomness, generated on your device, not on our servers. No hardware number, no hash of your email, nothing derived - there is nothing in it that could be traced back to you. And as said: re-rolling works any time. On group rides, by the way, this ID isn’t used at all - a different one rides along there, rolled fresh on every group join.