Your privacy
Most apps ask who you are before they do anything. We built MotoNavigator so that question never comes up. Not out of politeness — out of architecture. The principle behind everything: as anonymous as technically possible. Here’s what that means, in plain words.
We don’t know who you are
No account. No registration. No email, no name, no profile photo, no “sign in with anything”. When you first open the app, your phone rolls a random ID — a long string of dice throws, a purely technical, quasi-anonymous identifier. That number names nobody — and most of our servers never even get to see it.
We couldn’t send you a newsletter if we wanted to. There’s no address to send it to — the app doesn’t hold one and never asks for one. If a form ever turns up here on the website and you put yourself into it, then you handed us the address. On our own we can’t reach you. If you ever write to support, you’ll have to tell us your ID yourself — the app shows it to you, because we can’t look you up. There is no directory you appear in as a person.
There’s one exception, and you build it yourself: your email. We hang on to it, the way any decent workshop hangs on to its job cards — and if your ID is in it, it sits there right next to your address. Don’t want that? Say so; then we delete the email, except where a law makes us keep it.
Paying doesn’t unmask you
Pro runs through your device’s app store, so we never see a card number. What we get is exactly one confirmation: “paid until date X”. The receipt behind it carries no name, no email, no Apple or Google account — the stores don’t hand such data to developers in the first place. What lands with us is the expiry date, in one row against your rolled ID. The same row holds when you first started the app and the day you last used it — no more than that. No name, no address, no card number. If you ever re-roll the ID, the receipt simply carries its date over to the new number — no further connection exists. Your money and your riding never sit in the same row.
Privacy zones: what’s never written can never leak
Draw a circle around home. Inside that circle nothing is recorded — not uploaded-then-hidden, not deleted-later. Never written in the first place, not even on your own phone. And not just the position: speed, course, altitude, lean, air pressure — every reading stays empty.
It doesn’t tear a hole, though: the ride runs on, the clock runs with it, only the values are missing. Whoever ever gets hold of one of your rides doesn’t see where it really ends — and otherwise only what was ridden: distance, speed, lean. No name, no address, no destination.
That holds against us too: in uploaded rides, the position inside your zone doesn’t exist either. We don’t know where in that circle your home is — and we can’t know. What doesn’t exist, nobody can take. Us included.
Your rides live on your phone
Every recording — GPS, sensors, lean — is written locally, raw, and stays there. Nothing leaves this phone unless you have said it may — and you can take that back any day. Your tour archive is yours the way your garage is yours.
Uploads are opt-in — and to us, just numbers
If you contribute recordings — track, sensor readings and whatever the app noticed along the way, plus your answer to it — the upload carries your rolled ID. Nothing more. Your ride lands on a stack with lots of others, and from that stack we learn: which corner puts a grin under the helmet, where riders meet up, what the app will spot better next time. Routes that flow. Maps you can trust. An app one step ahead. That’s our business, and we’d rather say so than keep quiet about it.
What we don’t do: analyse you individually. No report card on your riding, no speeders’ list, no points on your licence. We care about the stack, not the single sheet in it. To us, your ID means exactly one thing: these rides come from the same device, those from another. There is no name, no email, no account the number would lead to. Tracing it back to a person is neither intended nor possible: the path simply doesn’t exist.
Each ride is additionally filed under its own random ID as the filename — your number sits inside the file, not in the shelf label. It’s the only thread between your rides, and it stays what it is: a number that names nobody.
Where all this sits
Your uploaded rides sit in the EU. Full stop — and so does everything we compute from them, as long as it still points at a device.
The rest may sit closer to you. A map download or a group server on the other side of the world is technically a bad idea: every request takes the detour, and you notice it. Those servers never even get to see your rolled ID — the credential the app identifies with there doesn’t carry it. They know somebody wants map data. Not who.
They do see an IP address, like every server on the internet. It stays in the log for two weeks at most, in case someone makes trouble. After that, it gets kicked out. The statistics we pull from it know no IP addresses. The same goes for this website.
The fresh-start button
Deep in the settings you can throw your ID away and roll a new one. The old number ends there — whatever our servers had under it is orphaned for good. We’d rather you never need it. But it’s your handle, so it’s your lever.
No social network — on purpose
No feed, no followers, no likes, no “discover” tab, no profile to groom. That’s not a missing feature, it’s a decision: your routes and POIs are yours, and nobody earns money from you showing them off.
You can still share — the way you already do. A tour leaves as a file: forum, mail, messenger, USB stick, AirDrop at the fuel stop. The common exchange formats go in and out. And if you want more, there’s our own open format: it carries not just the track but the whole recipe — waypoint types, routing profile, POIs, entire collections. Openly documented, human-readable, no vendor cage. Either way: a file in your hand, not a link to our servers — without your ID in it, and without us ever learning that you shared. Community happens where you put it, not where an algorithm herds you.
And yes, we still have a profile on Facebook and Instagram. A shop window, not a clubhouse. If we link to it at all, it’s a plain link — no tracking pixel, no like button, nothing that sends data to Meta up front. Click through and you’re on Meta’s turf; what Meta counts about visitors there is in the formal version.
Group rides? There you don’t even need a file — the route comes automatically from the group’s planner, and when they change it, everyone has the new one. One QR code, valid for the tour, display name optional. While you ride together, the group sees each other on the map — that’s what it’s for. And anonymity holds here too: the group runs on its own technical identifier that has nothing to do with your ID, and your display name is just a label on it. After the tour the code expires — nothing remains that points at anyone.
Why we say “pseudonymous” — not “anonymous”
A GPS track is a GPS track: where someone rode, and when. Researchers have shown that a handful of route points can be enough to tell one person’s pattern from another’s. That’s exactly why the architecture above exists — no name attached, privacy zones cutting out home, uploads leading to no person. We call your data “pseudonymous”, not “anonymous”, because that’s the truthful word. What we give back to the community — which corners flow, which passes are worth the detour — is aggregated across many riders until it points at no one at all.
The app talks only to us
MotoNavigator communicates exclusively with our own systems under motonavigator.app — maps, routing, uploads, group rides: everything runs against our servers. No analytics services, no ad networks, no third-party SDKs phoning home. When the app transmits, it transmits to us. Three exceptions, all obvious: the in-app purchase naturally runs through the till of your device’s app store. Your phone’s backup takes app data with it, like it does for every other app — the fat map packs we’ve excluded from it. And if you tap a petrol station’s website or number, you’re over at theirs: that info comes from OpenStreetMap, not from us — and until you tap, nobody out there learns a thing.
The formal version with articles and paragraphs lives in the privacy policy. Same facts. More lawyers.
For the engineers among us: The “rolled ID” is a UUIDv7 — something like this: 01a0f3e8-4d2c-7b91-a6e4-9c825d13f7a2. The front part is a timestamp of the roll — so at most it tells when the app was first launched. The rest is 74 bits of cryptographically secure randomness, generated on your device, not on our servers. No hardware number, no hash of your email, nothing derived — there is nothing in it that could be traced back to you. And as said: re-rolling works any time. On group rides, by the way, this ID isn’t used at all — a different one rides along there, rolled fresh on every group join.