Privacy policy

Velio is a free cycling route planner, run as a personal project by Diego Sanchez in Spain. This policy explains which personal data Velio processes, why, for how long and what you can do about it. Velio has no ads, no analytics and no tracking cookies, so the list is short.

Who is responsible

Diego Sanchez is the controller of your data. For any question or request about it, write to cub1zdev@gmail.com.

What we process and why

• Your account. Your email address, your name and a hash of your password (never the password itself). If you sign in with Google, Google shares your account ID, email address and name instead of a password. We need them to create your account and sign you in, as part of the service you sign up for.
• Codes and sessions. The six-digit codes we email to confirm your address, reset your password or delete your account, stored as a hash for 15 minutes, and your open sessions with the browser that started them, for up to 7 days. They keep your account secure.
• Saved routes. The name and the route of every route you save, including its start point and stops, which can reveal places you visit. They are kept until you delete them or your account.
• Routes you plan. The points you send to plan a loop or a route are used to compute it and are not stored unless you save the route.
• Country requests. If you ask for your country, we store the country, the note you add and, if you give it, the email address to tell you when it is covered. That email is kept on your consent, which you can withdraw at any time.
• Contact list. When your account is activated, your email address joins Velio's contact list at our email provider, so we can tell you about important changes to the service. It leaves the list when you delete your account.
• Technical data. Your IP address and requests reach the server, which keeps short rotating logs to run the service and protect it from abuse. IP addresses are also held in memory for a minute to apply request limits. This rests on our legitimate interest in keeping Velio secure.

What stays in your browser

Velio uses no cookies. Your browser keeps your session token, so you stay signed in, and your language and theme choices in its local storage. Only the session token is ever sent to Velio. Your location is read only if you allow it, to centre the planner on you.

The map loads directly from OpenFreeMap (map tiles), Esri (satellite imagery) and Amazon Web Services (terrain relief). Like any website, those providers receive your IP address and the part of the map you are looking at.

Who helps us run Velio

• Contabo GmbH (Germany) hosts the server and the database.
• Backblaze, Inc. stores encrypted daily backups of the database in its European data centre in Amsterdam.
• Brevo (Sendinblue SAS, France) sends the account emails and keeps the contact list.
• Cloudflare, Inc. provides DNS and network protection for velio.cub1z.es.
• Google takes part only if you choose to sign in with Google, under its own privacy policy.

We do not sell your data or share it with anyone else unless the law requires it. Where a provider handles data outside the European Economic Area, the transfer is covered by the safeguards the GDPR requires, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Your account, saved routes and country requests: until you delete them or your account.
• Deleting your account erases it from the database and the contact list at once. Copies in the encrypted backups are gone within 21 days: backups are kept for 14 days, and deleted backups for 7 more.
• Verification codes: 15 minutes. Sessions: 7 days.
• Server logs: overwritten as they rotate, usually within days.

Your rights

You can access, correct, export or delete your data, object to or restrict its processing, and withdraw any consent by writing to cub1zdev@gmail.com. Most of it you can do yourself: change your name and password in Account settings, export any saved route as GPX or GeoJSON, and delete your account in Account settings, which erases your data.

If you think your data is handled unlawfully, you can complain to the Spanish Data Protection Agency (AEPD).

Age

Velio is not meant for anyone under 14.

Changes

If this policy changes in a way that matters, we will say so in the app or by email before the change applies. The date at the top shows the current version. The terms of service cover the rest of the rules for using Velio.