Privacy Policy
Last updated: October 16, 2026
MakeRoutes ("we", "us", or "our") respects your privacy. This policy explains what data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR) and other applicable laws.
Data Controller
Legal entity: MakeRoutes (sole proprietorship / autónomo)
Contact: privacy@makeroutes.com
Location: Spain
The data controller is responsible for determining the purposes and means of processing your personal data in accordance with GDPR and Spain’s Ley Orgánica de Protección de Datos y garantía de los derechos digitales (LOPDGDD).
1. Information We Collect
MakeRoutes has no sign-in: we collect no name, email or account identifier.
Location Data
When you use the "Add Current Location" feature, we access your device's GPS coordinates to add your current position as a stop in your route. Location access is requested only when you explicitly trigger this feature and requires your permission. We do not track your location in the background. To name the point, its coordinates are sent through our server to Nominatim (OpenStreetMap).
Route Data
Routes you create (stop names, addresses, coordinates, and route order) are stored locally on your device, via localStorage. The most recent optimised routes (up to 20, including their result) are kept in a "Recent routes" list, only on your device, and you can delete them one by one from that list. When you optimize a route, your stops are sent to our server to calculate the result. For up to 30 days it keeps an anonymous copy of that calculation (travel times and the line drawn on the map) so that a repeated route is answered without recalculating; see Data Retention below.
Usage and Diagnostic Data
We may collect anonymous, aggregated usage statistics (such as feature usage frequency) to improve the app, measured with Cloudflare Web Analytics and — on the makeroutes.com website and in the Android app — Google Analytics 4, which stores nothing on your device and sends only cookieless signals unless you accept. In the iOS app from version 1.1.8, and only if you accept when you first open it, anonymous usage statistics are sent to our own server and relayed to Google Analytics: no cookies, an identifier generated in memory and discarded when the app closes, and no IP address forwarded; change your answer at any time with the Usage statistics switch in the profile menu. Versions before 1.1.8 send nothing to Google Analytics. Separately from this choice, and with or without your consent, the website and the apps also send the name of each usage event to our own anonymous live counter (see Live counter below), which never goes to Google Analytics. This data cannot identify you personally, and wherever it runs you can change your answer at any time with the Usage statistics switch in the profile menu.
What the usage statistics contain — the same things on every platform: how many routes are optimised and how many are exported (to Google Maps or Apple Maps), address searches that found nothing, app opens, and the limits that were reached; the interface language of the app; how you use the tutorial (whether it is completed, skipped or closed and at which step, and replays); use of the example route (loaded, optimised, exported, discarded); clicks on our own Fair Divider notice and on the notice to download the app; and, on the content pages, clicks on the buttons that open the app and on the store badges. Each is a count or a category from a fixed list built into the app — and, on iOS, enforced again by our own server, which discards anything else. Alongside them travels non-identifying technical metadata: the device's time zone, the length of the search text (never the text itself), how long the operation took, and the app version. The statistics never contain addresses, coordinates or the text you typed; on iOS they carry no identifier that outlives the session, and on the website and Android Google Analytics sets its own cookies only after you accept (see Cookies below). None of it includes addresses, locations or anything you type. The live counter (see below) receives, with or without consent, only the name of each in-app usage event — for example stops added, each address-search outcome or a failed optimisation — never parameters. We use them to know which features are used and what fails, so a free app can be maintained and improved.
Anti-Abuse and Device Security Data
To keep the free service usable, we count requests per day against an IP address or a device identifier, never against an account, since there is none. On iOS and Android we also keep a signed device-attestation record (Apple App Attest / Google Play Integrity) that proves a request comes from our real app rather than a forged client. Error reports: written only to our server logs, never to a database, with your full IP address, device identifier and browser or app version; the logs are capped in size and overwritten oldest-first, not archived. Cloudflare Turnstile checks that requests to the free-tier endpoints (address search and route optimisation) on the website come from a real browser, not a bot.
2. How We Use Your Information
| Purpose |
Data Used |
Legal Basis (GDPR) |
| Provide and maintain the service |
Route data |
Contract performance |
| Add your current position as a stop |
GPS location |
Consent |
| Improve the app |
Anonymous usage data |
Consent (Google Analytics, Microsoft Clarity); legitimate interest for the cookieless Cloudflare Web Analytics on the website and for our own cookieless live counter (website and apps) |
3. Third-Party Services
We integrate with the following third-party services, each with their own privacy policies:
Routing and Geocoding
Address searches go to CartoCiudad (Spanish government) and, when your other stops or the search itself point to France, Argentina, Switzerland or the Netherlands, and only for addresses with a house number, to the Géoplateforme (IGN, French government), Georef (Argentine government), swisstopo (Swiss Confederation) or PDOK (Dutch government), all called straight from your device so they also see your IP address, and through our server to Nominatim (OpenStreetMap), Photon (Komoot), Google Geocoding and Mapbox, which never see your IP. Outside Spain, and in Spain whenever CartoCiudad finds nothing, Google (or Mapbox, once Google's monthly allowance is spent) is asked before Nominatim and Photon. They receive the text you type and a point derived from your other stops. Routes are calculated by OSRM on our own server; if any stop is outside Spain, the coordinates of all stops go to Mapbox instead — or, on a day when Mapbox's allowance is spent, to Geoapify (Geoapify GmbH, Germany). For some routes whose stops are all in Germany, the Netherlands, Belgium, Luxembourg or Switzerland, the coordinates of the stops (longitude and latitude only, with no addresses or account data) are sent from our server in Germany, over an encrypted private network, to a routing server that we operate ourselves in Spain (EU), running Valhalla (open source, OpenStreetMap data). It is used only to compute travel times and distances, does not log coordinates and stores nothing. You may get this result because you chose the optional “beta” button after reaching a limit, or automatically for a share of routes (the result then shows a “Beta” badge). The same server also runs in the background, for measurement only and without showing you the result, on routes in those countries that were sent to Mapbox. No third party is involved.
- OSRM (Open Source Routing Machine) — open-source; processes route coordinates
- Valhalla — open-source routing engine on our own server in Spain (EU); processes route coordinates for stops in Germany, the Netherlands, Belgium, Luxembourg and Switzerland; no third party
- CartoCiudad — Spanish government geocoding service
- Géoplateforme (IGN) — French government geocoding service (data.geopf.fr, BAN data under the Etalab 2.0 licence); asked only when your other stops or the search itself point to France, and only for addresses with a house number; receives the text you type and a point derived from your other stops
- Georef (Argentine government) — Argentine address register (apis.datos.gob.ar); asked only when your other stops or the search itself point to Argentina, and only for addresses with a house number; receives the text you type, from which it returns every match in the country (the nearest is chosen on your device)
- swisstopo (Swiss Confederation) — Swiss address register (api3.geo.admin.ch); asked only when your other stops or the search itself point to Switzerland, and only for addresses with a house number; receives the text you type and a search area of about 120 km around a point derived from your other stops
- PDOK (Kadaster, Netherlands) — Dutch address register, BAG data (api.pdok.nl); asked only when your other stops or the search itself point to the Netherlands, and only for addresses with a house number; receives the text you type and a point derived from your other stops
- Nominatim (OpenStreetMap) — OSM Foundation Privacy Policy
- Photon (Komoot) — Photon project
- DB-IP — IP Geolocation by DB-IP (IP to Country Lite, CC BY 4.0); a country database downloaded to our own server and read there to decide whether the website is available in your country; none of your addresses is sent to DB-IP
- Google Geocoding API — Google Privacy Policy
- Mapbox — Mapbox Privacy Policy
- Geoapify (Geoapify GmbH, Germany) — route calculation for stops outside Spain when the Mapbox allowance is spent; receives the coordinates of the stops — Geoapify Privacy Policy
These services receive the addresses or coordinates you search for in order to return route calculations and location results.
Analytics
- Cloudflare Web Analytics — privacy-first, cookieless website analytics (aggregate page views and performance) — Cloudflare Privacy Policy
- Google Analytics 4 — usage analytics on the makeroutes.com website and in the Android app, running in Google Consent Mode v2, denied by default: without your consent it stores no cookies or identifiers on your device and sends only signals without cookies or any persistent identifier, which Google uses to estimate aggregate usage; with your consent it uses measurement cookies. The content pages (guides, landing pages) have no banner and always run in the denied mode unless you already accepted in the web app. In the iOS app it applies from version 1.1.8 only, and differently: no Google script is loaded and no cookie is set there, and if you accept the question the app asks the first time you open it, the events reach Google through our own server, carrying an identifier generated in memory and discarded when the app closes. Versions before 1.1.8 send none. Wherever it does run you can change the answer at any time with the Usage statistics switch in the profile menu — Google Privacy Policy
- Microsoft Clarity — heatmaps and session replay on the makeroutes.com website only, to see where pages confuse people. It records how a page is used — clicks, scrolling, mouse movement — and sets its own cookies, so unlike Google Analytics it is not loaded in a denied state: it runs only after you choose Accept, and never before. The recording includes what you type in the address box and the stops on your route: they are what the search is for, and a replay that hides them cannot show where the search went wrong. There is no account name or email to appear in a recording. Nothing is recorded at all unless you choose Accept. It never runs in the iOS or Android apps — Microsoft Privacy Statement
- Umami Cloud — cookieless, aggregate website statistics on the makeroutes.com website only: page views and a handful of product events (the app prompt being shown, accepted or dismissed, the Fair Divider ad being shown or dismissed or its link clicked, a route optimised or exported, opening or completing the tutorial, and a click on a call to action on the content pages), each with non-personal parameters such as the number of stops. It sets no cookie, stores nothing on your device, uses no persistent identifier and does not follow you across sites or visits, and it receives no addresses, coordinates or free text. It sets no cookies and stores nothing on your device (it only checks whether Umami has been disabled in this browser). Umami uses your IP address on its servers to derive your country and does not store it. It runs without a banner for that reason. It never runs in the iOS or Android apps — Umami Privacy Policy
- PostHog (EU cloud, Frankfurt) — product analytics on the makeroutes.com website only: page views and the same handful of product events as above, with non-personal parameters. Without your consent nothing is stored on your device and each visit counts on its own. If you choose Accept, it keeps a pseudonymous random identifier in your browser’s local storage (no cookie) to measure return visits and to keep experiments stable; Reject, or turning the Usage statistics switch off, deletes it. The page address is sent without its query string or fragment and the referrer only as the site it came from; advertising click identifiers are discarded. No session recordings, no automatic capture of what you click or type, no surveys, no names or emails. It never runs in the iOS or Android apps — PostHog Privacy Policy
- Live counter (our own server) — v.makeroutes.com, on the website and in the iOS and Android apps, with or without your consent. A cookieless live visit counter run on our own Cloudflare Worker: it sets no cookie and stores nothing on your device. It receives a page view and the name of each in-app usage event (for example stops added, searches and their outcome, routes optimised or exported, a failed optimisation, or the answer you gave to the statistics question), together with the page path without any query string, the platform and the site — never parameters, addresses, coordinates, text you type or any identifier. The IP address is used on the server only transiently for that count and the approximate city, and is not stored: to tell distinct visitors apart within a day, the Worker turns it, together with a secret salt, the date, the site and the browser’s user agent, into a hash that changes every day, so no visitor can be followed from one day to the next or from one site to another; that hash is kept only for the current day. The live detail is kept in a 5-minute window; for each day only totals of a short list of funnel events (visits, stops added, searches, routes optimised and exported, per platform) are kept for 400 days, with nothing that identifies anyone. Cloudflare processes it on our behalf. It is separate from Google Analytics and is not switched off by the Usage statistics switch. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in knowing, in aggregate, how the free service is used and whether it works; you can object at any time by writing to privacy@makeroutes.com — Cloudflare Privacy Policy
4. Cookies and Local Storage
The MakeRoutes web app uses browser localStorage to store your route data and app preferences locally, including the interface language you choose (for example when you arrive from a language page); it is used only to show the app in that language. For always-on, privacy-focused measurement (page views and load times) we use Cloudflare Web Analytics, which sets no cookies, stores nothing on your device, does not store your IP address, and does not track you across other websites.
On the makeroutes.com website we also offer Google Analytics 4, which uses cookies. It is governed by Google Consent Mode v2 and is denied by default: no Google Analytics cookies or identifiers are stored on your device unless you choose Accept in the cookie banner; until then (and if you choose Reject) it only sends signals without cookies or any persistent identifier, which Google uses to estimate aggregate usage. In the iOS app nothing goes to Google Analytics without your consent; the anonymous live counter described under Third-Party Services is separate and receives event names regardless. Your choice is remembered on your device, and it is not final: open the profile menu (the avatar in the top bar) and use the Usage statistics switch to turn it off again, or back on, whenever you like. Turning it off takes one tap, exactly like accepting did. We never enable advertising or ad-personalization signals, and we display no advertising.
Microsoft Clarity also uses cookies, and is held to a stricter rule than Google Analytics because it records the page rather than a list of events: it is loaded only once you have chosen Accept, and a refusal or an unanswered banner means its script is never fetched at all. Turning the Usage statistics switch off clears Clarity’s cookies from your browser and stops the recording. It runs on the website only, never inside the apps.
5. Data Retention
- Route data: your routes themselves (names, addresses and order) are not retained on our server; local data persists until you clear your browser or app storage.
- Route calculations: an anonymous copy of what each route calculation returned (travel times and the line on the map), deleted after 30 days. Not linked to any account, device or IP address; kept only so a repeated route is answered without recalculating.
- Address-search cache: the search text and its result — or, for a point picked on the map or your location, its coordinates rounded to about 11 m — with no IP address or device identifier, deleted after 30 days. Mapbox address-search results are never stored.
- Server access logs: each request's URL (for a search, its text or coordinates), your IP address shortened to its network (/24; IPv6 /64) and your browser or app identification; deleted after 14 days. Logs written before this policy's date may also include your device identifier until they are deleted.
- Anti-abuse counters, by IP address: one counter per day per IP address (for IPv6, its /64 network) to enforce the free limits. Deleted automatically after 30 days.
- Repeated-route counter: when a route is calculated by an outside paid provider, a keyed fingerprint (an HMAC under a secret only our server holds) of your connection or account and of the set of stops is counted for the day — never the stops, addresses or coordinates themselves, and never the provider's answer. It exists only to cap how many times the same paid route can be calculated, and it is deleted after that day (and immediately with your account, if you have one).
- Anti-abuse counters, by device identifier: the long-route allowance's per-minute counters expire after 24 hours and are purged in an hourly sweep. The daily allowance for routes outside Spain may be counted per device identifier, when the app sends one, instead of per IP address; that counter is deleted after the day (and immediately with your account, if you have one).
- Limit-reached log: when a free limit tells you no (or we give you an estimated route instead), or the app itself decides not to ask the server for something, we keep one line with the reason, the number of stops, the app's platform and version, the country the connection reports and how much of each limit you had used. Your account, device and connection appear only as a keyed fingerprint (an HMAC under a secret only our server holds) — never your IP address, the stops, addresses or coordinates. It exists to tune the limits with data, is deleted after 90 days and, if you have an account, immediately when you delete it.
- Device attestation (iOS/Android): your app's App Attest key or Play Integrity result (no IP address), valid for 30 days from its last renewal and deleted 30 days after it lapses — at most about 60 days after you last use the app.
- Error reports: written only to our server logs, never to a database, with your full IP address, device identifier and browser or app version; the logs are capped in size and overwritten oldest-first, not archived.
- Analytics data: Google Analytics 4 event data is retained for 14 months, after which Google deletes it. In the iOS app there is no persistent identifier to erase: the one the statistics carry is generated in memory when the app starts and is gone when it closes.
6. Your Rights Under GDPR
If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:
- Right of access — Request a copy of the personal data we hold about you
- Right to rectification — Request correction of inaccurate data
- Right to erasure — Request deletion of your personal data ("right to be forgotten")
- Right to restrict processing — Request that we limit the processing of your data
- Right to data portability — Request your data in a structured, machine-readable format
- Right to object — Object to processing based on legitimate interest
- Right to withdraw consent — Withdraw consent at any time, as easily as you gave it. For usage statistics, use the Usage statistics switch in the profile menu: one tap turns Google Analytics and Microsoft Clarity off again, and the app keeps working exactly as before. In the iOS app the same Usage statistics switch withdraws the answer you gave when you first opened it, and nothing further goes to Google Analytics. The anonymous live counter is not based on consent and is not switched off by it; you can object to it by writing to privacy@makeroutes.com. Location access is withdrawn in your browser or device settings
To exercise any of these rights, contact us at privacy@makeroutes.com. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD).
7. International Data Transfers
Some of our third-party service providers (Google, Apple, Mapbox, Microsoft, Cloudflare) may process data outside the EEA. These transfers are protected by Standard Contractual Clauses (SCCs) or adequacy decisions approved by the European Commission. Geoapify is a German (EEA) company, so sending it stop coordinates is not a transfer outside the EEA.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encrypted data transmission (HTTPS/TLS)
- Access controls on our server infrastructure
No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to privacy@makeroutes.com.
9. Children's Privacy
MakeRoutes is not directed at children under the age of 14, in accordance with Spain’s LOPDGDD. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@makeroutes.com and we will delete the data promptly.
10. Changes to This Policy
We may update this privacy policy from time to time. Material changes will be communicated on this page and in the app. The "Last updated" date at the top indicates the most recent revision.
11. Contact Us