Privacy Policy

1. Controller

The controller responsible for processing your data is quebi GmbH, Geitau 22, 83735 Bayrischzell, Germany. Email: hi@quebi.de. We have not appointed a data protection officer, as we are not required to. For any privacy question or to exercise your rights, write to the address above.

2. Hosting and server logs

Alpino runs on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA): Cloudflare delivers the web app and map data through its network, runs our server code (Cloudflare Workers) and stores data for us in the following services, under a data processing agreement:

• R2 object storage in the EU jurisdiction: map data, and the ride files of account holders;
• Workers KV: short-lived caches (signed-in sessions, rate-limit counters, shared-route lookups);
• Durable Objects in the EU jurisdiction: live multiplayer rides;
• Queues: processing of uploaded rides.

Account data is stored in a PostgreSQL database operated by Neon (Neon, Inc., USA) in its Frankfurt, Germany region, also under a data processing agreement; our server code connects to it through Cloudflare.

When you open Alpino, your browser sends technical request data to Cloudflare: your IP address, the requested address, date and time, browser type (user agent) and the referring page. This is necessary to deliver the website securely and to defend against attacks (Art. 6(1)(f) GDPR; our legitimate interest is a secure and working service). Our server code's logs (errors and request metadata) are kept for a few days for troubleshooting, then deleted automatically.

Cloudflare and Neon are US companies. Although your data is stored in the EU, access from the USA cannot be ruled out. Cloudflare is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, the data processing agreements of both providers include the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

3. Using Alpino without an account

The routing engine runs in your browser. It downloads routing tiles and other map data from our servers and calculates routes on your device; our servers only see which data tiles your browser downloads, which reveals the rough area you are looking at, as with any online map. The whole route is kept in the page address (for example /plan?p=…&profile=…), so it is only shared if you share the link. When you open such a link, the address, waypoints included, is sent to Cloudflare like any web request (section 2); the planner page is delivered as a static file, so our own server code does not process or log it. Short links to saved routes (/r/…), rides and profiles are handled by our server code, which looks up what they show to add link previews; if such an address carries waypoints, they can appear briefly in our server logs (section 2).

Storage on your device

Alpino uses your browser's local storage and cache. Nothing in it is sent to us, except as described for multiplayer below. It contains:

• any-router:settings: your settings (theme, units, map, graphics, trainer and multiplayer options, such as a guest name);
• any-router:trainer-control and any-router:trainer-gear: your last trainer mode and gear;
• any-router:hardware: the result of a one-time graphics performance check, with your browser's user agent, to choose suitable 3D graphics settings;
• any-router:mp-guest: a random multiplayer identifier, created only when you use multiplayer;
• the service worker's cache: the app itself, the map data you have viewed, a limited number of elevation tiles, and Bavarian and basemap.de imagery (for up to 30 days), so Alpino loads faster and works offline.

This storage is strictly necessary for the functions you use (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser's settings ("site data"). We do not use cookies when you are not signed in.

Third-party map servers

Background maps, satellite imagery, route overlays and elevation data are loaded by your browser directly from the servers of their providers. To deliver the images, these servers necessarily receive your IP address, browser information, our website's address (referrer), and the coordinates of the map area you look at. We have no control over their processing; please see their privacy policies. Which servers are contacted depends on the maps and views you choose:

The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in showing maps and terrain, which is the purpose of the service. For Esri (USA) the transfer is based on the EU-US Data Privacy Framework where Esri is certified. If you do not want a provider to be contacted, choose a different base map and do not open the 3D view.

Trainers, sensors and the bridge

Smart trainers, power meters, heart-rate and cadence sensors and Zwift Play controllers connect to your browser over Web Bluetooth, on your device. The values they send (power, speed, cadence, heart rate) are processed in your browser to control the trainer and record your ride; they are not sent to us unless you save the ride to your account (section 5) or ride in multiplayer (section 7). The optional bridge program runs on your own computer and talks only to your browser on that computer (127.0.0.1); it sends no data to us. Downloading the bridge from our server is an ordinary web request (section 2).

4. Your account

When you create an account we store:

• your email address (to sign in; we do not send newsletters or marketing emails);
• your display name, which others see on routes, rides and your profile you share;
• your password, only as a salted hash (PBKDF2-SHA256), never in plain text;
• the date you joined, and whether your profile is public;
• optionally your FTP (functional threshold power) and body weight, if you enter them, to calculate training metrics.

Signing in sets one cookie, ar_session: a random token, HttpOnly, sent only over HTTPS and only to this site, valid for 30 days and extended while you use Alpino. We store only a hash of the token, with the time the session was created and last used, its expiry and your browser's user agent, so you can see your sessions in the data export. The session is deleted when you sign out or it expires. This cookie is strictly necessary for the account you asked for (§ 25(2) no. 2 TDDDG).

To protect accounts against password guessing and the service against abuse, we count sign-in, sign-up and ride upload attempts per IP address, and follows and unfollows per account; these counters are kept for at most one hour (Art. 6(1)(f) GDPR; our legitimate interest is the security of the service).

The legal basis for account data is the performance of our contract with you (Art. 6(1)(b) GDPR). We keep it until you delete your account.

5. Saved routes, rides and visibility

Routes. When you save a route we store its name, routing profile, waypoints, the calculated line, distance, climbing, the area it covers, its visibility and timestamps.

Rides. When you save a ride recorded in Alpino or upload a FIT or GPX file, we store the original file and a processed version in R2 (EU), and in the database a summary (start time, duration, distance, climbing, speed, power, heart rate, cadence and training metrics), a simplified track and a power curve. Ride files contain your GPS track and can contain heart rate, power and cadence, and whatever else your bike computer recorded.

Heart-rate data is health data (Art. 9 GDPR). We process it only if you choose to save or upload a ride that contains it, based on your explicit consent (Art. 9(2)(a) GDPR), which you give by saving or uploading the ride. You can withdraw consent at any time by deleting the ride or your account; this does not affect processing up to then.

Visibility. Routes and rides are private when created: only you can see them. You can make them unlisted (anyone with the link can see them) or public (also listed on your profile and, for rides, in the feeds of riders who follow you). When a shared link is posted in a chat or social network, our server adds a preview with the route's or ride's name, distance and your display name.

Profile and following. Your profile shows your display name and, if it is public (the default), your follower counts, recent totals, public rides and routes, weekly totals and your followers and the riders you follow. If you make it private, others see only your display name. We store whom you follow; the riders concerned can see it in their followers list.

The legal basis is Art. 6(1)(b) GDPR (providing the features you use), and Art. 9(2)(a) for heart rate. We keep this data until you delete it or your account.

6. No analytics, no advertising

Alpino contains no analytics or tracking tools, no advertising, no social media plugins and no third-party fonts or scripts. We do not sell or share your data for advertising, and we do not use it for automated decision-making or profiling.

7. Multiplayer

Multiplayer is off until you switch it on in the settings. While it is on and you ride a route, your browser keeps a connection to our multiplayer server (Durable Objects in the EU) and sends your name (your display name, or the guest name you chose), your rider weight (for plausibility checks; not shown to others) and, up to twice a second, your position, heading, speed, power, cadence and distance. Riders near you see your name, position, speed, power and cadence. A random identifier from your browser (see section 3) keeps your rider number stable; it is not linked to your account. Live positions are kept only while you are connected and are not stored afterwards. For organised events, the start list, your name and your distance over time are stored to produce the results.

The legal basis is Art. 6(1)(b) GDPR: you ask to ride with others.

8. Recipients

Your data is processed by our processors Cloudflare and Neon (section 2). Content you make unlisted or public is visible to the people you share it with. Beyond that, we pass data to third parties only where we are legally obliged to, for example to authorities on the basis of a court order.

9. Retention and deletion

• Technical logs: a few days.
• Rate-limit counters: at most one hour. Session cache entries: one minute.
• Sessions: until you sign out, or 30 days after you last used them.
• Routes, rides, profile and follows: until you delete them or your account.
• Deleting your account (menu, Delete account) removes your account, sessions, routes, rides, power curves and follows from our database immediately, and your ride files from storage shortly after. Shared links stop working; cached copies expire within minutes. Remaining copies in our database provider's backups are overwritten in the normal backup cycle.

10. Your rights

You have the right to:

• access your data (Art. 15 GDPR) — the menu's "Export my data" downloads the data stored about you in our database as JSON: your profile, routes, rides (summaries and tracks), power curves, follows and sessions. Your original ride files and processed ride data in storage are referenced there but not included; you can view each ride in the app, or ask us for the files;
• rectification (Art. 16) — you can rename routes and rides; for other changes write to us;
• erasure (Art. 17) — delete routes, rides or your whole account yourself at any time;
• restriction of processing (Art. 18);
• data portability (Art. 20) — the export is machine-readable JSON; on request we also send you your original ride files;
• object to processing based on Art. 6(1)(f) GDPR, on grounds relating to your particular situation (Art. 21);
• withdraw consent at any time with effect for the future (Art. 7(3));
• lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

To exercise your rights, write to hi@quebi.de.

11. Are you required to provide data?

No. You can use Alpino without an account. An account needs an email address, a display name and a password; without them we cannot create one. Everything else is optional.

12. Changes

We update this policy when Alpino or the law changes. The current version is always on this page; we will inform account holders of significant changes.