Controller
Come In Labs FlexCo, Schottenfeldgasse 60/36-38, 1070 Vienna, Austria.
Contact: [email protected]
Public route data
Open Routes reads public app.pulseid.route records from the AT Protocol network and stores a searchable cache. These records can include a route name, geometry, start and end points, distance, elevation, place, links, timestamps, and the author's public DID and handle.
We process this data to provide the public directory and map. The legal basis is our legitimate interest in making openly published route records discoverable under Article 6(1)(f) GDPR. Authors control the source record on their own PDS. If a deleted or corrected record remains cached, contact us and include its AT URI.
Technical data
When you access the site, our hosting infrastructure may process your IP address, request time, requested URL, referrer, browser information, and error details. This is necessary to deliver and secure the service under Article 6(1)(f) GDPR. Technical logs are retained only as long as reasonably necessary for security and operation.
Maps and network services
Interactive maps load styles and map tiles from MapToolkit. Its servers receive technical request data such as your IP address. Open Routes also communicates with public AT Protocol relays, PDS hosts, the PLC directory, and Bluesky's public API to retrieve public records and profile images.
Sign-in and saved routes
If AT Protocol sign-in is enabled, Open Routes processes the DID, handle, and session data needed to authenticate the user. Saved route identifiers are stored locally in the browser and are separated by DID. They remain on that device until browser storage is cleared.
Cookieless analytics
Open Routes uses a self-hosted Umami instance on infrastructure operated by us at Hetzner to understand basic page usage. The tracker is delivered through an Open Routes proxy and processes the visited page without its search parameters, referrer, browser, operating system, device type, language, screen size, and technical request data such as the IP address. Umami does not set analytics cookies, is not used for advertising or cross-site profiling, and respects your browser's Do Not Track setting.
This processing helps us operate and improve the service. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. Essential browser storage may also be used for authentication and saved-route functionality when those features are enabled.
Recipients and transfers
Data is shared only with infrastructure providers where needed to operate the service, or where required by law. Public AT Protocol data is already available from independently operated network services. External links are governed by the privacy policies of their respective operators.
Your rights
Subject to the GDPR, you may request access, correction, deletion, restriction, data portability, or object to processing based on legitimate interests. You may also lodge a complaint with the Austrian Data Protection Authority.