Privacy Policy

Privacy Overview

Last Updated: 18 August 2026

The Short Version

Your route data stays private. Your GPX routes and location data are processed entirely in your web browser - our servers never see or store your route information. We use privacy-focused analytics which you can opt out of below.

PitStopper.net is a client-side web application. This means that when you upload a GPX file or search for points of interest, all processing happens locally in your browser. Your route data never touches our servers, but data is sent to 3rd party servers.

What We Don't Collect

  • GPX Files - Your route files are processed entirely in your browser and are never uploaded to our servers
  • Location Data - We don't track where you are or where you're planning to go
  • Personal Information - We don't require accounts, logins, or any personal details
  • Tracking Cookies - PitStopper does not use cookies to track you

Website Analytics

Privacy-Focused Analytics

We use Umami, a privacy-focused, self-hosted analytics system. Unlike traditional analytics, Umami does not use cookies, does not track users across websites, and does not collect personal information.

Our analytics help us understand which features are most used so we can focus our improvements. We collect:

  • Page views - Which pages are visited
  • Feature usage - Which buttons and features are clicked (e.g., "Export GPX", "Search POIs")
  • Referrer - How you found our site
  • Browser/device type - To ensure compatibility
  • Country - General geographic region (not precise location)

We do not collect:

  • IP addresses (anonymised before storage)
  • Personal identifiable information
  • Your route or GPX data
  • Cross-site tracking data

Opt Out of Analytics

If you prefer not to be included in our analytics, you can opt out by clicking the button below. This sets a flag in your browser's local storage that tells Umami to skip tracking your visits and feature usage.

One exception: if PitStopper Web hits a JavaScript error, an anonymous error report (the error message and app version - never your routes, location or any personal data) is still sent so we can find and fix the bug.

You can also manually opt out by opening your browser's developer console (F12) and running: localStorage.setItem('umami.disabled', 1);

Browser Storage

PitStopper.net uses your browser's local storage (localStorage) to save your preferences and improve your experience. This data is stored only on your device and is never transmitted to our servers.

Data stored locally includes:

  • Your preferred distance units (km/miles)
  • Theme preference (light/dark/auto)
  • Language preference
  • Saved projects and presets
  • POI cache (to reduce API calls)
  • Dismissed help dialogs
  • Analytics opt-out preference

You can clear this data at any time through Tools > System Tools > Saved Preferences or by clearing your browser's site data.

Third-Party Services

How API Requests Work

When you search for POIs or use other features, your browser makes requests directly to third-party APIs. These requests go from your device to the service provider - PitStopper's servers are not involved in this process.

PitStopper.net uses several third-party services to provide its functionality. When you use these features, your browser communicates directly with these services:

POI Data

PostGIS POI servers (OpenStreetMap data)

Used to find points of interest. Your search area coordinates are sent to query POI data. PitStopper operates two POI servers of its own, which answer where possible; Geofabrik's public Postpass instance is used as a fallback.

OpenStreetMap Privacy Policy

Map Tiles

OpenStreetMap

Default street map layer.

OpenStreetMap Privacy Policy
ESRI World Imagery

Satellite imagery layer.

ESRI Privacy Statement
Thunderforest

Outdoor activity maps.

Thunderforest Privacy Policy
OpenTopoMap & CyclOSM

Topographic and cycling map layers. These use OpenStreetMap data.

Geocoding (Address Search)

Nominatim (OpenStreetMap)

Primary address search service.

OpenStreetMap Privacy Policy
Photon API (Komoot)

Fallback geocoding service, and the place lookup behind "Further away" in Full search along route. What you type there, and a point on your route used to prefer nearby results, are sent to Komoot's servers.

Sunrise/Sunset Data

SunCalc Library

Sunrise, sunset, dawn and dusk times are calculated locally in your browser using the SunCalc JavaScript library. No external API calls are made for this data - all calculations happen on your device.

Send to Phone Relay

Cloudflare (Workers)

Used only for the optional Send to Phone feature. It briefly relays an encrypted, unreadable copy of your project across to your phone. Cloudflare cannot read your route or points of interest.

Cloudflare Privacy Policy

What Data is Sent to Third-Party APIs?

When using these services, the following data may be sent directly from your browser:

  • Geographic coordinates - Bounding boxes or point coordinates for POI searches
  • Search terms - When using address search
  • Map view coordinates - To load map tiles for the area you're viewing
  • Your IP address - As with any internet request, your IP address is visible to the service

We encourage you to review the privacy policies of these third-party services if you have concerns about how they handle data.

Optional Features

Komoot Route Import

If you use the Komoot URL import feature, your browser fetches the GPX file directly from Komoot's servers. PitStopper does not have access to your Komoot account.

Geolocation

The "Use My Location" feature requests your device's location through your browser's Geolocation API. This requires your explicit permission and the location data is only used locally to center the map - it is not sent to our servers.

Send to Phone

Send to Phone lets you move a planned project - the route, its points of interest, and any notes you have added - from the pitstopper.net website across to the PitStopper On-the-go phone app.

Encrypted End-to-End

Neither Cloudflare nor the PitStopper developers can see what you send. Your project is encrypted inside your own browser before it ever leaves your device, and only the phone that scans your QR code holds the key to unlock it. This is sometimes called "zero-knowledge" or "end-to-end encrypted".

Here is how the transfer works, step by step:

  • Encrypted in your browser first - Before anything leaves your device, the project file is encrypted using AES-256-GCM, a strong, standard form of encryption provided by your browser's built-in Web Crypto. Only the encrypted (unreadable) data is uploaded.
  • A short-lived relay - The encrypted data is passed through a relay hosted on Cloudflare Workers. Cloudflare only ever receives and briefly stores the encrypted blob - it cannot read your route or your points of interest.
  • The key never reaches the relay - The key needed to decrypt your project is placed in the QR code and link after the "#" symbol (the part of a web address known as the "fragment"), which web browsers, by design, never send to any server. Only the phone that scans your QR code receives the key, and the decryption happens locally on the phone.
  • One-time and short-lived - The encrypted blob is deleted the instant the phone downloads it, and if it is never collected it automatically expires and is deleted after about 10 minutes.

Treat the Code Like a Password

Because the key travels inside the QR code and link, anyone who can see that code or link while the transfer is live (within the roughly 10 minute window) could decrypt the file. Do not share it or post it publicly - treat it like a password. Once the phone has read the key, the app removes it from the address bar and history.

Share Project

Share Project creates a link (and a QR code) that anyone can open to view a copy of your project - the route, its points of interest, and any notes - on pitstopper.net. Unlike Send to Phone, which sends a project to one device once, a Share Project link is persistent: it can be opened by anyone, any number of times, until it expires or you revoke it.

The Same Zero-Knowledge Encryption

Neither Cloudflare nor the PitStopper developers can read a shared project. Just like Send to Phone, your project is encrypted inside your browser before it is uploaded (AES-128-GCM here, chosen for a shorter, easier-to-share link - still a strong, standard form of encryption, the same one that secures most everyday web traffic), and the decryption key lives only in the link's URL fragment (the part after the "#"), which browsers never send to any server. The relay stores nothing but the encrypted, unreadable blob.

What is different from Send to Phone:

  • Persistent, not one-time - the link stays live and can be opened repeatedly, by anyone who has it, rather than being consumed by a single device.
  • You choose the expiry - when creating a link you pick how long it stays live: 1 day, 3 days, 1 week (the default), 2 weeks, 1 month, or 2 months (the maximum). The relay enforces this expiry itself.
  • A separate relay - Share Project links are served from share.pitstopper.net, a Cloudflare Worker built for persistent, multi-read storage (Send to Phone's transfer.pitstopper.net relay is one-time only).
  • A normal, editable copy - opening a shared link loads a fully editable copy of the project into the recipient's browser, the same as opening any file. Nothing they do can change or affect your original project.
  • Revoke anytime - delete a link before it expires from Manage my shared links, and see how many times it has been opened while the Share Project dialog is open.

Treat the Link Like a Key

Because the decryption key travels inside the link, anyone who has that link can open your project for as long as it stays live - which could be up to two months. Only share it with people you intend to see your route and points of interest, and revoke it early from Manage my shared links if you change your mind.

Data Security

Since your route data never leaves your browser (except when communicating directly with third-party APIs), there's no centralised database of user routes that could be breached. Your data's security depends on:

  • Your browser's security
  • Your device's security
  • The security of the third-party APIs you interact with

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected on this page. As a client-side application with no user accounts, we have no way to notify you of changes directly - we recommend checking this page periodically if you have privacy concerns.

Contact

If you have questions about this privacy policy or how PitStopper.net handles data, please contact us at [email protected].