Privacy

What we don’t do

• No accounts: you never sign up, and we don’t know who you are.
• No ads, no traffic analytics, no cookies, no profiles.
• We don’t sell data. Apart from what you share yourself, your data goes only to the services listed below, each for its own job.
• Your recorded drives stay on your phone. They leave it only if you export them yourself.

Who is responsible

The data controller is Simone Spinozzi, a private individual who develops Hairpin. For anything about your data, write to privacy@hairpin.racing. For help with the app: supporto@hairpin.racing.

There is no data protection officer: the law does not require one for a project like this.

What leaves your phone, and where it goes

To find the roads and draw the map, Hairpin has to ask a few other services. Every request carries your IP address, like any internet connection. Here they are, one by one.

• Hairpin, through Cloudflare

  hairpin.racing · Cloudflare, Inc., USA

  What it gets

  Your IP address and the pages you open (and, if a page fails to load, a short error report from your browser). When you ask for the roads: the area of the route, with the start and the finish rounded to about 100 m (if the start is “Your location”, that is roughly where you are). Until this update the web app sent the start and the finish to about 1 m; the Android test versions 0.2 and 0.3 still do.

  When

  Every time you open the site or the web app, and when you ask for the roads. Some test versions of the apps (such as Android 0.2) also send it a check request every time they start.

  Why

  To show you the site, download the roads of the area and, in those test versions, check that the connection works. Legal basis: legitimate interest (art. 6(1)(f) GDPR) in making the service you use work.

  How long

  We don’t switch on any visit logging (the logs Cloudflare offers). The roads of an area are kept by Cloudflare for up to 7 days, to answer faster the next time someone asks for them, without your IP. Cloudflare handles the data on our behalf, under a data processing agreement.

  Where

  Cloudflare, Inc., USA, under the EU–US Data Privacy Framework (see “Outside the European Union”). Our road server in Germany (Hetzner) gets the request from Cloudflare; Cloudflare passes your IP address along in a header, but our server doesn’t use it and its log records only Cloudflare’s address. If our server can’t answer, the request goes to the public Overpass servers (next card).

• The roads from public servers: Overpass

  OpenStreetMap France · FOSSGIS e.V. (overpass-api.de) · private.coffee (formerly kumi.systems)

  What it gets

  The same road request as our server (the card above). It comes from Cloudflare, not from your phone, but Cloudflare passes your IP address along with it, in a header.

  When

  When the area of the route goes outside Italy or comes within about 1 km of its border, and when our server doesn’t answer within 5 seconds or answers with an error.

  Why

  To find the roads when our server doesn’t have them or is slow. Legal basis: legitimate interest (art. 6(1)(f) GDPR) in giving you the roads anyway.

  How long

  Each service decides, under its own rules: they are independent services, they don’t work on our behalf and we have no agreement with them.

  Where

  European Union: France (OpenStreetMap France), Germany and Finland (overpass-api.de), Austria (private.coffee).

• The place name: Nominatim

  OpenStreetMap Foundation, United Kingdom

  What it gets

  A position rounded to about 100 m: yours (from the GPS) or the point you dropped on the map; and the language of the app. When it stands in for Photon: what you type in the search boxes, without your position. The Android test version 0.2 sends the exact position, not rounded.

  When

  When “Your location” becomes the start (in the web app also as soon as you open it, if you have already allowed location), or when you drop a pin on the map. It is also the backup search when Photon doesn’t answer.

  Why

  To write the name of the place instead of its coordinates. Legal basis: legitimate interest (art. 6(1)(f) GDPR) in giving you a readable place name.

  How long

  The Foundation decides, under its own privacy policy: it records IP addresses and requests; it doesn’t say how long it keeps these records (it calls the storage temporary), and it may also use them to improve the map.

  Where

  United Kingdom and the Netherlands. The United Kingdom is covered by an EU adequacy decision.

• Search: Photon

  komoot GmbH, Germany

  What it gets

  What you type in the search boxes, while you type it, and a rough position (about 1 km) to show the nearest places first: yours if the app has it, otherwise the centre of the map. If the app is in English, German or French, also that language. The Android test version 0.2 sends no position.

  When

  When you search for a place.

  Why

  To suggest places as you type. Legal basis: legitimate interest (art. 6(1)(f) GDPR) in helping you find the place you are typing.

  How long

  komoot decides. Its privacy policy doesn’t mention Photon and gives no period for it; for the komoot website and apps it says it keeps IP addresses for 90 days.

  Where

  Germany, in the EU: that is where the Photon server is (komoot’s policy doesn’t say).

• The map: OpenStreetMap tiles

  OpenStreetMap Foundation, United Kingdom

  What it gets

  The map tiles (small square images of the map) for the area you are looking at. When the map is centred on you, that is the area around you.

  When

  When you look at the map: while choosing the route and on the large map. Not the driving screen: its small map is drawn without tiles. In the web app, tapping that small map opens the large map, which loads the tiles of the whole route (framed on the road, it doesn’t follow you).

  Why

  To draw the map. Legal basis: legitimate interest (art. 6(1)(f) GDPR) in showing you the map of the area you are looking at.

  How long

  The Foundation decides, under the same privacy policy: it gives no period for these records either. It publishes only anonymous, aggregated usage figures.

  Where

  A worldwide delivery network picks the server for each request, so it can be outside the EU.

• Email: Proton

  Proton AG, Switzerland

  What it gets

  Your message and your email address.

  When

  Only if you write to us.

  Why

  To answer you. Legal basis: legitimate interest (art. 6(1)(f) GDPR) in answering whoever writes.

  How long

  As long as it takes to handle your request.

  Where

  Switzerland, covered by an EU adequacy decision.

Your phone does the rest, under its own rules: the position is worked out by the system (Apple or Google), the voice is the system’s own, and if you download the app from a store, Apple or Google handle the download under their policies. For these, Apple and Google are controllers in their own right, not us.

Each of these services is itself bound by the GDPR, by a law the EU recognises as equivalent (United Kingdom, Switzerland) or, for Cloudflare in the USA, by the EU–US Data Privacy Framework: they give your data the same protection, and you the same rights, described on this page. What each one keeps, and for how long, is written in its card.

What stays on your phone

Recorded drives, your corrections to the notes, recent routes, roads saved for when there is no signal, and your settings stay in the phone’s storage. They are also in the backups your phone makes to your Apple or Google account: those are your copies, not ours.

They leave the phone only if you export a drive or share a route. To delete them, delete them in the app, or uninstall it.

No cookies. The site remembers the language you pick, and the web app your settings, in the browser’s own storage, on your device only, because they need them to work.

A route link carries the start, the stops and the finish, with their names and their coordinates to about a metre: if the start is “Your location”, the link says where you are. It goes wherever you send it. The part after the # never reaches our server.

How long

We keep nothing that says who you are, apart from the emails you send us, only for as long as it takes to handle the request. Otherwise we keep only the road data of an area, for up to 7 days, without your IP. What the other services keep is written in their cards above.

How your data is protected

Every connection the site and the apps make travels encrypted (HTTPS), including the one from Cloudflare to the road servers; the versions we publish don’t allow unencrypted connections. What stays on your phone sits in the storage reserved to the app (for the web app, to the site, in your browser). We don’t switch on Cloudflare’s visit logs, our road server’s log records only Cloudflare’s address, and Cloudflare handles the data only on our behalf, under a data processing agreement.

Outside the European Union

Three recipients are outside the EU. Cloudflare (USA): the transfer relies on an EU adequacy decision, the EU–US Data Privacy Framework (art. 45 GDPR, decision 2023/1795), to which Cloudflare is certified; if its certification lapses, the Commission’s standard contractual clauses already in its data processing agreement (section 6) apply. The OpenStreetMap Foundation (United Kingdom), covered by an EU adequacy decision, whose map network can serve you from anywhere in the world. Proton (Switzerland), covered by an adequacy decision. komoot, our road server and the public Overpass servers are in the EU.

Your rights

You can ask to see your data, correct it, delete it, limit its use or take it with you (articles 15 to 20 of the GDPR). Write to privacy@hairpin.racing: we answer within a month. Unless you have written to us, we keep nothing linked to you, so we will often have nothing to show; if so, we will tell you. For what Nominatim, the map, Photon and the public Overpass servers receive, you can also write to them directly.

Right to object. Everything described in the cards above is based on legitimate interest, so you can object to it at any time, on grounds relating to your particular situation (art. 21 GDPR): write to privacy@hairpin.racing or, for what they receive, directly to Nominatim, the map, Photon and the public Overpass servers. One limit: the services your phone contacts directly cannot answer without receiving your IP address, and on the road requests to the Overpass servers Cloudflare passes your IP address along in a header that cannot be removed; so for that part objecting means not using the service.

You can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority of the country where you live.

You don’t have to give us anything. Your position is what lets the app follow the road while you drive; without it you can still type places and read the notes. No automated decisions are made about you.

Children

Hairpin is made for people who drive. We don’t ask anyone’s age and we don’t build profiles of anyone.

Driving in a group

If you create a group, or join one from a link, your position is shared with the rest of the group while you drive. Only if you say so, on the group’s own sheet: “Share and watch” or “Watch without sharing”.

• The group

  gruppo.hairpin.racing · Cloudflare, Inc., USA

  What it gets

  Your position (to about 1 m), your direction and the time, every 5 seconds while moving and every 30 when stopped, with the nickname you choose (up to 12 characters). Never your speed.

  Who sees it

  Everyone who has the group link. Anyone watching without sharing shows up to everyone as “+1 watching”.

  How

  It is encrypted on your phone (AES-256-GCM) with a key that travels only inside the link, in the part after the #, which never reaches the server. Our group server only forwards data it cannot read, and does not store it. Cloudflare sees your IP address, as with any connection.

  How long

  A group lasts 12 hours at most, or until whoever created it closes it. After that the server keeps only the group code and its expiry, for 7 days, so an old link cannot reopen it. The key is deleted from your phone when the group expires, and it never goes into backups.

  Why

  To see each other on the map while driving together. Legal basis: your consent (art. 6(1)(a) GDPR). You can withdraw it at any moment with “Stop sharing”, even while driving; withdrawing it does not affect the lawfulness of what was sent before.

Replays and simulated drives never transmit. Nobody else’s position ever ends up in your recorded drive or in an export. Share the link only with people you know.

Changes

If something changes, we write it here and update the date at the top. If a new feature sends something new off your phone, the app asks you before it does.