Privacy Policy

This policy covers the EveryByway app for Android and the everybyway.com website. EveryByway is made and run by one person, David Townsend ("I", "me"), who is responsible for your data. If anything here is unclear, email me at hello@everybyway.com.

If you use the app without Premium

Whether or not you've signed up, the app records your rides on your phone and keeps them there. Your rides, GPS points and settings are stored only on your device. They are not sent to me, and they are not included in Google's cloud backup of your phone. Uninstalling the app deletes them.

The map in the app is loaded from everybyway.com, but your own rides are drawn from the data on your phone, not downloaded from my server.

If you have Premium

Some Premium features only work if data is stored on my server. Each one is something you choose to turn on:

• Sync: when you turn sync on, your rides and their GPS points are uploaded so you can see them on the website and keep them if you change phone. Turning sync off stops further uploads.
• Live sharing: while you have an active live share, your position is sent to my server as you ride, so the people you've given the link to can follow you. Anyone with the link can see your live location while you're riding, so only share it with people you trust. When the share ends or you sign out, live uploads stop.
• Home areas: a home area hides rides near your home from anything public: shared rides, live views and public pages. When you add one in the app, your phone sends its current position to my server. Anyone signed in can also add one on the website, by tapping their home on a map or letting their browser share its location; that point is sent to my server instead. Either way, the server doesn't store that exact point. It stores a circle between 400 and 800 metres in radius, placed at random so that your home is always well inside it but never at its centre.

Sharing a ride

You can share any ride that's on my server, whether it was synced from the app or imported from a GPX file. Anyone with the link can see it, apart from any parts inside your home areas. You can set up a home area in the app or on the website. If you don't have one, a shared ride shows the whole route, including where it starts and ends.

Your account

If you sign up, I store your email address, your name if you give one, and your password in a scrambled form that can't be reversed. I use your email only to sign you in, to send password reset emails, and to tell you about important changes to the service.

When you sign in or turn on sync, the server also stores a random ID for the app on your phone and your phone's model name (for example "Pixel 8"), so it can recognise your device.

Anyone can plan routes and search for places on the website, signed in or not. The route points and search text are sent to my server, which asks a routing or place-search service on your behalf (see "Other services" below). The server counts each request, so it can share out the routing allowance, but doesn't keep what you searched for. Which roads on a planned route are narrow lanes or unpaved is worked out on my server, from my own copy of OpenStreetMap data, without sending the route anywhere or keeping it. Planned road closures along a route are checked the same way, against the official closure lists my server downloads, and the route isn't kept. Otherwise, only routes you save, and rides you import from a GPX file, are stored on the server with your account. If you share a planned route without signing in, the route is stored on my server with no account attached, so that the link works. Anyone with the link can see the whole route, including where it starts and ends. It's deleted if nobody opens the link within 30 days of you sharing it, or once nobody has opened it for 6 months. If you're signed in, a shared route stays in your account and leaves out anything inside your home areas. Downloading a planned route as a GPX file on the website happens on your device; the server receives only an anonymous count that a GPX was downloaded, with the same daily code and nothing about the route.

Premium is bought through Google Play. Google handles the payment, and I never see your card details.

If you're signed in when you buy Premium, or sign in later, the app sends me the purchase's Google Play token. I use it to ask Google whether your subscription is active, and I keep the token, which plan it is, its state and its renewal or end date, so the website and my server know you have Premium. Google also tells me when it renews, ends or is refunded. If you buy Premium without an account, Google still tells me when a subscription starts, renews, ends or is refunded. I only count those: I keep the date, the plan and what happened, and nothing that could lead back to you or your purchase. When you delete your account, I delete these records.

Information collected from everyone

• Server logs: my server sees your IP address whenever the app or website loads, but it doesn't keep a log of your visits. It records technical errors, which can include your IP address, and deletes them after 14 days.
• Error reports: when something goes wrong in the app or on the website, it sends me an error report. This contains the error message and technical details of where in the code it happened, the page it happened on, the app version, your phone's model and Android version, and your account if you're signed in. The report is logged with your IP address, and that log is deleted after 14 days. The error details are kept for up to 30 days. A short summary of each distinct error, without your IP address, is kept until the problem is fixed, and deleted 30 days after it last happened.
• Page counts on the website: the website counts page views: which page, the name of the website that linked you here (for example "reddit.com", never the page you were on), any campaign tags in the link you followed (such as "utm_source=newsletter"), and a code that changes every day and can't be traced back to you. Page counts are never linked to your account, even when you're signed in. They're kept for a year. This uses no third-party analytics. Views inside the app aren't counted. The website also counts a few actions, such as planning a route, sharing one, opening a shared route, downloading a GPX or playing a replay, with the same daily code and never linked to your account. The app counts opening the Premium screen and starting, completing or cancelling a purchase, with no code, no account or device id, and only the date.
• Where sign-ups come from: if you sign up on the website, your account notes which site or campaign link first brought you to EveryByway, so I know what's working. Sign-ups in the app don't record this.
• Messages you send me: if you use the contact form, I receive your message, your email address (the one you type in, or your account's email if you're signed in), your app version, your plan and your phone model. They are delivered to me through a private Discord channel.

Cookies

The site uses only the cookies it needs to work: one that keeps you signed in, one that remembers your sign-in between visits, and one that protects forms against forgery. There are no advertising or tracking cookies.

The site also keeps a few small settings in your browser's own storage, such as whether you've already seen the introduction. These stay on your device and aren't sent to me.

Other services

EveryByway relies on a few other services. Each one only gets what it needs to do its job:

• OpenStreetMap provides the map tiles. Your device downloads them directly, so OpenStreetMap sees your IP address and which area of the map you're looking at. OpenStreetMap's Nominatim service also names places for me: the towns along your journeys, and the start point you tap when planning a route. Those lookups go from my server, not your device. For navigation's petrol, coffee, toilet, police and hospital buttons, my server also asks OpenStreetMap's Overpass service for those places in map squares about 28 km across, along the routes you plan and the route you're riding. It sends only each square's corners, not the route line or who you are, though a run of squares asked for together follows the route roughly. It keeps the answers to share with every rider who passes that way.
• OpenFreeMap provides the map for in-app navigation. It sees your IP address and the area shown.
• Stadia Maps calculates routes and runs the route planner's place search. When you plan a route, my server sends it your route points. If you choose to avoid road closures, it also sends where those closures are, which is public information. When you search for a place, my server sends it what you type and roughly where the map is centred (to within about 11 km), so nearby places come first.
• Esri provides the satellite view. When you switch to it, your device downloads the photographs directly, so Esri sees your IP address and which area of the map you're looking at.
• Bunny Fonts and unpkg serve the fonts and some of the map code, so they see your IP address.
• Pusher serves the code that makes live share pages update, so it sees the IP address of anyone viewing one.
• Amazon Web Services hosts the server and database and sends password reset emails.
• Google handles Play Store purchases and app updates. The app uses Google Play services to get your location on your phone. It also confirms Premium subscriptions to me, using the purchase token Google issued.
• Discord is where I receive error alerts and contact form messages.

I don't share your information with anyone else, except where the law requires it.

Deleting your data

• Without an account: uninstall the app, or clear its data in your phone's settings. Nothing else is held about you apart from the short-lived logs and error reports described above.
• With an account: you can delete your account from the website. This permanently removes your name, email address, password, every ride and all of its GPS points, your planned routes and collections, devices, home areas, live shares, public share links, and any links between you and riders you follow or who follow you. Rides saved on your phone stay there until you delete them or uninstall the app.
• If you can't get to the website, or you want a copy of what I hold about you, email hello@everybyway.com and I'll sort it out within a month.

Under UK data protection law you also have the right to ask me to correct your data, to object to how I use it, and to complain to the Information Commissioner's Office (ico.org.uk).

Why I use your data

I use your data to provide the features you ask for (the contract between us), and for things I have a legitimate interest in: keeping the service secure and fixing bugs. I don't use it for marketing, profiling or advertising.

Security

Connections to EveryByway are encrypted, passwords are stored in a form that can't be reversed, and access to the server is restricted to me. No system is perfectly secure, but I take reasonable care to protect your information.

Children

EveryByway is not meant for anyone under 13, and I don't knowingly collect information from children under 13. If you think a child has given me personal information, please email hello@everybyway.com and I'll delete it.

Changes to this policy

If this policy changes, I'll update this page and the date below. If a change affects what I store about you, I'll tell you in the app or by email before it takes effect.

This policy was last updated on 16 October 2026.