Privacy policy

1. Controller

IEX Labs UG (haftungsbeschränkt), Talstraße 27, 94209 Regen, Germany, represented by its managing director, Amadeus Lederle. Email: info@iexlabs.com.

2. The essentials in brief

• You can use NavX4 without an account and without signing in.
• Statistics (Google Analytics) only run on the web and only if you expressly agree in the cookie banner; without consent the website loads nothing from Google. There is no advertising tracking.
• Only if you allow it, ML Kit from Google looks for faces on your photos on your device in the Android app so that you can blur them before uploading. The image does not leave the device for this; Google does, however, receive diagnostic data including an identifier of the device or the installation. Without your consent the app does not start ML Kit; app versions up to 0.44.0 do not ask beforehand yet (section 5t).
• Location data is only used after you expressly allow it in the browser or in Android; you can plan and use the map without this permission as well.
• Other people only see your location if you share it yourself. Live, this happens with location sharing in a group tour, which you switch on for each tour individually; the participants then see only your latest position, no route travelled, and it is deleted as soon as you stop sharing, leave the tour or the tour ends, and at the latest a little over an hour after it turns twelve hours old (section 8a). It also happens with “Share a ride by link” (section 5r), over group radio without a network (section 5s) and with a help call in a tour, including the one after a detected fall if you have switched on fall detection (section 8a). Places you show yourself, such as where a photo was taken, the place of a post or of a problem report on a track, and public places, are seen by others as you release them (sections 8a and 9).
• A drive only goes to your account if you agreed in the Android app before the first drive report – together with the driven line, simplified to about ten metres. You can withdraw your consent at any time and delete every drive, line included, one by one (sections 5 and 8a).
• With an account we store more: drives, points, achievements, friendships, clubs, photos. Section 8a lists every category; section 9 says how to get rid of all of it again.
• Routing and address search run on our own servers in Germany.
• The cockpit of the Android app processes notifications, media, vehicle, tyre pressure and camera data on your device only; the app fetches vehicle values from your own Home Assistant instance directly from there, without our server. For the weather only a coarsely rounded grid cell goes to our server, and the weather can be switched off (section 5a).
• The speed camera warning of the Android app is off by default. When switched on, it calculates on your device; positions are neither stored nor transmitted for it (section 5b).
• If the Android app guides an imported GPX file with turn instructions, the file’s line goes to our server for the calculation and is discarded afterwards; curve guidance and warnings are calculated by the app itself (section 5c).
• If you search for places nearby (fuel, food, accommodation …) or use Auto-POI, the app or the browser loads tiles with places from our server – without your location and without an identifier; the search runs on your device (section 5f).

3. Hosting and server logs

navx4.app runs on our own servers at IONOS SE (Germany). When you open the site, the web server necessarily processes your IP address as well as the date, time and requested resource in connection and error logs. This data serves solely operational security and error analysis and is not combined with other data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation).

To keep single senders from slowing down route calculation for everyone, the server counts route, round-trip and place-search requests per IP address in memory for at most one minute; the address is not stored. The legal basis is Art. 6(1)(f) GDPR.

Update check of the Android app. On start, the app fetches the file app-version.json from navx4.app to see whether a newer version is available on Google Play – and every time you tap “Check for updates now” in the info area. Only the log data named above is produced; the app sends no identifier and no information about you or your device. The automatic check can be switched off in the info area or limited to Wi-Fi. Installation happens exclusively through Google Play. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in offering you bug fixes).

3a. Google Analytics (only with consent)

If you agree in the cookie banner, we use Google Analytics 4 by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to understand how NavX4 is used. This processes, among other things, the pages visited, time spent, browser and a shortened IP address; data may be transferred to Google servers in the USA (Google is certified under the EU-US Data Privacy Framework). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent no Google script is loaded. You can change your decision at any time via “Cookies” at the bottom left of the map; the retention period of the Analytics data is limited to 14 months.

4. Cookies and local storage

Without your consent we only use cookies and storage entries that are technically required (Section 25(2) no. 2 TDDDG):

• Sign-in cookies (only when using an IEX Labs account): HttpOnly cookies with access and refresh token as well as short-lived cookies securing the sign-in process (OAuth state, PKCE). They are strictly necessary for signing in.
• Interface cookie: remembers the state of the sidebar (open/closed).
• Device identifier (localStorage, navx4-device-id): a randomly generated identifier with no link to name or email. It has only one task left: moving routes that an earlier version of NavX4 without an account assigned to this device into your account as soon as you open your saved routes while signed in. Reports, comments, ratings, tracks and new saved routes exist only with an account – the device identifier assigns nothing to them. The planner also sends it with every route calculation; the route calculation neither evaluates nor stores it. You can remove it at any time by deleting the site data in your browser.
• Consent storage (localStorage, navx4-consent): remembers your cookie decision.
• Language choice (localStorage, navx4-locale): remembers the interface language chosen in the account dialog (one of the ten interface languages). The entry is only created if you change the language there manually; without it, your browser’s language applies. The setting stays on your device and is not transmitted to us.
• Units (localStorage, navx4-units and navx4-einheiten): remember your choice for distance and, separately, for altitude, speed and time of day. The entries are only created by your choice in the account dialog, stay on your device and are not transmitted to us. In the Android app, units, the language of the app and of the announcements and the settings of the update check are also kept in the app’s settings on your device; they do not go to us, but like the other settings they are included in the Android device backup if you have switched it on.
• Display of your places (localStorage, navx4-orte-darstellung): whether the web planner shows your places on the map and which categories are hidden. The entry is only created when you change this in the places manager, stays on your device and is not transmitted to us.
• Sorting of your places (localStorage, navx4-orte-sortierung): how the web planner sorts the list of your places. The entry is only created when you choose a sort order, stays on your device and is not transmitted to us.
• Store hint (localStorage, navx4-play-hint): remembers that you closed the hint about the Android app on Google Play in the planner. The entry is only created by closing it, stays on your device and is not transmitted to us.
• Pending account preference (localStorage, navx4-preferences-outbox): only created with an account and only if your choice of vehicle, route profile and avoidances did not reach us just then (offline or server fault). Exactly this choice is stored so that it can be sent as soon as there is a connection again; the entry is deleted afterwards. After 24 hours it expires unused. It contains no positions, no routes and no names.
• Map layers (localStorage, navx4-kartenebenen): remembers which additional map layers you switched on in the layers panel, their opacity and the addresses of your own tile sources (section 6). The entry is only created by your choice in the panel, stays on your device and is not transmitted to us.
• Zoom level at the scale bar (localStorage, navx4-massstab-zoomstufe): only remembers whether the zoom level is shown next to the scale bar of the map (switch in the layers panel). The entry is only created by your choice, stays on your device and is not transmitted to us.
• Off-road layer (localStorage, navx4-wegegrad): only remembers whether you switched on the off-road layer (section 6). The entry stays on your device and is not transmitted to us.
• Map colour preset (localStorage, navx4-farbsicht): remembers which colour preset you chose in the map legend – standard or a preset for red-green or blue-yellow colour vision deficiency (section 6). The entry is only created by your choice, stays on your device and is not transmitted to us.
• Loaded files (localStorage, navx4-geladene-dateien): which entries of your library are additionally shown on the map (only their identifier), whether they are visible and in which colour. The entry is only created by your choice, stays on your device and is not transmitted to us.
• Route display (localStorage, navx4-linienstil): colour, width and opacity of the route, direction arrows, size and names of the waypoint markers, and whether it is coloured by gradient and shows distance markers. The entry is only created by your choice, stays on your device and is not transmitted to us.
• Map style (localStorage, navx4-kartenstil): map theme, high contrast, road colours, map language, scale and which roads, places and labels appear from which distance. The entry is only created by your choice, stays on your device and is not transmitted to us. “Like the device” only reads whether your system is set to light or dark.
• Offline storage (Cache Storage): at your request (“Offline” button) stores the planned route and map tiles along it locally in your browser so that navigation works without an internet connection. The data does not leave your device and can be removed by deleting the site data.
• Google Analytics cookies (_ga, _ga_*): are only set after your consent (see section 3a).

5. Location data (navigation)

For navigation and the “Use current location as start” function, your browser actively asks you for permission (Geolocation API). Without your permission there is no access to your location. For the route calculation, the start, destination and any intermediate coordinates are transmitted to our own routing server and processed there only to calculate the route, not stored permanently. Your current position during navigation stays on your device. The same applies to the measuring tool in the planner: it only asks for your location if you choose “Distance to me” and calculates the distance on the device. If you tap the location button on the map in the Android app, the map follows your location: while following is on and the app is visible, it reads your location about once per second only to move the map – it stays on the device and is not stored; a second tap ends following. “Save location” in the quick actions measures once and creates a place of your own, like the places manager (section 8a, “My places”). A coordinate you type in (for example decimal degrees, UTM, MGRS or Plus Code) is also read by your device; it does not go to the place search service. You can withdraw the permission at any time in your browser settings or in your phone’s system settings. The legal basis is Art. 6(1)(b) GDPR (providing the function you requested).

Sections and route repair. If you plan sections with their own profile or as a straight line, the same points and, per section, the chosen type go to our routing server. If you have a route repaired, the planner sends the same request as for a calculation to our server; it recalculates the sections one by one, looks for the nearest drivable road for individual points and returns a suggestion. Nothing is stored – whether you apply the suggestion is up to you in the planner. The legal basis is again Art. 6(1)(b) GDPR.

Start map in Android Auto. While NavX4 is shown in the car without a drive running, the Android app measures your position about every two seconds using your phone’s location (GPS and Android’s network location) to show you on the map in the car – only with your location permission. The measuring stops as soon as NavX4 no longer draws the map in the car (at the latest when NavX4 is closed in the car) or a drive starts. The position stays on your device; it is neither stored nor transmitted for this. In addition, the app remembers the chosen base map (standard, relief or satellite) in its settings on the device; like the other settings, it goes into the Android device backup if you have switched that on.

Exceptions where a location reference does reach us. First, location sharing in a group tour: if you switch it on for a tour, your device reports your position to our server so that the other participants see you on the map (see section 8a). Second, a photo you upload: we store the place where it was taken, because a photo without a place helps nobody. Both can be switched off or deleted; neither happens without your action. Third, the drive report with driven line: if you finish a guided drive while signed in and have agreed to drive reports, the app sends the drive together with the driven line to our server. The line consists of the parts of the guided route you actually drove, simplified to about ten metres – not the raw chain of your GPS positions and without a timestamp per point. We need it so that unpaved kilometres only count in full the first time, and we show it to you – and only to you – as a map of the drive in your drive history (section 8a, “Driven lines”). Without an account no drive and therefore no line is transmitted. Further exceptions are described with the respective feature, and each requires your action or your switch: sharing a ride by link (section 5r), help calls in tours including after a fall, theft protection, joining nearby, your own places, events and the place of a feed post (section 8a), and a problem on a track with your position (section 9). Only for computing, without us storing them, our server also receives: the points of a route calculation (above), the line of a file for track guidance (section 5c), the line of the one-way check (section 5l), rounded grid cells and route points for weather and hazard warnings (sections 5a and 5m), and your position for “Closest first” and the search for places and events nearby (section 8a).

Consent to drive reports. Before the Android app reports a drive to your account for the first time, it asks you – stating what is transmitted: start and end time, distance, the unpaved share of it, elevation gain and loss, the route you followed and the driven line. Until you answer, the finished drive stays in the app on your device and does not go to us. If you say “Don’t report”, it is discarded, and future drives do not go to us either – there are no points then. Our server only creates a new drive if the app sends this consent along: if an older app version that does not ask yet sends a drive, we reject it without storing any of it; it stays in the app on your device until you update the app and agree. The app remembers your answer per account in its settings on the device, together with the version of the question and the time; like the other settings it goes into the Android device backup if you have switched that on. If what a drive report transmits changes, the app asks again. You can change your answer at any time in the drive history (“Report drives”). Withdrawing applies to all later drives; the app discards drives not yet reported. What is already with us you delete one by one in the drive history or all at once (section 9). The legal basis for transmitting and storing the drive and the driven line is your consent (Art. 6(1)(a) GDPR); for the plausibility checks and the comparison against points abuse it is our legitimate interest (section 8a).

5a. Cockpit of the Android app

The Android app has a cockpit: a driving screen with displays you put together yourself. Apart from the weather and the vehicle values from your own Home Assistant instance, your device measures or reads its values itself. The cockpit only makes its own network requests for the weather and – if you connect it – to your Home Assistant instance (both below) and – only if you turn sync on – to your account (rider profiles, below); in addition, the map in the cockpit loads its tiles like the map in the planner, and if you start guidance from the cockpit, section 5 applies to the route calculation.

Rider profiles and trip counters. In the cockpit you create up to six rider profiles (name, vehicle name, colour) and set up two start pages per profile. For each profile the cockpit counts two trip counters (trip A and B: distance as well as total, moving and stopped time) and the total distance; counting goes to the currently active profile. For this it evaluates the location tracking that is running anyway – during navigation, a recording, or while the cockpit is on screen. The cockpit only opens its own location tracking while it is visible or a map overlay card with a location value is on the map (see “Map overlays” below) – both only while NavX4 is on screen; it only asks for location permission when you tap “Allow location” there. Stored are totals, settings and individual points in time (such as the last count) – no positions and no routes. The cockpit also remembers per profile when it should reset your trip counters automatically, whether both trips are reset and whether only the selected trip counts, and which of your saved routes are on the favourite tiles (only their identifier on the device). The distance on a favourite tile is calculated by the app on the device as a straight line and is not stored.

Profile photos, settings per profile and device report. You can give a rider profile a photo. You pick it with the Android photo picker; NavX4 only receives this one image, gets no access to your other photos and needs no permission for it. The app scales it down to at most 512 pixels on the longer side and stores it in the app’s private storage on your device (folder profilfotos, excluded like the cockpit file from the Android device backup and from the transfer to a new device). It is not transmitted; when you delete the profile or the photo, the app deletes the file. For each rider profile the cockpit file also holds the settings for units, map, guidance, warnings, GPX track guidance, auto POI and background operation; when you switch profiles the app swaps them on the device. Under “Version and diagnostics” the app creates a device report on request: app and Android version, device manufacturer and model, language, whether the device is online, the state of the permissions and of battery optimisation, free storage and the number of offline regions and rider profiles – without location, account, routes or profile names. It stays on the device until you pass it on yourself via the Android share menu or copy it to the clipboard; NavX4 does not send it.

Rider profiles in your account (only on request). By default your rider profiles do not leave the device. If you turn on sync in the profile management or under Account, the app transfers them to your NavX4 account: per profile the name, vehicle name, colour, the set-up of home screens, bars and overlays, the trip and total counters (sums, no positions) and the settings per profile (units, map, guidance, warnings, GPX track guidance, auto POI, background operation), plus the device manufacturer and model so you can see where a version came from. Not transferred: which profile is active, profile photos, device pairings (addresses of adapter, cameras, switch box, CAN module, tyre pressure sensors and buttons), app shortcuts and app widgets, collected notifications and muted apps, and the favourite tiles. The server stores exactly one version per account with a revision number and time; at navx4.app/konto/fahrerprofile you can change name, vehicle, colour and units in the browser. “Remove from account” (app or browser) deletes the version, as does deleting the account, and the account export contains it. The legal basis is Art. 6(1)(b) GDPR, because you turn sync on yourself. On the device the app remembers, outside the Android device backup, whether sync is on and which version it last synced.

Offline snapshot of the community. So that friends, shared tours and clubs can be seen without a network, the app keeps the lists it last loaded (names and identifiers of your friends, open requests, tours with title, time and participants, clubs) on the device – outside the Android device backup and only for the signed-in account. It deletes them when you sign out; they are not transmitted.

GPS displays and orientation sensors. While the cockpit is on screen, the app shows values your device measures itself: position, accuracy, altitude, speed, the time of the satellite signal, how many satellites the device receives and uses, the direction of travel from compass or movement, pitch and roll from the orientation sensors, and battery level and charging state. In the status bar it also shows the device’s date and time, whether and how it is connected to the network (Wi-Fi, mobile data or no network, as reported by Android), on request the free memory and, instead of the battery level, the charging or discharging current or the battery temperature, and whether a drive is currently being recorded. Sunrise and sunset in the weather forecast are calculated by the app from your location on the device; nothing goes to the network for this. The declination for the direction to true north is calculated by the app with the system’s magnetic field model from your last location; if the device reports no height above sea level, from Android 14 on it converts with the system’s geoid model – both on the device. These values are only displayed, not stored and not transmitted. The only thing stored is which vehicle class the zero setting of the tilt applies to; the zero setting itself stays, as before, with the settings of the app’s tilt display.

Compass on the map. During navigation, while you are standing still, the app turns the following map to the direction your device is facing – only if “Turn with the compass when standing” is switched on. For this it reads the device’s compass and orientation sensors, and only while the map is being followed like this; it calculates the declination as in the cockpit from the last location the device knows. These values are not stored and not transmitted. Stored on the device are only the map settings (follow mode and switch, the last chosen zoom and the tilt of the 3D view) – like the app’s other settings.

Appearance by light sensor. If you choose “Light sensor” in the display settings, the app reads your device’s ambient light sensor while it is on screen and switches between light and dark appearance accordingly. The readings are evaluated on the device for this purpose only, not stored and not transmitted. The display settings themselves (appearance, accent colour, font, display size, orientation) are kept with the respective rider profile in the cockpit file on your device.

Map style. Map theme, high contrast, road colours, map language, scale and visibility of the map are kept with the respective rider profile in the cockpit file on your device; they are not sent to your account, not even when rider profiles are synced. If you choose “Light sensor” as the map theme, the app reads the ambient light sensor as described for the appearance – on the device only, without storing or transmitting. The base map style from which the app calculates your chosen version is fetched from the same map service as before (or taken from the offline package) and kept on the device, so the map looks the way you set it even without a connection.

Voice guidance: volume by speed and advance notices. If you turn on “Louder with speed”, the app adjusts your device’s media volume to the measured speed during guidance and restores it afterwards; how often a manoeuvre is announced in advance also depends on the speed. The speed is evaluated on the device for this purpose only, not stored and not transmitted. Both settings are kept with the respective rider profile in the cockpit file on your device. If text-to-speech has no voice for your announcement language, the app speaks English or German; it only asks your device’s text-to-speech which voices are installed.

Notifications, media and apps. If you allow it in the Android settings (“Notification access”), the app reads your device’s notifications – app, title, text and time, including those of text messages and calls; to classify them as a call or text message, also their category and which apps are set as default for text messages and phone on the device. While the cockpit is visible, it also reads the media currently playing (app, title, artist, album art, position and length of the track). It shows both in the cockpit, counts unread notifications (also as a badge on the cockpit button in the planner), removes them at your request – as in the notification shade, also from Android itself – and controls play, pause, the next track and, at your request, the position within the track. This content stays in the app’s memory; it is neither stored nor logged nor transmitted to us or third parties. As long as access is granted, Android connects the notification service even when the app is closed (for example after restarting the phone) and starts the app in the background for this; such a start does not trigger any network access by the app. For the app shortcuts and the “All apps” list, the app asks Android for the apps with a launcher icon, and, to pre-fill shortcuts that have never been set up, which apps are the defaults for map, music, phone and settings; this does not leave your device either. Stored are only: up to which point in time you have seen your notifications, whether muting is on and which kinds (apps, calls, text messages) still appear, and per profile the apps you placed as shortcuts (package name, launch screen and name of the app, plus the icon and colour you give a slot). You can revoke access at any time in the Android settings. If you add the “App widget” row in the cockpit, the app asks Android for the apps that offer widgets and shows their names for you to choose from; the chosen widget is drawn by the app that offers it, NavX4 only displays it and does not read its content. Stored per profile is only which widget it is (the identifier Android assigns and the name of the provider). With the first widget, Android asks in its own dialog whether NavX4 may create widgets.

Pop-up, replies and app selection for notifications. With the same access the app shows a newly arrived notification as a pop-up over its own screens and, if you wish, flashes the screen edge – only while NavX4 is open. “Open” and “Reply” use the intents the sending app itself put into its notification: a reply (one of your quick replies or your own text) goes to exactly that app, as from Android’s own notification shade; NavX4 does not store it and does not send it to us. For the list of apps you can hide one by one, the app asks Android for the apps with a launcher icon and adds the apps currently showing a notification. Only your settings are stored, in the cockpit file on your device: pop-up on or off, how it closes, button focus, “calls only”, flashing, your quick replies and the package names of the hidden apps.

Community notifications. If you are signed in and have not switched off “Community: requests and invitations”, the app asks our server about every 15 minutes – Android decides exactly when – whether, since the last check, there are friend requests to you, accepted requests from you, invitations to tours or clubs, started tours you take part in, or join requests to clubs you lead or moderate. The server reads this from the data that exists for it anyway (section 8a) and creates nothing new for it; what is transferred is the kind, the time, the name of the person who triggered it and the title of the tour or club. Nobody who is blocked with you triggers a notification. The app shows a notification from it (also in Android Auto) and keeps on the device only the time of the last check, the identifiers of the most recently notified events and which account this applies to. There is no third-party push service and no device identifier; the check runs with your sign-in. You can switch it off in the cockpit under “Notification settings” or in Android’s settings for the “Community” channel. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

Notifications per content type. In the app’s account panel and at navx4.app/konto/benachrichtigungen you can switch off individual content types – such as tour invitations, new club events or help calls. All that is stored in your account for this is which content types are off and when you last changed it; the row is only created once you save the setting. The server then no longer delivers switched-off content types in the check above, on none of your devices. The setting is part of your data export, stays when you delete only your content, and is deleted with the account. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

Vehicle data and action cameras. If you pair an OBD2 adapter (ELM327) with your phone and choose it in the cockpit, the app reads via Bluetooth the values you choose to display – such as engine speed, temperatures, on-board voltage, speed, fuel level or consumption –, continuously the state of the engine warning light and the number of fault codes, and, when you open the fault display, the stored, pending and permanent fault codes. At your express request and after a confirmation it clears the fault codes. It does not read the vehicle identification number. To choose the adapter it shows the Bluetooth devices paired with your phone (name and address). If you add a camera, the app searches for GoPro and DJI cameras nearby for 20 seconds; afterwards it starts and stops their recording and shows recording state and battery level. The app is only connected while the cockpit is on screen, background operation keeps it (section 5g) or a map overlay card with a vehicle value is on the map (see “Map overlays” below) – the latter only while NavX4 is on screen. Vehicle values, fault codes and camera data are only displayed: they stay in memory, are not stored and are not transmitted to us or third parties. Only your settings are stored: name and Bluetooth address of the chosen adapter and of up to three cameras, per profile which values are shown, and for the fuel simulator the range of a full tank, the reading of the app’s distance counter at the last refuelling and the remaining range from which the cockpit warns; for the service counter the interval, the remaining distance for the reminder and the reading of the distance counter at the last service; and the names you give your cameras. The app only asks for Bluetooth permission when you allow it for an adapter or search for a camera (from Android 12 “Nearby devices”); up to Android 11, searching for cameras needs location permission because Android classifies Bluetooth scanning that way – the app does not determine a location from it.

OBD adapters on the USB port and DJI cameras. If an OBD adapter is plugged into your phone’s USB port, the app lists it in the adapter choice with the name it reports and its vendor and product ID; for that device Android asks you once whether NavX4 may access it. Over the cable the app reads the same as over Bluetooth. It also asks the adapter for its chip ID and the protocol it speaks and shows both; if you wish, it sends the adapter the sleep command when the cockpit closes, sets an idle time on adapters with an STN chip or resets it to factory settings. Only the chosen bus protocol and these switches are stored. The camera search finds DJI cameras as well as GoPro cameras. With DJI the app registers with an ID of six random bytes that it draws once and keeps in the cockpit file on your device so the camera recognises your phone again – it is not an ID of your phone. The first time, you confirm the connection on the camera’s screen; the app remembers that it has been confirmed. From the camera it reads the recording state, battery level and model. None of this is sent to us or to third parties.

OBD2 values in the recording. If you switch on “Log OBD2 values” in the recording settings (off by default), the app adds to a trip recording, at the chosen interval (1 to 10 seconds), the values the OBD2 adapter is currently reading for the vehicle displays – such as engine speed, coolant temperature or supply voltage – each with its time. They are kept with the recording on your device. They only leave it in a GPX or CSV file that you save or share yourself; the CSV file contains the time, position and elevation from the recording for each value. They are not included when you upload a recording or in the library in your account. If you delete the recording, they are gone with it.

Vehicle data from your Home Assistant instance. If you connect your own Home Assistant instance in the cockpit under “Vehicle data”, you enter its address and a long-lived access token that you created in Home Assistant. The app checks both with a request to your instance and only stores them afterwards – encrypted with a key that is kept only in your phone’s protected key store (Android Keystore), in a folder excluded from the Android device backup. It only connects via HTTPS and only to the address entered; it does not follow redirects. While a vehicle data display is visible in the cockpit or on the cockpit board in Android Auto, it queries your instance for the values you chose – such as fuel level, range, odometer, tyre pressure, doors or locking –, each at most once per minute, and after an error at growing intervals. When you pick a value, it loads the list of your instance’s entities with name and current state for this. This connection runs directly between your phone and your instance: our server is not involved and receives neither address nor token nor values. Your instance – or a remote access you use for it, such as Home Assistant Cloud – sees your IP address, as with any access. Values and the entity list stay only in the app’s memory; per profile only the identifiers and names of the chosen values are stored (in the cockpit file, see below). With “Disconnect” the app deletes address and token from your phone; you can also revoke the token in Home Assistant at any time. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

Tyre pressure caps. If you assign commercially available Bluetooth valve caps to your wheels in the cockpit under “Tyre pressure”, the app listens to the radio advertising of these caps: pressure, temperature and battery level of the cap, plus its Bluetooth address. Nothing is connected in the process – such caps broadcast openly, anyone within range can read along. The app only scans while at least one cap is assigned and the cockpit is on screen, a navigation or recording is running or your phone is connected to Android Auto, and during assignment while the search is open in the cockpit. It only listens to the two radio formats it can read; during assignment it also shows other people’s caps nearby (address and readings) until you pick one or close the search – none of this is stored. Readings and warnings stay in the app’s memory; they are not stored and not transmitted to us or third parties. Only your settings are stored: two or four wheels, per wheel the Bluetooth address and radio format of the assigned cap, your warning limits and switches (in the cockpit file, see below). The app shows warnings in the cockpit and – as long as you do not switch that off and notifications are allowed – as a notification on your phone, which Android Auto can show in the car. The app only asks for Bluetooth permission when you want to assign a cap (from Android 12 “Nearby devices”); up to Android 11 the search needs location permission – the app does not determine a location from it. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

Switch box. If you choose a self-built switch box following NavX4’s open protocol in the cockpit, the app connects to it via Bluetooth while the “Switch box” row or the switch box settings are on screen or the cockpit board is shown in Android Auto. The app reads which channels are on, whether voltage is present at the box’s inputs (ignition and second input), the on-board voltage if the box measures it, the box’s settings (profiles, rules, ignition monitoring, undervoltage threshold) as well as its type and firmware version; it sends your switching commands and settings to the box, which stores them itself. If you search for a box, the app searches for switch boxes nearby for 20 seconds and shows name and Bluetooth address of those found. These values stay in the app’s memory; they are not transmitted to us or third parties. Only name and Bluetooth address of the chosen box and the names you give its channels are stored (in the cockpit file, see below). The switch box simulator connects to nothing. The app only asks for Bluetooth permission when you search for a box (from Android 12 “Nearby devices”); up to Android 11 the search needs location permission – the app does not determine a location from it. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

CAN module on the motorcycle. If you choose a self-built CAN module following NavX4’s open protocol in the cockpit, the app connects to it via Bluetooth while a display shows its values (row “Motorcycle (CAN)”, vehicle sensors, vehicle data, cockpit panel in Android Auto) or – if you have taught and switched on handlebar buttons – while NavX4 is visible. The module only listens to the motorcycle’s data bus; the app receives the frames it hears (identifier and up to eight bytes, such as engine speed, gear, temperatures, tyre pressure, button presses on the handlebar) and decodes them according to the chosen vehicle profile. These values stay in the app’s memory and are not transmitted to us or third parties. If you start a recording, the app writes the frames to memory and – only when you end it and choose a storage location – to a text file at that location; it is passed on only if you pass it on yourself. Only the module’s name and Bluetooth address, the chosen and imported vehicle profiles, the chosen model series and the taught buttons are stored in the cockpit file (see below). The simulator connects to nothing. Firmware update. If you install new firmware on your own NavX4 hardware (CAN module, ESP32 switch box), the app reads the chosen package file from your device and transfers it to the module via Bluetooth; in doing so it reads the module’s firmware version. None of this goes to us. The app only asks for Bluetooth permission when you search for a module (from Android 12 “Nearby devices”); up to Android 11 the search needs location permission – the app does not determine a location from it. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

Weather. While the cockpit is on screen, the “Weather” switch is on (the default), the app knows your location and has a connection, it fetches the weather at your location – even if you have not set up a weather display. For this the app rounds your position to a grid of 0.1 degrees (in Central Europe an area of about 11 × 7 km) and sends only this grid cell, your device’s time zone (such as “Europe/Berlin”) and the language of the source credit (German or English) to our server (see section 3) – without your account, without a device identifier, never the exact position. Whether our server offers weather is asked beforehand with a request containing no personal information. Our server requests the forecast for the grid cell from the Norwegian Meteorological Institute (MET Norway, Oslo, Norway); MET Norway receives only the grid cell and the address and identifier of our server, not your IP address. Our server keeps the forecast for a grid cell in memory and hands it, until the expiry time MET Norway supplies, to everyone asking for the same grid cell; there is no assignment to persons. As a fallback in case of a fault, the last state is kept for at most six hours; the server no longer serves older states and clears them from memory with the next weather requests. As with any request, the connection logs of the web server (section 3) contain the requested address, here the rounded grid cell. The app asks at most once per minute and afterwards only again when the forecast expires, the grid cell changes or you tap “Reload”; after an error at growing intervals. On your device the most recently fetched forecast stays only in the app’s memory. You can switch the weather off at any time: with the “Weather” switch in the cockpit settings (home layout, reached by long-pressing a display) or with “Switch weather off” in the weather forecast. The app then makes not a single weather request – not even the question whether our server offers weather –, discards a forecast already fetched and shows no weather. The setting is kept in the cockpit file on your device and applies to all rider profiles. The legal basis is Art. 6(1)(b) GDPR (providing the function you use). Weather data: MET Norway, licence CC BY 4.0.

Remote and keys. In the cockpit under “Devices” → “Remote and keys” you assign app functions to the keys of a Bluetooth or USB remote, a keyboard or your phone. Stored per rider profile is only the assignment (key code, view, gesture, function) and, device-wide, the list of input devices that have sent a key – per device the identifier Android gives it, its name and your direction reversal (at most eight devices, in the cockpit file, see below). If the remote is connected, the app reads its battery level from Android (from Android 12), shows it and does not store it. If a paired device identifies itself to Android as a keyboard, the app reads its name and whether “Show on-screen keyboard” is switched on in Android, to tell you that Android hides the on-screen keyboard; only the identifier of the devices for which you confirmed the hint is stored (at most eight, in the cockpit file). Key presses are not recorded, and none of this is transmitted. If you switch on control by other apps under “Advanced” (off by default), an automation app on your phone can trigger an app function while NavX4 is in the foreground – only with the key the app shows you there, which does not leave your device; that app receives no data from NavX4. The “Map by keys” settings (crosshair, hold time, auto zoom, stick level) are kept per rider profile in the same file. The key test only evaluates key presses on the screen and stores none of them. If you assign a key to push-to-talk via Zello, the app checks on your phone whether Zello is installed and, on pressing and releasing, sends only this key signal to Zello; whatever Zello then transmits, Zello processes under its own terms. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

Map overlays. Under quick menu → settings → map → “Map overlays” you place displays as floating cards on the driving map: speed, distance and times of the selected trip, average, altitude, heading, time of day, street and progress of the current guidance, fuel, OBD2 values, recording, tyre pressure, “Now playing” (title and artist of the media app that is playing) and single channels of your switch box. By default nothing is on the map. Every card shows the same values from the same sources as the cockpit (location and orientation sensors, trip counters, guidance, OBD2 adapter, cameras, tyre pressure caps, media sessions via notification access, switch box) – no new data source is added, and the values are only displayed, not stored and not transmitted. Stored per rider profile are only which cards you chose, their position and size separately for portrait and landscape, the main switch “Hide all overlays”, whether the recording indicator is shown without a label and which cards show their label (in the cockpit file, see below). One deviation from the rules above: while a card that needs one of these values is on the map, location tracking with compass, the connection to the OBD2 adapter and the cameras, listening to the tyre pressure caps, reading the active media session or the connection to the switch box stays on even when the cockpit is not visible – as long as NavX4 is on screen and until you deselect the card or hide all overlays; if you leave the app or the screen goes off, background operation alone applies (section 5g). The footnote in the panel tells you this too. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

Where the cockpit data is kept. Profiles, counters and all the settings named above are kept in one file of the app on your device (cockpit.json). We do not transmit it, it is not synchronised with your NavX4 account, and it is excluded from the Android device backup and from transfer to a new device – which is why the cockpit starts afresh when you change devices. Every rider profile has its own set of devices in the devices area: when you switch profiles, the app stores name and Bluetooth address of the chosen devices (adapter, cameras, switch box, tyre pressure caps including their warning limits) with the previous profile in the same file and connects those of the new one; it also remembers per profile which device cards the area shows and in which order. The file disappears when you delete the app data or uninstall the app.

5b. Speed camera warning of the Android app

The Android app can warn of fixed speed cameras and show them on the map. Both are switched off by default; they are only switched on if you expressly confirm a note on the legal situation.

What happens on your device. The app downloads the speed camera data – locations of fixed speed cameras from OpenStreetMap and a grid of national borders – from our server (navx4.app/packages, like the offline packages) when you switch it on or tap “Update”. As with any download, our server sees your IP address (section 3); the request contains no location and no identifier. Whether a speed camera lies ahead and which country you are in right now is calculated by the app on your device from the location tracking that is running anyway – during a navigation (also in Android Auto) or while the cockpit is visible. The speed camera warning does not open location tracking of its own. Positions are neither stored nor transmitted for it.

What is stored. On your device: the two switches, the time of your confirmation, the most recently determined country as a country code (so that the note at a border crossing is right even after restarting the app), the country codes of countries where the warning is off by default and you deliberately turned it back on (today only Switzerland) and the downloaded file. Everything is in a folder excluded from the Android device backup and from transfer to a new device; on a new device the app therefore asks again. With “Delete” you remove the data, with the switches you turn the warning off at any time. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

5c. Track guidance for GPX files in the Android app

The Android app guides an imported GPX file as a track: with turn instructions, with curve guidance, both (“Hybrid”) or only as a line. Curve guidance, the warning when leaving the track, the wrong-direction warning and reversing are calculated by the app on your device.

What goes to our server. Only with “Turn instructions” or “Hybrid” does the app send the file’s line to our server when guidance starts and after “Reverse track” – at most 5,000 points as longitude and latitude, without altitudes, timestamps, names or identifier –, together with the vehicle class and the permissions and unlocks from your terrain preference. Our server passes it on to our own routing service, which matches the line to the roads and tracks and calculates turn instructions from it. Both discard the line afterwards; it is not stored. Against bulk requests, the server counts how often an IP address has asked in the last ten minutes – only in memory and under a shortened hash of the IP address, never on disk; after ten minutes or a server restart it is forgotten. A file’s line can allow conclusions about planned or driven routes. If you do not want that, choose “Curves” or “Line only” – then none of it leaves your device.

What is stored. On your device the settings of the track guidance (mode, curve level, announcement, flash, warnings); on our server nothing. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

Point to resume from. So that you can later resume a track or route where you left it, the app remembers for each line the point the guidance last reached: the distance from the start, the point there (longitude and latitude), the total length and the time – for at most 200 lines, the oldest is dropped first. This happens during every navigation (not during a test drive, not during the approach), and the point stays after the drive has ended. At the destination or with “Forget this point” on the route card it is deleted. The points stay only on your device; they do not go to us, not into your account and not into the Android device backup. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

5d. Offline maps of the Android app

The Android app only downloads offline maps from our server (navx4.app/packages) when you choose to: the directory of packages and the packages themselves. As with any download, our server sees your IP address (section 3); the request contains no location and no identifier.

Downloading only the corridor of a route. Instead of whole regions, the app can download only the map tiles and routing data along your active route – only when you tap “Work out the size” and “Download corridor” in the offline section. To do so it requests individual sections of the package files from our server; the approximate course of the route could be read from these sections. Our server logs, as with any download, the IP address, time, file name and amount transferred (section 3), but not which section of a file was requested. The route line and the downloaded tiles stay in the app’s internal storage; “Delete” removes a corridor again. The legal basis is Art. 6(1)(b) GDPR (providing the feature you use).

Updates as changes. If the directory offers a change file from your version of an installed map to the new one, the app downloads only that file for the update and applies it on the device. The file name names the old and the new version; our server logs it like any file name (section 3) and can tell from it which version you had. The legal basis is Art. 6(1)(b) GDPR.

Closures and reports without a network. For each installed region the app keeps the official closures and the community reports (section 9) with their date on the device, so that they do not disappear without a network. The reports come from the same request the app already makes for the map. The official closures are requested from our server (navx4.app/api/v1/amtlich) at most every half hour per region while online, for the map area of each installed region; our server sees your IP address and these areas, i.e. which regions you have installed, and stores nothing of this beyond the log in section 3. Everything is stored only on your device, in the app’s internal storage; when a region is no longer installed, the app deletes its data at the next sync. The legal basis is Art. 6(1)(b) GDPR.

The same applies to the extracts of the off-road layer (section 6): the app only downloads them when you tap “Download” in the layer’s legend and stores them in the app’s internal storage; “Delete” removes them again.

Likewise the extracts of the contour lines (section 6): the app only downloads them when you tap “Download” under the contour lines in the layers panel, stores them in the app’s internal storage, and “Delete” removes them again.

Hillshade without network (Android app). Likewise the extracts of the hillshade: the app only downloads them when you tap “Download” under the hillshade in the layers panel, from our package server (navx4.app) – which sees your IP address and the chosen region –, stores them in the app’s internal storage, and “Delete” removes them again. Without network the app draws the hillshade from these extracts and from the elevation tiles of your offline maps, on the device. The app fetches the list of available extracts from there only while this section of the layers panel is open (at most every six hours); the map alone does not ask for it.

New map format. If maps in the old format are on the device, the app suggests downloading them again and for that only asks Android whether your device is currently on Wi-Fi or on a metered network (usually mobile data). This information does not leave the device; it only stores that you chose “Later on Wi-Fi”, and for which maps.

Storage location. The packages are kept in the app’s internal storage or, if you choose, in the app’s folder on an SD card. The app can use this folder without a storage permission; it is deleted together with the app when you uninstall it. Stored on your device are the packages, the chosen storage location, which maps you switched off and which were found to be damaged during a check, and for each map where it is kept and which version it has.

“Map area not downloaded”. During a navigation or a recording, the app compares your position on the device with the outlines of the regions from the directory in order to tell you when no offline map is installed for the area. It uses the location tracking that is running anyway and opens none of its own; the position is neither stored nor transmitted for this. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

5e. Drive recording in the Android app

If you record a drive in the Android app, the app stores on your device the positions driven with their time and – as far as the device reports it – altitude, plus speed, moving and stopped time, the waypoints you set and, if you switch on “Measure lean angle”, the lean angle calculated from this. For the lean angle the app reads your phone’s gyroscope and accelerometer during the recording; the raw values stay in memory, only the calculated angle is stored.

What stays on the device. The app keeps a finished recording under “Recorded trips” until you delete it – even after you have uploaded it as a track. This folder is excluded from the Android device backup and from transfer to a new device. You only pass a recording on as a GPX file if you choose “As GPX” and pick a storage location yourself. Your settings (auto start, threshold, lean angle) are stored as well.

In the library (“My recordings”). With “Stop” the app additionally puts the recording, named, into its library, collection “Recordings” – as a line without timestamps, without altitudes and without lean angle. By default it stays there on your device only; unlike the “Recorded trips” folder, the library goes into the Android device backup like the saved routes if you have switched that on. It only goes to your account if you switch on “Put new recordings into the account” or release a single one with “To the account”; then we store the line, the waypoints set along the way, name, length, driving time as a number and the start of the drive (it is contained in the identifier and the name) like a saved route (section 8a) and show it on your other devices and in the web planner. “Delete in the account” removes the account copy and leaves the one on the device, “Delete on this device” the other way round.

Record automatically. If you switch it on, the app evaluates the location tracking while it is open to detect that you set off; this does not happen in the background. These positions are not stored and not transmitted for this. If you set “Discard automatic recording below”, the app deletes an automatically started recording that stays shorter on the device when it ends, instead of saving it; nothing is sent to us.

Trimming. If you trim a recording in the app or a track in the web planner, the shortened version replaces the previous one – on the device and, if it is in your account, there at the next sync or immediately on the web. We do not keep the cut-off parts. No new kind of data is created.

What goes to our server. Only if you upload a recording as a track: the positions with their times and the waypoints set (place, altitude, name, symbol). The waypoints become part of the track and are as visible as the track itself (section 9); times, segments and lean angle are not stored.

Playback in the browser. On navx4.app/wiedergabe you play back a GPX file. Your browser reads the file; it is not transmitted to us. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

5f. Search for places nearby and Auto-POI

In the Android app and the web planner you can search for places such as fuel stations, restaurants or accommodation by category – through the search tiles and “Search nearby”. The Android app can do this continuously with Auto-POI, along the route or around you; Auto-POI is off by default. The search runs on your device or in your browser.

What goes to our server. The places come from OpenStreetMap; we prepare them in advance and store them in tiles on our server (navx4.app/packages/poi). For a search, the app or the browser downloads the tiles of the area being searched. The request contains no location and no identifier, but it names category and tile – depending on category and latitude, a tile is about 5 to 160 km wide. As with any download, our server sees your IP address (section 3). Which tiles you download therefore roughly reveals the area you are searching in. The Android app keeps downloaded tiles in its cache (at most 64 MB; a new data version replaces the old ones), the browser according to its own rules. Without a connection the app searches the offline maps on your device; then nothing goes to us. The “Services” tab in Discover (workshops, accommodation, driving schools, rentals) searches the same tiles in the same way, around the map centre or – only when you tap and with your permission – around your location, which does not leave your device. The businesses come from OpenStreetMap; they do not register themselves with us, and we store nothing about you for this.

Location. For “My location” – and in Android Auto for the list of a category while no guidance is running – the app or the browser measures your position once, only when you tap and with your permission; it does not go to us. Auto-POI uses the location tracking that is running anyway (navigation, recording, cockpit, also in Android Auto) and opens none of its own. Positions are neither stored nor transmitted for this.

What is stored. On your device the settings of Auto-POI (switch, three categories, radius, range of view, keep searching, icon size) in one file of the app. It is not synchronised with your NavX4 account; like other settings of the app it goes into the Android device backup if you have switched that on. Tapping “On OpenStreetMap” opens the place’s page at openstreetmap.org; the privacy policy of the OpenStreetMap Foundation applies there. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

5g. Background operation of the Android app

If you leave the Android app with the home or overview button, lock the screen or choose “To background”, the app can keep running with its own background service – always with a visible notification saying what it keeps running. What keeps running in the background is set under “Background operation”.

Location. If neither navigation nor recording is running, this service measures your position every second so that the trip computer keeps counting or your location sharing in a group tour keeps reporting. For the trip computer the position stays on your device; it only goes to our server if you share your location in a tour – exactly as during a navigation (sections 5 and 8a). The app neither needs nor asks for “allow all the time” location permission for this: the service only starts while the app is still in the foreground and ends as soon as you open it again or close it. Exception: if you share your location in a tour and neither navigation nor recording is running, the same service also measures while the app is open – with the same visible notification and at the same interval – so that your sharing can send a position at all. It ends as soon as you stop sharing, the tour ends or navigation or recording take over location tracking. When you switch sharing on, the app asks for notification permission on Android 13 and later; if you decline, sharing still works, Android just does not show the notification.

Bluetooth devices. Adapters, cameras, tyre pressure caps and the switch box can stay connected in the background. Their values stay on your device, as in the cockpit (section 5a).

Rest location while stopped. If you switch it on, the app evaluates in the background the positions measured anyway and your phone’s motion detector (the “significant motion” sensor) to detect stopping and setting off. This happens on the device only; nothing is stored and nothing is transmitted for it, and the activity recognition of Google’s services is not used.

What is stored. Only your settings of the background operation, in one file of the app on your device. It is not synchronised with your NavX4 account; like other settings of the app it goes into the Android device backup if you have switched that on. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

5h. Touch lock of the Android app

The Android app can lock touch input on the screen so that rain, gloves or a branch trigger nothing – by hand, with a lock key or, if you switch it on, automatically as soon as you drive; likewise it can unlock automatically when you stand still. For these two automatic functions the app measures your position every second – only while NavX4 is on screen and one of the two switches needs it – and reads nothing from it but the speed, to tell driving from standing. The position stays on your device; it is neither stored nor transmitted, and without location permission the settings say that the automatic function cannot work. Only the three switches of the lock are stored, in one file of the app on your device, without synchronisation with your NavX4 account; whether the screen is currently locked is not stored. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

5i. Exchange with other apps (Android app)

The Android app accepts files, photos, map links and text from other apps – via “Share”, “Open with” and Android’s text selection – and passes a map point on to other apps. All of this only happens when you tap; the app does not read anything from other apps on its own.

Files (GPX, KML, KMZ, GeoJSON, TCX, FIT, ITN, CSV, OziExplorer) that you share to NavX4, open with NavX4 or import from a chosen folder are read by the app on your device and stored in its library on your device. The reading happens on the device; when you are signed in, the app then synchronises the entry with your account like any saved route (section 8), without an account it stays on the device. A folder is read once; the app does not keep permanent access to it. From a chosen folder the app also takes files from its subfolders (up to two levels deep) and puts them into a collection named after the subfolder; with an account, this name goes into the account as a collection. Whether a file is already in the library is checked by the app on the device (name and line); nothing is transmitted for this.

PDF roadbooks. A PDF that you share to NavX4, open with NavX4 (“Open as roadbook”), import in the Roadbook area or have in a chosen folder is stored by the app as a copy in its own storage on your device and shown in the Roadbook area. Along with it, the app remembers the file name, size, number of pages, when it was opened, which roadbook is loaded, where you were (page, zoom, position) and whether the paper is shown inverted. None of this is transmitted or synchronised with your account, unless you upload a roadbook to the account yourself (section 8a, “Roadbooks in your account”). Whether a file is a PDF is checked by the app from its first bytes on the device. Roadbooks are excluded from the Google backup; when you move to a new phone, Android transfers them along from Android 12 onwards if you use the device-to-device transfer. “Unload” closes a roadbook, “Delete” removes the copy together with the remembered position; NavX4 does not touch the file in the app it came from.

GPX and OpenRally roadbooks. If the app recognises a roadbook in the open OpenRally format in a GPX file, it asks how to open it. With “Roadbook only” it stores the file solely in the app’s private storage on your device; it is not transmitted and not included in the Google backup. With “Roadbook + Map” the track with the notes as waypoints and the collection “Roadbook” also goes into the library and, when signed in, is synchronised with your account like any entry (section 8); the original file with tulip images, zones and radii stays on the device. For distance and heading to the next waypoint the open roadbook reads the device location – only while it is open and only on the device; it is not transmitted for this. If location permission is missing, the roadbook offers it; Android asks only when you tap.

Generate roadbook. “Generate roadbook” in the Roadbook section builds, on the device, a roadbook with drawn tulips from the running guidance, the planned route or a route or track loaded on the map. As with “Roadbook only”, the generated file is stored solely in the app’s private storage on your device and replaces the roadbook opened last; it is not transmitted, does not go into the account and not into the Google backup. The app remembers the chosen curve threshold on the device like its other settings. A roadbook only goes into the account if you upload it yourself under “Roadbooks in your account” (section 8a). You choose the unit (kilometres or miles) when generating; the app’s unit is preselected.

Edit roadbook. Text and font size at the tulips that you change under “Edit” in the Roadbook section are written by the app into the roadbook file in the app’s private storage on your device; nothing else is stored for this. A change only goes into the account for a roadbook that is already in your account, and only when you tap “Save” (section 8a, “Roadbooks in your account”).

Roadbook tripmaster. The tripmaster counts total and partial distance from the locations the app receives anyway (open roadbook, visible cockpit, running guidance or recording); it does not open a location request of its own. Only the two distance values, whether it is paused, and its settings are stored – no locations and no times – in the app’s private storage on your device, not in the Google backup. None of it is transmitted.

Roadbook notes and roadbook settings. What you draw on a roadbook in notes mode is stored by the app as strokes per page or per note in its private storage on your device, next to the roadbook and not in the Google backup; “Erase all” or deleting the roadbook removes them. The roadbook settings (auto-follow, scroll amount, map split, mini map, stopwatch, roadbook keys) are kept device-wide in the cockpit file on the device. For the auto-follow of the tulip roll and for distance and heading in the mini map, the app uses the location the visible cockpit already has; “GPS › Map” shows a roadbook point on the map on the device. The instruments next to the tulip roll (heading, CAP, steering hint, speed, zone, next waypoint) are computed from that same location, only on the device and without storing it; the announcements “Off course” and “Back on course” are spoken by the device’s speech output. Which instruments are shown where is kept with the other roadbook settings in the cockpit file. None of it is transmitted.

Roadbook rally scoring. Whether you reached a roadbook’s control waypoints and how often you were too fast in a speed zone is computed from the location and speed the visible cockpit already has; the app opens no location access of its own for it. For each control waypoint it stores its state (validated, missed) with the time of validation, and for each penalty pulse the zone and how much too fast you were – no locations and no track – in the app’s private storage on your device, not in the Google backup and not in the app’s own ZIP backup; “Restart scoring” or another roadbook deletes it. The penalty rules are kept with the other roadbook settings in the cockpit file. None of it is transmitted; only when you tap “Share” or “Export CSV” does the result go to the app or storage location you choose.

Passing files on. If you tap “Share” on a loaded file, the app writes a GPX copy (name, line, waypoints) into its cache and hands it to the app you choose in Android’s share dialog – read-only and only for this one handover. A copy stays until the first share that comes more than an hour later – then the app removes it (some apps only read an attachment when sending); Android may also clear the cache earlier. What the chosen app does with it is up to that app. In the same way, “Share” on a recording passes on its GPX file (line with timestamps, elevations, waypoints and, if measured, lean angle) – again only when you tap and only to the app you choose.

Photos. If you share a photo to NavX4 or choose “Destination from photo”, the app reads from the photo nothing but the place where it was taken, as written into it by the camera, and puts it into the planner as the destination. The image itself is neither stored nor uploaded. Since Android 10 the system removes the place from photos in the media library before an app reads them; that is why NavX4 asks for the “media location” permission (ACCESS_MEDIA_LOCATION) – only when such a photo arrives without a place, never at start and for nothing else. If you decline, the app says that it could not read a place.

Contacts. “Destination from contact” opens Android’s contact picker for a single postal address. This needs no READ_CONTACTS permission and NavX4 does not read your address book; it only receives the one address you pick, with a temporary permission, and puts it as search text into the destination field – from there it goes to our geocoder like any search (section 7). Nothing of the address is stored. Only the phone book in the cockpit asks for contacts access (section 5n).

Map links and short links. The app reads a map link from another map app (Google Maps, Apple Maps, Waze, OpenStreetMap, Bing Maps, HERE, OsmAnd) on your device. A short link (such as maps.app.goo.gl, waze.to, her.is) does not carry the destination itself; to find it, the app requests the link once from the provider and follows its redirect. In doing so, this provider receives your IP address and the link – as with every time the link is opened in a browser –, and its privacy policy applies. NavX4 sends no identifier and no cookies along and only reads the redirect address.

Directions. If you share directions with several stops (such as a route link from Google Maps), the app takes every stop into the planner. Stops that the link names only as text (a place or an address) are looked up through our geocoder (section 7), like a search by hand; stops with coordinates stay on the device. If the directions start at your own location, the app uses the “My location” start or a location fix with the permission you have already granted; it does not ask for it.

Links to OpenStreetMap objects. A link to an object on openstreetmap.org (such as …/node/123) carries no coordinate. To find its location, the app asks the public interface of the OpenStreetMap Foundation (api.openstreetmap.org) once for this one object, for a relation for one of its members – at most three requests. In doing so, the OpenStreetMap Foundation receives your IP address and the identifier of the object, as when the link is opened in a browser; its privacy policy applies. NavX4 sends no identifier of yours and no cookies along.

Selected text. If you select text in another app and choose “NavX4” there, the app receives exactly this text and checks it on your device for coordinates, map links or a short address. An address goes to our geocoder as search text (section 7); otherwise nothing is transmitted, and a text without a place is discarded.

Passing on and sharing. “Open in another app” hands the coordinate of a map point (and, if known, the street) as a geo: link to the app you pick in Android’s chooser; “Share” hands over name, coordinate and a map link as text. What the chosen app does with it is governed by its privacy policy. “Open in OpenStreetMap” at a map point (also in the map-point menu of the web app) opens the query “objects at this point” on openstreetmap.org in the browser, with the coordinate of the point; the privacy policy of the OpenStreetMap Foundation applies there. The legal basis for everything in this section is Art. 6(1)(b) GDPR (providing the function you use).

5j. Auto-off and charging cable (Android app)

If you switch it on, the Android app uses the charging cable as an ignition signal: while NavX4 is running, the app listens to Android’s messages that a charger was connected or disconnected and that the screen turns on or off. From this it decides whether to close after a countdown, release the screen or carry out the actions you chose for plugging in and unplugging; for “Close after inactivity” it sets an alarm with Android. These states are only evaluated on your device, not stored and not transmitted. If you choose “Open another app” as an action, the app reads the list of apps with a launcher icon for this, as under section 5a, and only remembers the one app chosen. The switches and actions are stored in one file of the app on your device, without synchronisation with your NavX4 account. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

5k. Country modules (app and web app)

The country modules show official warnings, fire danger, incidents, closed natural areas and low emission zones for Portugal, Catalonia, New South Wales, Victoria and France. Whether you are in a module area is checked by the Android app on your device: it compares the location supplied by the location tracking that is running anyway (navigation, recording, map) with coarse area outlines shipped with the app – it does not switch on location tracking of its own for this. Your location does not leave the device for this. When it lies in a module area for the first time, the module switches on; stored on the device are only which modules are on, which areas the device has already been in and which reports have already been shown (at most 500 identifiers), without synchronisation with your NavX4 account.

For every module switched on, the app or the web app fetches the situation from our server (/api/v1/laendermodule/…). The request only contains the module’s identifier – no position, no account, no device identifier; as with every request, our server sees your IP address (section 3). Our server fetches the data itself from the authorities (MeteoAlarm/EUMETNET for Météo-France and IPMA, Generalitat de Catalunya, NSW Rural Fire Service, Emergency Management Victoria, transport.data.gouv.fr); nothing of yours goes to these bodies. The app can show serious situations at your location as a notification, also in Android Auto; this can be switched off in the layers panel. For every module switched on, the app creates a shortcut in the menu of the app icon.

Crit’Air sticker. If you enter your motorcycle’s sticker, the app stores it in the rider profile on your device (the web app in your browser’s storage) and sends it with every route request (laender.critAir) so that the route avoids low emission zones you may not enter right now. Our server only uses it for this one calculation and does not store it. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).

5l. One-way check before reversing a line (app and web app)

If you reverse a line in the planner that is not recalculated – a saved route, an imported file, an adopted track or a round trip –, the app or the web app first checks whether the reversed line runs against a one-way street.

What goes to our server. Only at that moment does it send the line to our server (/api/v1/oneway-check) – at most 20,000 points as longitude and latitude, without altitudes, timestamps, names, account or device identifier. Our server passes it on to our own routing service, which matches it to the roads and names the stretches that run against a one-way street when reversed. Both discard the line afterwards; it is not stored. Against mass requests the server counts how often an address asked in the last ten minutes – only in memory and under a shortened hash of the IP address, never on disk. The line may allow conclusions about planned or driven routes. Without a connection, or if you do not wait for the check, nothing is sent; the planner then says that nothing was checked. The legal basis is Art. 6(1)(b) GDPR (provision of the function you use).

5m. Hazard warnings: weather and fires at your position and along the route (app and web app)

Warnings at your position (Android app only). While the map is open or you are navigating, the app checks about every 30 seconds what applies at your position – using the location the location service already provides; it does not switch on location by itself and needs no background location access. It compares the official situations of the country modules (section 5k) on the device. For active fires and this hour’s weather it asks our server: for fires with a rectangle of about 20 km around your position rounded to 0.1 degrees (/api/v1/gefahren/feuer), for the weather with that rounded cell and the current time (/api/v1/gefahren/wetter). It asks again only when you leave the rectangle or the cell, otherwise at most every 15 or 30 minutes.

Weather and fires along the route (app and web app). In the planner only when you tap “Get weather and fires along the route”, during navigation automatically and then at most every 30 minutes: the app or the web app sends up to ten points of the route, rounded to 0.1 degrees, with the estimated arrival time, and for the fires a rectangle around the route to our server. These points roughly reveal where and when you intend to ride. No request contains your account or a device identifier; as with every request our server sees your IP address (section 3), logs no coordinate and does not store the request.

Where the data comes from. Our server fetches the weather for each cell from MET Norway, as for the weather in the cockpit (section 5a) – MET Norway receives only the rounded cell and our server’s address, nothing from you. Our server fetches active fires as one worldwide file from NASA (FIRMS); nothing from you goes to NASA. If you switch on the “Fire danger” map layer, your device or browser loads the map images directly from the Global Wildfire Information System of the EU’s Copernicus Emergency Management Service (Joint Research Centre of the European Commission); that service receives your IP address and the requested map sections.

Emergency alerts and affected fire areas (app and web app). If “Show emergency alerts” is on (the default), the app asks our server for disaster alerts (GDACS) and official weather warnings (MeteoAlarm) for a rectangle of about 1000 km around your position, rounded outwards to 5 degrees (/api/v1/gefahren/meldungen) – again only when that rectangle or the severity filter changes, otherwise at most every 30 minutes. The web app asks the same for the visible map section, likewise rounded outwards to 5 degrees, when the “Warnings” layer is on or the “Hazards” dialog is open. Together with the active fires, the app and the web app fetch the affected areas in the same rectangle (/api/v1/gefahren/feuerflaechen). Our server fetches the alerts from GDACS (Joint Research Centre of the European Commission with the United Nations Office for the Coordination of Humanitarian Affairs) and from MeteoAlarm (EUMETNET, the national weather services); nothing from you goes to them. If a new alert concerns your location, the app shows it on the driving screen and as a notification, with or without sound depending on your setting.

If a serious weather situation or a fire along the route is new, the app shows it on the driving screen and, if you have allowed notifications, as a notification – also in Android Auto. Of this, only your emergency alert settings and the identifiers with level of the alerts already reported are stored on the device (no position), so that the same warning does not come again after a restart; the web app only remembers the severity filter in the browser. The situation itself lives only in the memory of the running app. The legal basis is Art. 6(1)(b) GDPR (provision of the function you use).

5n. Phone and home screen (Android app)

Quick dial, phone book and dialler. When you fill a quick dial slot, the app opens Android's contact picker; NavX4 receives only the one entry you choose (name and phone number) and stores it on your device. The phone book in the cockpit reads – only if you allow contacts, and only while it is open – names, phone numbers, thumbnails and the favourite mark of your contacts; none of it is stored. When you call from the app, it hands the number to your device's phone function (directly with the “make calls” permission, otherwise to the phone app). The app keeps its own history: which numbers you dialled from NavX4 and which calls the call filter rejected, each with name (if known) and time, at most the last 50. NavX4 does not read the phone's call log.

Call filter. If you make NavX4 the caller ID and spam app in Android, Android gives the app the number of every incoming call. Depending on your choice (all calls, favourites only, silent) NavX4 lets the call ring or rejects it; for “favourites only” the app looks up in the address book whether the number belongs to a contact marked as favourite. Rejected calls go into the history with number, name and time. The large call screen in the cockpit (only if you switch it on) uses the “phone state” permission to notice that a call is ringing and, on your tap, answers or declines it with the “answer calls” permission.

Home screen. If you make NavX4 your home screen, the app remembers your choice of navigation app (package name), whether and after which delay it should start after switching on, and for which boot that already happened (Android's boot counter). For the choice the app asks Android for the apps that accept navigation destinations. If you uninstall an app from “All apps”, NavX4 only opens Android's confirmation.

All of this stays on your device: it is not sent to us or third parties. The phone data (quick dial, history, filter level) is also excluded from Android device backup and from transfer to a new device; the home screen settings (chosen navigation app, delay, marker of the last boot) contain nothing about people and go into your Android backup like the other settings. You can delete the history in the app (“Clear history”) and a quick dial slot by long-pressing it; permissions and the role as call filter or home screen are withdrawn in Android's settings. The legal basis is Art. 6(1)(b) GDPR (provision of the function you use).

5o. Introduction, local backup and bug report with app log (Android app and web app)

Introduction. On the first start the app shows a short introduction. For this it remembers on your device that you have seen it. To suggest an offline package for your country it reads the country codes of your mobile network and SIM card and the device language setting – not your location. This stays on the device; a package is only downloaded when you tap “Download” (section 5d).

Local backup as ZIP. Under “Backup and restore” the app creates, at your request, a ZIP file with your settings, rider profiles including photos, the library (routes, collections, recordings with timestamps), roadbooks, places and the other app settings, such as speed dial. Not included are offline maps, your sign-in and reports not yet sent. You choose where the file goes in the Android file picker – for example on the device, an SD card or a cloud folder; if it is with a cloud provider, their terms apply. Nothing is sent to us. When restoring, the app only reads a file you select yourself and replaces the backed-up state on the device with it.

Bug report with app log. Under “Report a problem” (in the app menu and under Settings → Help) you send us the title and description of a problem and, if you choose, a category. Only if you switch on “Attach the app log and device details” (off by default) are an identifier of app version, Android version and device model and the latest entries of the app’s own Android log sent as well; “Preview” shows every field that goes out before sending. Before sending, the app removes from the log positions (numbers with three or more decimal places, geo addresses), credentials (tokens, keys, identifiers), e-mail addresses and the query parts of web addresses; at most 400 lines are sent. The log can contain the app’s error messages together with the program locations where an error occurred; the app has no separate service for crash reports. The server cleans the log once more. Reports are sent with your account; without sign-in or connection the report waits on the device. Only once our server has accepted the report does the app say “Received”; you see status and reply under “My reports” (section 5p). Only NavX4 moderation and administration see the report. We delete the log 30 days after the report, the report itself with your account; it is part of your data export. The legal basis for title, description and category is Art. 6(1)(b) GDPR (handling your bug report). The app reads and sends the log and device details only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); without it the switch stays off, and you can delete a sent report together with its log under “My reports” at any time. App versions up to 0.44.0 do not ask yet: they attach the identifier of app version, Android version and device model to every report and every ticket from the planner, and their switch for the log is on by default.

After a crash. If the app crashes, it keeps a note on your device with the time, the name of the affected part of the program (thread), the error message and the program locations of the crash. If a native part of the app crashes, such as the map display, or Android closes the app because it stopped responding, the app takes from Android only the kind, the time and the short description. The note is kept in an app storage area that is not part of your Android backup. On the next start the app asks once whether you want to send a bug report. The note only leaves the device in a report you send yourself, and only with “Attach the app log and device details” switched on; then it appears at the top of the log, cleaned like the rest of the log. As long as it stays on the device, we receive nothing. The app deletes the note as soon as the report is sent or you choose “Do not report the crash”, at the latest after 14 days.

Report a problem in the web planner. Under “Report a problem” in the planner menu you send us, signed in, the title and description of a problem, plus what you mark yourself (controls of the page with their text and an excerpt of their page source, a stretch of the route) and, unless you remove them, route diagnostics of the route shown (profile, vehicle, start and destination as entered in the planner, distance, data timestamp, route ID); the planner does not send your location. Only if you switch on “Attach browser and device details” (off by default) are the page address without the query part, the page title, the window size and your browser’s identifier sent as well; “Preview” shows beforehand what will be sent. Only NavX4 moderation and administration see the report; you find it at /konto/meldungen and can delete it there (section 5p). The legal basis for the report is Art. 6(1)(b) GDPR, for the browser and device details your consent (Art. 6(1)(a) GDPR).

5p. Support replies, roadmap and translation portal (app and web app)

My reports. For a report from the app or the web app we store, besides title and description, the category and the products concerned as chosen by you or the moderators, and our team’s reply with its time. Only you see your reports with status and reply, when signed in, in the app under “My reports” and in the browser at/konto/meldungen. We send no email for this. We delete the data with your account; it is part of your data export. You can also delete each of your own reports there: it disappears immediately together with our reply, the app log and the route details; a roadmap entry our moderators wrote from it stays. The legal basis is Art. 6(1)(b) GDPR (handling your report).

Roadmap and bug list. When you vote for an entry of the public roadmap while signed in, we store your account ID, the entry and the time – one vote per entry. Only the number of votes is public, not who voted. You can withdraw your vote at any time; we delete it with your account, and it is part of your data export. Our moderators word the entries themselves; the text of your report never becomes public on its own. The legal basis is Art. 6(1)(b) GDPR (taking part in the vote).

Translation portal. When you submit a translation at/uebersetzen, we store the language, the text key, your suggestion, your account ID, the time and your consent to the CC0 1.0 licence; for a vote, your account ID, the suggestion and the time. The wording of suggestions and their vote counts are public, your name is not. We take approved suggestions into the app and the web app as text without a name. With your account we delete your suggestions and votes; texts already in a published version stay there. Suggestions and votes are part of your data export. The legal basis is Art. 6(1)(b) GDPR (taking part in the portal).

Reports, proofreaders and leaderboard in the translation portal. When you report a translation as possibly wrong, we store your account ID, the language, the text key and the time; only the number of reports is public, not who reported. If an admin appoints you as a proofreader for a language, we store your account ID, the language and the time; admins also see your name and email address. You only appear on the leaderboard if you add yourself: we then publicly show your profile name (without a profile name, the name of your account, never an email address) with the number of your approved translations, your suggestions and your languages; you can remove yourself at any time. The open interface/api/v1/translate/strings lists texts, suggestions and numbers, but no accounts. With your account we delete reports, role and entry; they are part of your data export. The legal basis is Art. 6(1)(b) GDPR (taking part in the portal), for the leaderboard your consent under Art. 6(1)(a) GDPR, which you withdraw by removing yourself.

5q. Phone bridge and iPhone notifications (Android app)

Phone bridge. If you pair two devices running NavX4 – your phone and a device on the handlebar – they connect directly over Bluetooth; nothing passes through our servers. The phone sends to the paired device: from the notifications NavX4 sees through notification access, app name, package name, title, text and time (not from apps you switch off, and for calls and texts according to your filter); for calls the caller's name or number, whether it is ringing, and the call duration; your speed dial, contacts marked as favourites (name and number, at most 30, only with contacts permission) and the last ten numbers dialled from NavX4; files you share with “Send to handlebar device”. For the filters “known numbers only” and “favourites only” the phone looks up in the address book whether the sender is in it. The handlebar device sends back what you do there: dismiss, reply (the text goes to the app on the phone through its notification), answer, decline, hang up, the number to dial and the request for a hotspot. The connection is end-to-end encrypted (key exchange ECDH P-256, AES-256-GCM); at the first pairing you compare a six-digit code on both devices.

Both devices store only the bridge settings, their own key and the name, Bluetooth address and public key of the paired device. The handlebar device keeps the phone's notifications, calls and contacts only in memory while the connection is up. Received files stay in the app's private storage until you delete them.

iPhone notifications. If you switch them on, the device makes itself visible to iPhones over Bluetooth Low Energy. After pairing and your consent on the iPhone (“Share System Notifications”), NavX4 reads through Apple's notification service for accessories, per notification, the app identifier, title, subtitle, text (shortened), time and category and shows them – with “Show calls only” only incoming calls. Answer, decline and dismiss are sent to the iPhone as commands. Only the Bluetooth address and name of the chosen iPhone are stored; the notifications stay in memory.

None of this is sent to us or third parties. Settings, keys, the paired device and received files are excluded from Android device backup and transfer to a new device. You can delete them with “Unlink”, by switching off the bridge or iPhone notifications, and with “Delete” for received files; you revoke permissions and Bluetooth pairings in Android settings. The legal basis is Art. 6(1)(b) GDPR (providing the feature you use).

5r. Sharing a ride by link (Android app)

Sharing a ride by link. When you explicitly share a ride with “Start sharing”, we store on our server: a random link identifier, the name of the ride, your privacy settings, the state (running, paused, finished), identifier and name of the sending device (a random identifier of the app, not a hardware identifier), the measured positions with time, speed, altitude and heading (every ten seconds, every three seconds in bends), the ride values calculated from them and your posts: messages, photos (as a reference to your private photo) and places with name, category and description, each with location and time. A shared ride is therefore a location trail; it only exists while you share and not while the ride is paused.

Who sees what. Followers open the link. By default these are only your signed-in friends; anyone with the link without an account only if you choose that and our server offers it. Followers see your display name, your profile picture only if your profile is visible to them, position and trail within the chosen window (no trail, 1 to 24 hours or the whole ride), with a delay everything 1 to 6 hours later, speed and ride values only if you switch them on, and your posts except hidden ones. Anyone signed in who blocked you or whom you blocked sees nothing. If you chose “anyone with the link”, this only applies to signed-in people: without signing in we do not know who opens the link.

Follower count. On every refresh the follow page sends a random identifier of its browser tab. We store only a hash of it (SHA-256), without IP address and without an account, and delete it after one minute without a refresh. You only see the number.

Retention. When you finish you decide: keep leaves the ride as a journal under the same link until you discard it or delete your account. Discard deletes ride, trail, posts and follower rows at once; your photos stay as private photos in your account until you delete them. With “Keep the GPX in the library” the app first downloads the ride as GPX to your device. Deleting your account deletes everything. If you quit NavX4 via “Exit”, the ride pauses. Ending on its own: if nothing happens on a running or paused ride for 24 hours (no point, no post, no pause, no renaming), our server ends it on its own; for this we store the time of your latest post and the time of that end. Viewers no longer see it then. The next time it is online, the app puts the ride’s GPX into your device’s library if this device took part in it, and asks once whether you keep it as a journal or delete it. If you do not keep it, we delete it with its trail and posts 14 days after that end; your photos stay private photos.

My shared rides and the journal on the web. In the app and on navx4.app/konto/geteilte-fahrten you see your shares with their state, distance, the number of photos, messages and places and the highest number of simultaneous viewers; of the latter we store only the number, no names. On the web you can add a description to a kept journal, set it to “Only me” (then nobody but you sees it), allow viewers to download the GPX (the file keeps the same trail window as the follow page) and create a new link, after which the old one no longer works. Clicking your trail adds a message or photo at that spot afterwards; a photo is shrunk and re-encoded in the browser, uploaded as private and gets the place and time of the chosen spot. Two devices: if you start on a second device while another one is already sharing, you see the name of the sending device and can take over; the old device then sees the name of the new one.

Follow page in the browser. The link leads to navx4.app/f/ with the link identifier. The page asks our server for the new state every five seconds while its tab is visible, once a minute for a journal, and shows only what your settings allow. Only people who are signed in and friends with you may watch; without signing in, the page only shows the way to sign in and no details of the ride. The random identifier for the follower count is created anew each time the page is opened and kept only in the memory of the open page; nothing is stored in the browser for it. The page looks up the nearest place for your posts through our reverse search (section 7): for this, the spot of a post rounded to three decimal places (about 100 metres) goes to our server and from there to our Photon, and only if it fails to the public Photon service of komoot, without the viewer’s IP address and account. The page takes the units of the ride values from the setting or the language setting of the viewer’s browser; this stays on their device. The page is not listed in search engines (noindex), and its preview when shared in a messenger shows neither you nor the name of the ride.

Companion in the browser. If you open the link of your own running ride while signed in, you can add messages, a photo and a place from there and pause, resume and finish the ride (keep as a journal or discard). The browser does not ask for a location for this: a post is placed at the latest position your sending device reported. A photo is shrunk and re-encoded in the browser (image data such as the capture location is dropped), uploaded as private and gets this position. A place goes into the ride’s GPX as a waypoint, not into “My places”. You can also keep or delete a ride that ended on its own there.

On the device the private app storage holds what waits for sending without a connection (positions, posts, photo files until uploaded), the settings of the last ride, your own quick message texts and the IDs of the rides this device took part in, last sent for, has already asked about and whose GPX it has already saved (at most 50 each). Positions, posts, settings and texts do not go into the Android backup or to a new device; the waiting photo files are kept in the app’s photo folder and, like other photos not yet uploaded, can go into your Android backup. Signing out or switching accounts deletes all of it. Photos are re-encoded before upload, which drops all image data such as capture location and device; their location comes from the ride. Faces in photos of a shared ride are not detected or blurred automatically. A place with the target “My places” is also saved as your own place (section 8a).

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give with “Start sharing”. You can withdraw it at any time with effect for the future by pausing, finishing or discarding the ride.

5s. Group radio without a network over LoRa (Android app)

Group radio. If you turn on the radio under Settings, Devices, “Radio without network” and pair a dedicated radio module built to the open NavX4 protocol, the app transmits over this module by radio (LoRa) to all devices in range that have the same radio code: your display name and, if you are signed in, your account ID (so others see you only once on their map), your position with speed, heading and time of measurement, whether you have internet and whether you need help, your messages in the radio chat, a help call with your last location and the all-clear. Your position goes out only while “Send my position over radio” is on and location tracking runs (guidance, recording, keep-alive service or the radio service’s own location, see below), every 30 seconds while riding and every 2 minutes when stopped. Other phones of the group relay these radio frames, and yours relays theirs, so they arrive beyond direct range.

Encryption and path. Everything goes out encrypted with the key from the radio code (AES-128-GCM); without the code it cannot be read. Only the header of each frame is unencrypted: its type (such as position, message or help call), how often it may still be relayed, a group ID derived from the key, a random sender ID of the app (not a hardware ID) and a counter that shows the approximate time of sending. From these one can tell what type of frame a device sends and when, and that two frames come from the same device, but not from whom and not what they contain. Whoever has the radio code is in the group; you pass it on yourself. None of this goes through our server or to third parties. Radio cannot be limited to particular recipients: anyone in range who knows the radio code receives it too.

What the app stores. In the app’s private storage: whether the radio is on, name and Bluetooth address of the module, the radio code of your group (with the key), the random sender ID, the last counter, the last determined region and your settings. None of this goes into the Android backup or to a new device. What you receive from others (riders, positions, messages, help calls) stays in memory and is gone when the app ends; the chat keeps at most 100 messages. A help call over radio appears as a notification and announcement like a help call in a tour (section 8a).

Region. So that the module only uses the permitted frequencies and limits, the app determines the radio region: if you chose one by hand, that one applies; otherwise from the country at your location. For this it takes the latest location of its running location tracking or, with your location permission, the last location Android knows, if it is at most 30 minutes old; it does not start location tracking for this. It looks the country up offline on the device in a bundled country grid (from OpenStreetMap data, Europe); the location does not leave the device for this and is not stored. If the location gives no country (none known, older or outside the grid), the country of the mobile network applies, otherwise, if no country is known at all, the last determined region. In a country without a known region the app sends nothing until you choose one.

Other apps. Only if you turn on “Other apps may use the radio” (off by default) can apps with the permission “Use NavX4 radio” send and receive their own data over your radio group and read the radio settings (with the name of the radio group and the number of riders in range, without the key and without the radio code); they may set power, antenna and listen-before-talk only with a second switch. What these apps do with it is up to them. They never get the positions, messages or help calls of your group.

Radio service. While the radio is on and a module is paired, a dedicated service of the app with the ongoing notification “Radio without a network is running” holds the module, also when NavX4 is in the background. After the phone restarts or the app is updated it starts again by itself if the radio was on before; if it was off, nothing starts. If you have a radio group, “Send my position over radio” is on and the precise location permission is granted, this service determines your location itself (GPS every five seconds), but only when it starts from the open app; after a restart only once you have opened NavX4. This location goes only into the group radio, not to our server and not into tour sharing; it is not stored and is gone when the service ends. The app neither needs nor asks for an “all the time” location permission for this. If the service cannot start, the keep-alive service holds module and location as before while you send your position over radio (section 5g). You turn the radio off with its switch or “Turn radio off” in the notification; “Shut down NavX4” (section 5g) does not turn it off.

The app asks for the Bluetooth permission only when you search for a module (from Android 12 “Nearby devices”); up to Android 11 the search needs the location permission. The legal basis is your consent (Art. 6(1)(a) GDPR), given by turning it on; you withdraw it at any time by turning off the radio or “Send my position over radio” or by leaving the group.

5t. Face suggestions for photos with ML Kit from Google (Android app)

What happens on your device. If you have allowed face suggestions and take a photo in the app, in the planner or for one of your own places, it looks for faces in it so that you can blur them before uploading (section 8a, “Photos”). If it finds any, it holds the photo back until you have decided. For this it uses the face detection of ML Kit, a software library from Google; the detection model is supplied by the Google Play services on your phone, which download it on first use. According to Google, ML Kit processes the image entirely on the device and sends neither the image nor the result to Google. The app does not search photos of a shared ride (section 5r). Without Google Play services there is no suggestion, and you mark faces yourself.

What Google receives. While it is used, ML Kit sends metrics about performance and use to Google. Google lists: information about the device (manufacturer, model, Android version and build, available hardware accelerators for machine learning), about the app (package name and version), an identifier (depending on how ML Kit is integrated, Google names a device identifier or per-installation identifiers that are not intended to uniquely identify a user or a device), performance values such as latency, the settings of the request such as image format and resolution, the size of input and output, the version of the feature, the type of event and error codes. ML Kit is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA; Google processes these metrics as an independent controller, not on our behalf. They may reach the USA in the process; Google LLC is certified under the EU-U.S. Data Privacy Framework, to which Google’s data protection terms refer for such transfers. According to Google, it uses these data to measure performance, find errors, maintain and improve the interfaces and detect misuse; they are transmitted encrypted (HTTPS), and according to Google they are not passed on to third parties. This processing is governed by Google’s privacy policy. We ourselves do not receive these data. Sources: Google’s pages “ML Kit Android data disclosure”, “ML Kit Terms”, “Google APIs Terms of Service”, “Google Controller-Controller Data Protection Terms” and “Data Privacy Frameworks”, all retrieved on 17 October 2026.

Consent and legal basis. Face suggestions are only available with your consent. Before the app suggests faces to you for the first time, it asks you after the photo and explains what happens on the device and what goes to Google; until you answer, the photo you just took stays on the device. The legal basis for the reading of device information by ML Kit is Section 25(1) TDDDG, and for the face search and the transmission of the metrics to Google Art. 6(1)(a) GDPR, in each case your consent. The metrics serve Google’s own purposes, diagnostics and usage analytics; in the Data safety form on Google Play we therefore declare them as data for analytics. Google does not name a way to switch off this transmission while suggestions are switched on.

Declining, switch and withdrawal. Without your consent the app does not start ML Kit and does not call it; nothing goes to Google for this. You then mark faces and number plates yourself; you have no other disadvantage. The switch “Suggest faces on photos” under Settings, General, Face suggestions is off by default. There you can withdraw your consent at any time with effect for the future; after that the app no longer calls ML Kit. The app stores your answer together with the version of the text and the time only on this device (settings file navx4-gesichtsvorschlag), not in the Android device backup and not in the local backup (section 5o); on a new device it asks again. You can also upload photos in the web planner: there you mark faces by hand, and ML Kit does not run there. App versions up to 0.44.0 do not ask yet: they call ML Kit after every photo and have no switch; the question and the switch come with a newer version of the app.

6. Map display by third parties

To display the map, your browser loads map tiles directly from the following providers. In doing so they receive your IP address and the requested map sections (from which a rough location reference may result):

• OpenFreeMap (base map) – openfreemap.org
• EOX IT Services GmbH, Vienna, Austria (satellite imagery, Sentinel-2) – eox.at
• Mapterhorn (terrain data) – mapterhorn.com

The legal basis is Art. 6(1)(b) and (f) GDPR; without loading the tiles the map cannot be displayed.

Additional map layers (only if you switch them on). In the layers panel of the Android app and the web app you can place further layers over the map. Each is off until you choose it; then your device loads the tiles directly from the respective provider, which receives your IP address and the requested map sections. Nothing of this runs through our server. Without a connection the app requests none of these layers.

Distance circles (Android app only, only if you switch them on). The app calculates the circles around your own position on your device, from the position the map already shows during a drive or in the cockpit. Nothing is loaded and nothing is transmitted to us or third parties; the only thing stored is whether the layer is switched on.

• U.S. Geological Survey, USA (topographic map USA) – usgs.gov
• U.S. Forest Service, USA (designated forest roads, MVUM) – fs.usda.gov
• Bureau of Land Management, USA (federal lands and managers) – blm.gov. Both layers only make requests while the map is over the USA.
• Geoscience Australia, Australia (topographic map Australia) – ga.gov.au
• Kartverket, Norway (topographic map Norway) – kartverket.no
• ČÚZK (Czech Office for Surveying, Mapping and Cadastre), Czechia (map ZM 50) – cuzk.gov.cz
• IGN (Institut national de l’information géographique et forestière), France (Plan IGN) – ign.fr
• OpenStreetMap Foundation, United Kingdom (public GPS traces) – osmfoundation.org
• Deutscher Wetterdienst (German Meteorological Service), Offenbach am Main (precipitation radar, temperature, wind) – dwd.de. In the Android app the “Weather” switch in the cockpit applies to this as well: if it is off, no request goes to the weather service.
• Mapterhorn (hillshading from the same terrain data as the elevation view, see above).
• Your own tile sources: if you enter the address of a tile server yourself, your device requests exactly this server. You decide who runs it; its own terms apply to it.

The USGS, the U.S. Forest Service and the Bureau of Land Management are based in the USA, Geoscience Australia in Australia. If you switch on one of these layers, IP address and map section go there – only on your choice in the panel and only while the layer is switched on. The legal basis is Art. 6(1)(b) GDPR (providing the function you chose), for the transfer to these two countries Art. 49(1)(b) GDPR.

Downloading layers in advance for the road (Android app). In the app’s offline area you can download topographic maps, the hillshading and your own tile sources for an area in advance – the visible map section or a corridor along your route or a file from your library. Only when you tap “Download” does your device request all tiles of this area directly from the respective provider (list above). The provider receives your IP address and the requested tiles; for a corridor, the course of the route can be read from this. The line itself, the area and the downloaded tiles stay in the app’s internal storage; nothing of this runs through our server. “Delete” removes an area again. Public GPS traces, weather and the satellite image cannot be downloaded in advance. The legal basis is Art. 6(1)(b) GDPR, for USGS and Geoscience Australia in addition Art. 49(1)(b) GDPR.

Map cache (Android app). The app keeps map tiles viewed online in internal storage, up to the size you choose in the offline area (50 MB by default, “off” switches it off); “Clear map cache” deletes it. It does not leave the device. While it is on, the map shows topographic maps and hillshading from this cache without a connection.

Place search in the offline maps (Android app). The offline maps contain a directory of places, streets and house numbers. The app searches it first, on the device; only if there is no matching answer does the search text go to our server as before (section 7). The app can note routing packages missing for the active route; the note stays on the device, and the download happens as in section 5d as soon as there is a connection.

Off-road layer (tracks by grade, paths and bridleways). This layer does not come from a third party but from our own package server (navx4.app/packages/ebenen/wegegrad): we build it ourselves from OpenStreetMap data. When it is switched on, the map loads the parts of this file that belong to the visible section. As with any download, our server sees your IP address and which parts were requested (section 3); a rough location reference may result from this. The request contains no identifier and no location. Whether the layer is on is stored by the app on your device, by the web app in the browser (localStorage, navx4-wegegrad). Likewise the colour preset chosen for colour vision deficiency stays on your device only (app: the app’s settings, web app: navx4-farbsicht); it does not go to us. The legal basis is Art. 6(1)(b) GDPR (providing the function you chose).

Contour lines. This layer also comes from our own package server (navx4.app/packages/ebenen/hoehenlinien): we calculate the lines ourselves from freely available elevation data (Terrain Tiles). When the layer is switched on, the map loads the layer’s small directory and the parts of the file that belong to the visible section. As with any download, our server sees your IP address and which parts were requested (section 3); a rough location reference may result from this. The request contains no identifier and no location. Whether the layer is on and with which opacity is stored with the other layers (below). The legal basis is Art. 6(1)(b) GDPR (providing the function you chose).

Which layers you switched on, their opacity and the addresses of your own tile sources are stored by the app on your device, by the web app in the browser (localStorage, navx4-kartenebenen). How much data each layer uses is measured by the device or the browser itself and shown in the panel. None of this is transmitted to us.

7. Place and address search

Our server answers search requests with its own geocoder (Photon, open source) on our own infrastructure. Only if it does not answer does our server forward the request to komoot’s public Photon service (photon.komoot.io). In both cases only the search text is transmitted – in the web planner, if you have already chosen a start or destination point, together with its coordinate so that nearby results come first –, not your IP address; for the reverse search (below) the same applies to the coordinate. The app and the web send the language of the interface (such as “en”) to our server only, so that it names the kind of a result (“River”, “Town”) in your language; it is not passed on to Photon. We do not store the search text. Our application logs only the path of a search request, without search text or coordinate; only if a connection is aborted can the upstream proxy record the full address including the search text together with your IP address in its error log (section 3). This log is overwritten by size (three files of 10 MB each), not after a fixed period.

Reverse search at a map point. If you tap a map point in the planner of the Android app or right-click it in the web planner, our server asks Photon which street is there. Only the point’s coordinate is transmitted, not your IP address; our server keeps the answer for one minute. If our server cannot be reached or knows no street at this point, the Android app asks your device’s geocoding – on most devices a Google service, which receives the coordinate and whose privacy policy applies; if it gets nothing there either, the street stays empty.

Destination and search in Android Auto. If the destination of a planned route exists only as a coordinate (a map point), the Android app asks in Android Auto in the same way which place lies there, to show it as a name – first our server, then your device’s geocoding; only the destination’s coordinate is transmitted. For the straight-line distance to each search result and to read a short Plus Code, the app uses the position of the running drive or the last one your phone already knows (at most two minutes old, only with your location permission); it does not measure anew for this. This position stays on your device; it is neither stored nor transmitted with the search request.

Country of the start point. As soon as a start point is set, the Android app asks your device’s geocoding, for the calculation of a route or round trip, which country it lies in – even before you have the route calculated; on most devices this is a Google service, which receives the start point’s coordinate for this and whose privacy policy applies. The app sends the country code (such as “de”) with the route request to our server so that it places that country’s rule notes under the route; it is not stored there. The app only keeps the answer in memory, per grid cell of about one kilometre. If the geocoding says nothing, the request goes out without a code, and our server uses the rule set of its own setting. The legal basis is Art. 6(1)(b) GDPR.

8. IEX Labs account (optional)

To store routes, tracks and reports across devices, you can sign in with a central IEX Labs account (auth.iexlabs.com, also operated by IEX Labs UG). This processes email address, display name and account identifiers. Sign-in uses the PKCE method. On the web, access and refresh tokens are kept exclusively in HttpOnly cookies; the Android app stores them encrypted in its private storage, with a key that only lives in your phone’s protected key store (Android Keystore), and excludes them from the Android device backup. Routes that an earlier version of NavX4 without an account assigned only to your device are moved into your account as soon as you open your saved routes while signed in (see “Device identifier” in section 4). If you choose a vehicle or route profile, we store this choice as a preference in your account so that it applies on your devices; it contains no location data and is deleted with the account. What else comes together with an account – drives, points, friendships, clubs, photos and more – is listed item by item in section 8a. The legal basis is Art. 6(1)(b) GDPR.

You decide who sees you. For your profile card (display name, picture, description), achievements, statistics and your own tracks there is a separate switch each with the levels “private”, “friends only” and “public”. The default is private everywhere: as long as you set nothing, nobody but you sees anything. You change this in the account under “Visibility settings” (app) or in the account dialog (web). Anyone you block sees you in no way – not even if an area is set to “public”.

8a. What your account creates with us

So that you do not have to guess, here is the complete list of the data NavX4 keeps on the server for a signed-in account. Each of these categories is contained in the account export and disappears when the account is deleted (sections 9 and 11).

• Master data and profile card: email address, display name and account identifier from the sign-in, plus – if you create them – profile name, profile description and a profile picture, which we store as a file.
• Visibility levels: one level each for profile card, achievements, statistics and your tracks (see section 8).
• Preferences and vehicle profiles: vehicle, route profile, avoidances and the vehicle profiles you created with their dimensions.
• Saved routes including labels you assigned yourself and short-lived handover codes for passing a route on to another device.
• Library: tracks, imports and collection icons: besides calculated routes, the library holds tracks – a route saved “as a track”, an imported file (GPX, KML, KMZ, GeoJSON, TCX, FIT) and, if you want, a recording (section 5e). Stored are the line with its waypoints, name, length and – for a recording – the driving time as a number; no timestamps per point. In the Android app an import is first kept on the device; when you are signed in, we synchronise it with your account like any saved route. In the web planner an imported file stays in the browser until you save the route. For each collection we store the icon you give it. Which files are currently on the map, in which colour, and what lines look like (colour, width, arrows, gradient colouring, distance markers) is remembered only by the device or the browser and not sent to us. If an imported GPX file contains several tracks, we store with the line where each track begins, its name and the colour the file names for it. If you explicitly set a colour in the account on a route (“Save as colour in the account”), we store this one colour with the route and synchronise it with your devices; “Remove colour from the account” removes it, and it is deleted together with the route.
• Waypoints on routes: places you set on a route or bring along from a GPX file – coordinate, altitude if any, icon, name, description and the marking as a stage destination, plus, where you set them, an own warning distance, a warning text and whether a warning card is shown for it. A waypoint you take over from a POI result on the way belongs to the route in the same way. They are part of the route: we only store them if you save the route, synchronise them between your devices and delete them with the route. If you share a route by link or create a group tour with it, the recipients see its waypoints too; if you publish it as a community track, the waypoints are left out. The proximity alert on the way is calculated solely on your device with the position the guidance determines anyway; nothing is transmitted or stored for it.
• My places: places you remember – from the search, with a long press on the map, with “Quick save” in the app, in the cockpit or in Android Auto, or in the web planner. Stored are name, coordinate and category and, as far as you fill them in, description, tags, surface, suitable vehicles, visitor level, best time to visit, warnings and references to your own photos, plus whether you marked the place as a favourite and the country it lies in. We determine the country from the coordinate when you create or move a place: the Android app asks our server, which – as with the reverse search (section 7) – asks our own Photon first and the public Photon of komoot only if ours fails, and without an answer the geocoding of your device – on most devices a Google service that receives the coordinate and to which its privacy policy applies. If you create a place in the web planner or it arrives from the app without a country, our server asks Photon in the same way. Only the coordinate of the place is transmitted, not its name and no identifier of yours; if no country is found, the field stays empty. If you sort the list by distance, the app or the browser measures your position once, only on this choice and with your permission; the position stays on your device. Without signing in, the places stay in one file of the app on your device; when you are signed in, we synchronise them with your account so that the app and the web planner show the same ones. If you delete a place, an empty deletion marker – only identifier and deletion time – remains for 90 days so that your other devices take over the deletion. For “Quick save” the app measures your position once, only when you tap and with your permission; in the cockpit and in Android Auto it takes the position determined there anyway. A photo you take in the app for a place is a private photo at the place’s location; the item “Photos” applies to it. If you share a place, name, coordinate and a link to openstreetmap.org go to the app you choose for it. Other users do not see your places – except those you show publicly (item “Public places and events”). Display and presets of the places are remembered by the device or the browser and not sent to us. In the Android app the places go into the Android device backup like the saved routes if you have switched that on.
• Drives: start and end time, distance driven, the unpaved part of it, elevation gain and loss, the points earned and the reference to the route you followed – only for drives whose reporting you agreed to (section 5). The raw chain of your GPS positions is not stored – the driven line is, see the next item. A drive stays until you delete it: one by one in the drive history of the app or the web planner, by deleting all your content (“My contributions only”) or with the account. If you delete a single drive, its line including the fingerprint and its points go with it (they then no longer count in leaderboards and challenges either); your own photos that were attached to the drive remain without a reference to it, and your first-time drives remain because a cell cannot be assigned to any single drive.
• Driven lines: for every drive your app submits since 22 September 2026, the driven line – the parts of the guided route you actually drove, per section with the note “paved” or “unpaved”, simplified to about ten metres. No timestamp per point, no speed, no accuracy; the time reference results solely from the start and end time of the drive. Purpose: it is the basis for unpaved kilometres only counting in full the first time – also on drives without a saved route. We also show it to you as a map of the drive in your drive history. The line lives as long as the drive it belongs to – it has no deadline of its own because the drive has none either; it is contained in the account export and is deleted with the drive: one by one in the drive history, when you delete all your content and when the account is deleted. Nobody but you gets to see it; it flows into no leaderboard and no profile. Data minimisation: the app only sends the driven parts of the guided route, simplified to about ten metres, without time, speed or accuracy per point; free driving without guidance creates no line, and the positions of a drive recording stay on the device (section 5e).
• Comparing driven lines against points abuse (since 29 September 2026): for every driven line we store a fingerprint in the same row – a checksum from which the line cannot be reconstructed – and compare it with the fingerprints of other drives. If exactly the same drive, that is the same line with start and end identical to the second, has already been counted for another account, we do not count it again. If two accounts drive the same line at the same time or one account submits the same line several times, our moderation team sees this in a list of the last 30 days: which accounts, when, how far and how many points – but not the line itself and not where the drive took place. Points are not deducted automatically as a result; a human decides whether anything is done. No device identifier or IP address is included. The fingerprint is deleted with the line. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a fair points system).
• XP ledger: per credit the source (e.g. drive, confirmed report, confirmed photo, achievement, challenge), the amount, a reason and the time. The ledger only knows credits and no reversing entries; if you delete a drive or a single piece of content, the credit attached to it drops out entirely.
• Achievements: we create nothing additional for achievements themselves. They are calculated from the figures listed above anyway; only the corresponding XP credit in the ledger is stored.
• Challenges: challenges you created with title, description, period and – if set – a rectangular area, as well as your participations with the time you joined. Leaderboards are calculated from the drives on every request and not stored as a separate list.
• First-time drives: for every grid cell driven for the first time, an entry of account identifier and cell identifier. The grid is about 111 metres coarse; no time is stored with it, and the cell cannot be assigned to any single drive.
• Friendships, requests and blocks: who is friends with whom, open requests and blocks you issued, with their time.
• Clubs: clubs you founded with name, description and visibility as well as your memberships with role and time of joining.
• Club picture: if a club's lead uploads a picture (JPEG, PNG or WebP, at most 256 KB), we store the image data with the account that set it and the time. Everyone who may see the club can see it. Moderation can hide it. It is deleted when the lead removes it or deletes the club, and with the lead's account.
• Invite links: when a club's lead or moderation creates a link, we store the code, the club, who created it, expiry, usage limit, how often it was used and whether it was revoked. Anyone opening the link sees only the club name and member count without signing in; joining happens only after signing in and at the press of a button, and is stored like any membership. Links are deleted with the club and with the account that created them.
• Joining nearby: when you tap "Awaiting group invite", we store a six-digit code for at most five minutes and – only if you allow the app your location for it – your location. It is used solely for matching with club leads and moderators within one kilometre; they see your name and a coarse distance band (such as "up to 50 m"), never coordinates. Who adds you is recorded. We delete the location as soon as you are added, and the whole window on "Stop", when you leave the screen and after five minutes. While the window is open, any inviting person in range can add you to their club; you can leave right away. Anyone blocked with you does not see you and cannot add you. When a club's lead or moderator searches for people waiting, the app sends their own location for this one comparison; it is not stored, only the time of the search for the abuse limit and, until the respective window ends, which waiting people were shown to them – so that a tap adds exactly those.
• Group tours: title, description, period, state and a copy of the route, plus the list of participants with their role.
• Active group and group route: which of your clubs is currently your active group, with the time you chose it. If you set a group route as lead or moderation, we store a copy of the route with title, origin, length, your account as the one who set it and the time; all members of the club can see it. The app keeps a copy of your active group’s group route in the private app storage of your device so it stays visible without a network; the copy does not leave the device. The choice is deleted when you clear it or are no longer a member, the group route when lead or moderation remove it, and both with your account.
• Chat, files, places and drawings in groups: what you write or share in a club – messages in the group chat, shared routes and tracks (as a copy of the route with title, length, point count, size, origin and whether members may download a copy), shared places (name, kind, coordinates, note) and drawings on the group map (pins, lines, areas with colour and label), each with your account and the time. Also whether your “Share GPX with the group” switch is on: then the app shares the routes and tracks loaded on your map with that group, and switching it off removes them there again. Only the members of the club can see any of this; anyone blocked with you does not see your contributions. If you load a group file onto your map, the app keeps a copy in the private app storage of your device; it does not leave the device and is not backed up. If you report content, it goes to our moderation quoted with your report. A contribution is deleted when you or the club’s lead and moderation remove it (for a message the text disappears, the place remains as “removed”), all content of a club when it is dissolved, and your contributions with your account. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
• Public places and events: If you switch on “Show publicly” for one of your places, we store that it is public and since when. Then everyone – even without an account – sees its name, category, coordinate, description, tags, surface, suitable vehicles, visitor level, seasons, warnings and country, as long as it is public and you do not move it into a private category (General, Fence, Home, Work, Danger); these categories never become public. Your favourite star and – unless you switch it on yourself – your photos and anything about you, neither name nor account id, do not become public. If you switch on “Show my name” for a public place, we store that choice and show your display name (never an email address) as “Added by” – to everyone, even without an account, and to signed-in users also your account id so they can follow you. If you switch on “Show photos on the place page”, we store that choice and make the photos the place has at that moment public; the place page (navx4.app/o/…) then shows them to everyone. Switching off removes the name or the photos from the place page; a photo that became public this way stays public in your photos until you make it private again there or delete it. If someone adds the place to their own places, that is a copy of the details in their account without any link to you; if they are signed in and online, we also store that they took over this place (once per account and place) and show on the place only the number of take-overs as “favourites” – never who; the first count per place is recorded by the abuse limit like a rating, with a timestamp (section 8a). Rating and favourites are also used to filter and sort the list; “Only from riders I follow” and “Hide my places” evaluate your friendships and whom you follow for this, without storing anything. If you create an event, we store title, kind, start, end, meeting point (text and, if you choose one, coordinate), description, whether it is public or for a club, your account as organiser and the times, plus – if you choose them – the vehicle communities it is meant for and the country of the meeting point, which we determine from its coordinate via reverse geocoding (section 5, Photon); only that coordinate is sent; signed-in users (for a club event only its members) see it with your name as organiser. If you answer going, maybe or not going, we store your answer with the time; others only see the number of people going, never names. Members of a club are notified of a new club event (title and your name, via the polling described under “Notifications”). “Add to calendar” hands title, time, meeting point and description in the app to the calendar app of your device that you choose (no calendar permission for NavX4), on the web as a file to your browser. Searching for places or events nearby measures your position only when you tap and with your permission, and only sends a map area or radius to our server, which does not store it. When you open “My places”, the section “Places of other riders” asks our server for public places in the visible map area (in the app around the map centre); only that area or the map centre goes along, not your measured position (if the map is following your location, its centre is where you are), and the server does not store it. Discover shows public tracks, public places and – when signed in – public events in one list, without names or account ids; “Closest first” sends your position in the app (only when you tap and with your permission) or the map centre on the web with the request to our server, which uses it only for sorting and does not store it. If you report a place or event, we store the content, the reason, your name and your account for moderation; the owner is not told who reported it. If moderation hides a place or event, its owner reads the reason and can appeal. Publication, events and answers are deleted when you withdraw or delete them, with your account and – for club events – with the club when it is dissolved; reports remain as a moderation record (section 8a). The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
• Feed and following: If you write a post, we store its text, visibility, time, your account as author and – if you choose them – one of your own photos and a location (in the app the map centre or, only when you tap and with your permission, your position; on the web the map centre). From that location we determine the country via reverse geocoding (section 5, Photon); only the coordinate is sent. By default only your friends see the post; “Public” posts are seen by everyone signed in – each time with your display name, the location, the country and the photo. A photo that was not public becomes public with the post – the app and the web app point this out before you send it; if you make it private again or delete it, it disappears from the post. If you follow someone, we store that with the time; you then see their public posts and the places, events and tracks they made public. Who follows you you only learn as a number, not by name – and vice versa. Anyone blocked with you cannot follow you and does not see your posts. The feed also mixes in public places, events and tracks without names. The app keeps the newest entries and the number of people you follow as a cached state in the device’s cache folder so that the overview and the cockpit row show something without a connection; it is not part of any backup and is deleted when you sign out. Reporting a post works like reporting places and events. A post is deleted when you delete it; posts and follows (both directions) are deleted with your account; the photo stays in your photos until you delete it. If you edit one of your posts, we store the new text, the visibility, the photo and the time of the change; the post then shows “edited”, and a newly chosen private photo becomes public with the change – after the notice. If you tap “Like” on someone else’s post, we store that with the time; everyone who sees the post only sees the number, never who. A like is deleted when you take it back, all likes of a post when the post is deleted, and your likes and the likes on your posts with your account. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
• Tour positions: only while you have location sharing switched on in a tour. Stored is exclusively your latest position per tour – coordinates, accuracy, heading, speed, altitude and the time of measurement and of receipt. Every new report overwrites the previous one, so no route travelled is created. Consent: sharing is separate from accepting the tour, has to be switched on individually per tour and is off unless you act; the switch states who sees what and when it is deleted. The legal basis is your consent (Art. 6(1)(a) GDPR), which you withdraw at any time with “Stop sharing now” in the app or “Stop sharing my location” on the web. Who sees it: only the participants who accepted this tour, and only in this tour – not people invited, not people you blocked or who blocked you, and nobody outside the tour. Deletion: if you switch sharing off, leave the tour, are removed or the tour is ended or cancelled, we delete the position immediately. A position older than twelve hours is no longer served and is deleted – along the way as soon as someone reports a position again or opens a live map, and in any case by an hourly clean-up run, so at the latest a little over an hour after the twelve hours have passed.
• Sending device in tours: so that only one device per account sends your location into a tour, the app sends a random identifier it creates once (not a hardware identifier) and the name your phone gives itself (manufacturer and model) with each report. We store one row per tour with the identifier, the name, since when and when this device last sent. Who sees it: only you – the app uses it to show “Your location comes from …” and asks before a second device takes over; the other riders still only see your name and position. Legal basis is the same consent as for the tour position. Deletion: immediately when you stop sharing, leave the tour or are removed by the organiser, otherwise twelve hours after the last report (hourly clean-up run) and with your account. Muting riders and the group alerts (no signal, stopped, distance, oncoming) stay on your device: for stops the app only keeps the point where each rider came to a halt, for the oncoming alert (“is coming towards you”) only the last calculated distance to them, both in memory – nothing is stored or sent for it. The oncoming alert uses your own location, heading and speed and the live positions you already see. Rider trails: the line behind a fellow rider (where they rode in the last few minutes) is built in the Android app only from these live positions and only in your device’s memory – at most 15 minutes back, never stored and never sent. It is gone as soon as the tour ends, you leave the tour or the rider stops sharing, and you can switch it off in the group settings.
• Help calls in tours (help beacon): if you press “I need help” in a tour you accepted, we store one row per tour with your account, the time of the call and – if your device has one – your last position with accuracy and the time of measurement and of receipt. The position is sent even if you do not share your location otherwise; the app says so before you raise the call. This is not an emergency call: nobody except the riders in the tour is notified. The legal basis is your consent by raising the call after the confirmation (Art. 6(1)(a) GDPR). Who sees it: only the participants who accepted this tour – not people invited, not people with whom a block exists; they get it in the live map and as a notification on the phone, and the all-clear likewise. Deletion: “I’m OK” deletes the position immediately; we delete the row itself twelve hours after the call (hourly clean-up run) and with your account. If you leave the tour, nobody sees your call any more.
• Fall detection (Android app, only if you switch it on): while navigation or recording runs, the app reads the phone’s accelerometer and gyroscope and the speed of the running location tracking and decides on the device whether you have fallen; it keeps the last five minutes of these values in memory only. After a detected fall and 60 seconds without “I’m OK”, a help call goes to the running shared tours you accepted – as described above under “Help calls in tours”, with your last position. This is not an emergency call. Voluntary data donation: if you also switch this on (or report a missed fall), we send the sensor trace from 30 seconds before to 15 seconds after an event to our server – acceleration, rotation rate, speed, plus sensitivity level, vehicle type, app version and whether it was a false alarm. A position is never included. We store it linked to your account to improve the detection. The legal basis is your consent by switching it on (Art. 6(1)(a) GDPR); you can switch it off at any time. Deletion: “Delete donated traces” in the app deletes all of them immediately; otherwise we delete each trace after twelve months and with your account. Nobody but us sees them.
• Theft protection (Android app, only if you switch it on on a device that stays on the vehicle): there the app reads the accelerometer, charging and screen state and decides on the device whether to trigger; these values are neither stored nor sent. The owner contact you enter for the lock screen stays on the device and, after “Report stolen”, is shown publicly on its screen and lock screen. We do not store your PIN anywhere – the device only keeps a key derived from it. With an account the device registers with us (name, random device identifier, a key for the Bluetooth path) and sends its state every ten seconds to every minute: armed or triggered and why, stolen, locked, on power, battery level, whether a PIN is required to stop it together with a salt, app version. It sends a position only while an alarm is triggered, after “Report stolen” and for ten minutes after “Locate”; we keep it for seven days, at most 500 per device. Your remote commands (such as “Stop alarm”) are stored with their result for seven days; an attached PIN proof is computed from your PIN and allows conclusions about a short PIN. Who sees it: only you, in the app and at navx4.app/konto/geraete; a triggered alarm reaches your other devices as a notification. If someone else has the device, the position shows where it is with them – the protection is meant for your own device. Bluetooth: if you switch on “Can be stopped nearby via Bluetooth”, the device broadcasts a constant short identifier by which it can be recognised within radio range. The legal basis is your consent by switching it on (Art. 6(1)(a) GDPR). Deletion: “Remove from account” in the app or on the web deletes the device, commands and positions immediately, otherwise after the periods above and with your account. There is no SMS on alarm.
• Roadbooks in your account (app and navx4.app/konto/roadbooks, only when you upload one or create one on the web): the file itself (PDF or OpenRally GPX) with name, type, size, checksum and time; at most 20 MB per file, 50 roadbooks and 100 MB in total. An OpenRally roadbook made from a route is computed by your browser from the saved route; only the finished file reaches us. Roadbooks are not synchronised on their own – you start every upload and download. New version: if you save an edited roadbook in the app that is in your account, or use “Upload new version” on the web, the new file replaces the previous one – only if the account still holds the version your change is based on; otherwise everything stays as it is and you decide. Name and shares stay; we do not keep the previous version. Sharing: if you share a roadbook with a friend, we store with whom and since when; they see its name, the file and your name and can download it. The share only works while you are friends and neither has blocked the other. A copy they already downloaded stays on their device. Legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Deletion: “Delete” in the app or on the web removes the file and its shares immediately; otherwise a roadbook stays until you delete it or your account.
• Photos: the image itself, plus place and time of capture, category, caption, visibility and image dimensions. We remove hidden capture data (EXIF) when uploading. You mark faces for blurring yourself; the Android app suggests them to you for this if you have allowed it, and then looks for them on your device with ML Kit from Google (section 5t); the unblurred original does not leave it. There is no automatic anonymisation.
• Photo ratings: which photo you marked as helpful, with the time. Only the number of votes is public; you can take back your “helpful”.
• Track ratings: per track you rated, your values on the axes scenery, condition and difficulty – each 1 to 5, together with the scale in force when rating –, plus the time of the first rating and of the last change. Only the number of votes and, from three votes on, the average per axis are public. We show nobody who rated how, not even the moderators. You can withdraw your own rating at any time.
• Progress on tracks: per track of someone else you rode, the best and the latest measured share of the route, the number of rides and the times of the first and the last – also when it was less than 80 % (“started” from 10 %). No positions, no line. You see the list under “My tracks”; the creator only sees numbers without names (section 9).
• Collected tracks: which public tracks you collected, with the time. Only the number of collectors of a track is public.
• Votes on reports: whether you confirmed or contradicted someone else’s report, with the time. Only the totals of confirmations and contradictions are public.
• Tracks, comments and reports – see section 9.
• Abuse limit: timestamps of social actions (requests, invitations, reports) so that mass actions can be limited.
• Feedback: feedback and bug reports you sent; for a bug report from the Android app, only with your consent, the device details and the cleaned app log, which we delete again 30 days after the report, and from the web planner, only with your consent, the browser and device details (section 5o); also the category, the products concerned and our team’s reply (section 5p). Under “My reports” you can also delete each of your own reports.

What we do not keep. NavX4 does not store a list of your sign-ins; who is signed in where is known only to the IEX Labs auth hub (see section 10). We only keep devices where this policy says so: the devices of theft protection, the sending device per tour and the sending device of a shared ride (section 5r), each with a random identifier of the app and the device’s name. There is deliberately no search for other users’ names or email addresses – friend requests only go to people you are already in a tour or a club with.

Automatic plausibility checks. Whether a reported drive counts and whether it confirms someone else’s track as driven is checked by the server automatically against measurable limits – such as speed, jumps between two points, duration and overlap with drives already reported. This decides about points and badges in the game and about nothing else; access to NavX4, the account or functions does not depend on it (see also section 12). The legal basis is Art. 6(1)(b) and (f) GDPR – without this check every leaderboard would be worthless.

9. Community content

You can only submit reports (e.g. closures), comments, ratings and tracks with an account. We store them with your account identifier to prevent abuse and to enable trust ratings; the device identifier from section 4 plays no part in this. Of ratings – your values for a track, your “helpful” for a photo, your confirming or contradicting a report – we only publish the total: how many voted and, for tracks from three votes on, the average. Who rated how stays with us (section 8a).

You decide who sees your track. You set your own track to “private” (only you see it), “by link only” or “public” (in the library for everyone) and change this at any time under “My tracks”. For “by link only” we create a random link that cannot be guessed (navx4.app/t/…). Whoever has it sees the track’s map, key figures, title and description without an account – never your name or your account. Such a track appears in no list, no profile and no search, and the page is blocked for search engines. You decide whom you send the link to; the recipients can pass it on too. If you set the track to “private”, the link is invalid immediately; if you share again afterwards, a new one is created. The link is contained in your account export and disappears with the track.

Track page, problems and statistics. The page of a public track shows who maintains it: for community tracks your display name only if your profile levels show the viewer both profile and tracks – otherwise “a NavX4 rider”. Every view of the page by someone other than you increases a counter; only the number is stored, not who. We determine the country of a public track from its start point via reverse geocoding (section 5, Photon); only this coordinate is sent. You report a problem on a track (fallen tree, bridge gone, closed) with an account: we store kind, text and time with your account identifier and, if you choose so in the app, your last position (at most 500 m from the route). Everyone sees the report on the track and the point on the map – without your name – until the creator marks it resolved; the creator is notified but does not learn who reported it. The report stays until you delete your account or the creator deletes the track. As the creator of a track you see anonymous usage data: how many other accounts rode or started it, by season and month, and how its ratings developed – a monthly average only from three votes, so that no single rating can be read off. On comments we show whether the creator is writing and whether the author has ridden the route – as yes/no, without names. Reviews of public places (1 to 5 stars and a text, one per account) and the place owner’s reply are stored with the account identifier; publicly they appear without names, an average only from three reviews. You can delete yours at any time; they also go with your account. Videos on a track page are the creator’s links to YouTube or Vimeo. We only load the provider’s player when you explicitly start the video (YouTube in its cookie-less variant, Vimeo with “do not track”); your IP address and browser data then go to the provider, and its privacy policy applies. In the app a video opens at the provider. The legal basis is Art. 6(1)(b) GDPR (the function you use) and, for the view counter, (f) (an anonymous counter).

You can delete things yourself, without asking us. Individual content – a photo, a comment, a road report, a saved route, your own track, a drive including its driven line (in the drive history) – can be deleted directly where it is shown. All content at once (without giving up your account) or your whole NavX4 account you delete at navx4.app/konto/loeschen (a page in German so far) or in the app under Account → “Delete data or account”. Beforehand you see, with real counts, what disappears and what remains; deletion only happens once you type a confirmation word. An informal email to info@iexlabs.com still works as well.

What a deletion does not take along. Moderation cases – a report about a piece of content and its decision – remain as long as they are necessary to fend off abuse (Art. 17(3)(e) GDPR). The answer to your deletion request states this explicitly instead of keeping quiet about it. Contributions by other people also remain; where they referred to you, the reference is removed and the affected count is recalculated.

Public inventory counters. At navx4.app/api/v1/stats and on the navx4.com home page we state how many public community tracks and curated routes exist – and, once we enable it, the number of registered accounts. These are plain counts: no title, no name, no identifier. Private tracks and tracks shared by link only are not counted. The request needs no account and no cookies; we store nothing about it.

10. Retention period

Server logs are only kept for a short time. We store account and community data as long as your account exists or the content is published, and delete it at your request – see section 9, you can trigger this yourself.

Location data in detail. We do not store the position of a route calculation (section 5). A drive and its driven line remain until you delete the drive, delete everything at once or delete your account (section 8a) – the line has no deadline of its own. The server keeps the latest position of location sharing in a tour for at most twelve hours; it is deleted at the latest a little over an hour after that, and immediately when you stop sharing, when you leave and when the tour ends (section 8a).

Backups. So that accounts and content survive a server failure, we back up the database and the uploaded images (photos, profile pictures) every night. The backups are kept on our server and as a copy on a computer of IEX Labs, both accessible only to us. On the server they are deleted after 14 days, on the computer also after 14 days, provided the nightly synchronisation runs without errors – if it fails, the copies stay there until the error is fixed. Because we back up this computer completely ourselves, the copies can also remain in its full backup for as long as that backup is kept. What you delete therefore does not disappear from the backups immediately, but only once the last backup containing this data has been deleted. We do not pass the backups on and only restore them if data has been lost.

NavX4 and the sign-in are two things. If you delete your NavX4 account, all data NavX4 stores about you disappears. Your sign-in itself – email, password, passkeys, a linked Google account, two-factor setup – is held by the central IEX Labs auth hub and has to be deleted there; we link the page after the deletion. The order is up to you: if you delete the sign-in first, NavX4 learns this from the auth hub – NavX4 asks there once an hour which accounts have been deleted and then deletes all data on your account to the same extent as above, at the latest after a little over an hour. We do not keep a list of deleted accounts for this; only a checkpoint up to which the messages have been processed is stored (it contains the identifier of the deletion processed last and is overwritten at the next run). If you sign in again later, you start NavX4 with an empty account – the old data does not come back.

11. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). To exercise them, contact info@iexlabs.com. You also have the right to lodge a complaint with a data protection supervisory authority; the one responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Ansbach.

For two of these rights you do not have to write to anyone. Access and data portability (Art. 15 and Art. 20) are served by the account export in the account dialog and in the app: a complete JSON file with everything the server keeps for your account – including your photos –, plus your routes and tracks as GPX. Not included are raw moderation data and blocks against your account: they name the person who reported and the moderator (Art. 15(4) GDPR). The export file says so. The right to erasure (Art. 17) is served by the ways from section 9.

12. No automated individual decisions

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.