YowzaMap.com

Privacy notice

Version 2026-10-23

Who we are

The controller of your personal data is Brebis.cz s.r.o., ID No. 24567108, Koterovská 601/25, 326 00 Plzeň, Czech Republic. You can reach us at info@brebis.cz.

What we collect and why

Your account. When you sign in with Google or Microsoft, we receive your name, your email address and an identifier the sign-in service assigns to you. We use them to recognise you, to handle your request for access and to contact you about it. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

News by email. Now and then we email you what is new in YowzaMap - mostly what changed in the version you are testing - in your language, to your account's address. Every such email has a link to unsubscribe, and you can switch the news off and back on in the app's account menu. We keep which news went to whom and when, and whether the email was handed over for delivery; we don't track whether it was opened or clicked. Legal basis: our legitimate interest in telling the people who test YowzaMap what changed (Art. 6(1)(f) GDPR).

Your request for access. When you asked, what we decided, and which version of the testing terms and this notice you agreed to and when. Legal basis: providing the service, and our legitimate interest in being able to show what was agreed (Art. 6(1)(f) GDPR).

How the app is used. For example when you open the app and how long you actively use it, that a route was calculated (with the routing profile and the number of points), which layout and basemaps are in use and how many map tiles were loaded, together with technical data such as the browser and an approximate location derived from your IP address - the address itself isn't stored. This is recorded under a pseudonymous identifier rather than your name or email, but our administrators can match it to your account: to see what running YowzaMap costs per person, and to look into problems. When calculating a route fails, we also record the route's points, to find out why. We use all this to fix problems, keep an eye on costs and improve YowzaMap. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Feedback you send. What you write, together with your account, the page you were on, the map layout, screen size and browser. It is emailed to the YowzaMap team so we can reply to you and look into what you describe. Legal basis: our legitimate interest in improving YowzaMap (Art. 6(1)(f) GDPR).

Your routes and settings. The routes you are working on and the way you left the app - basemaps, map positions, heatmap and routing settings - are kept with your account, so they are there on your next visit and on your other devices. That includes where your routes and maps are, which can say something about where you ride or run. Our administrators see how many routes you saved and how many variants they have, not the routes themselves. Routes are calculated on our own server from the points you place; nobody else receives them. To show the weather along a route, our server asks MET Norway for the forecast at points along it, rounded to about 5 km and without anything that identifies you. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Routes you share. A saved route you share by link can be seen by anyone who has the link, as the testing terms describe. The page with the shared route doesn't show your name or email. We count how often a link is opened. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Opening a shared route. This notice also covers people who open a link to a shared route, with or without an account. We record that the link was opened, with technical data such as the browser and an approximate location derived from the IP address - the address itself isn't stored - and no cookies. For someone signed in, it's recorded like the rest of their usage. Legal basis: our legitimate interest in running and protecting the service (Art. 6(1)(f) GDPR).

Rides recorded with the Android app. When you record a ride in the YowzaMap app, your phone keeps your position every second with the time, speed, height (from GPS and the barometer), how accurate the position is, the battery level and whether the screen was on, together with a summary of the ride (distance, time, climb, kind of activity). Once the app is signed in, it sends the recording to our server, so that you see it on the web and on your other devices. A recording shows where and when you went, including where your rides start and end – your home, for example. Only you see your recordings and we don’t pass them on; you can delete them in the app or on the web. The app uses your phone’s location only during a navigation or recording you start. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Signed-in devices. To keep the Android app signed in, we keep your phone’s name, when it signed in and when it was last used, and a fingerprint (hash) of its access key – the key itself stays on the phone. You can sign a device out at any time in your account menu on the web. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Navigation to the start of a route. When the app leads you to the start of a route, it sends your current position and the route’s start to our server, which works out the way there. We don’t keep them – like the points of any route, only in the records of routes that failed to calculate. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Planning tables and their chat. When you start or join a planning table, the others at the table see your name and profile picture (if you sign in with Google; their browsers load it from Google directly), the routes you plan at the table, the places you point out on the map and what you write in the table's chat; while you plan, also where your map looks and which basemap you use. When you vote on the variants in a table’s chat, the others at the table see how you voted. We don't share your device's location. We keep a table with its plan and list of participants for 24 hours from its last use, and for 90 days after it is closed, so that anyone with its link and access to YowzaMap can still look at it; messages in a table's chat are kept for 90 days from when they were written. The email addresses you send an invitation to are used only to send it and are not stored. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Teams. When you create or join a team, its other members see your name and profile picture (if you sign in with Google), your role in the team, the rides you put in, whether you are coming to a ride and which way you ride it, and what you write in its chat; the team’s administrators also see who asks to join. Everyone in a team sees its routes and rides. Emails about the team – a new ride, a change to or the calling off of a ride you are coming to, a reminder the day before – go to your account’s address, which the others don’t see. The email addresses a member sends an invitation to are used only to send it and are not stored. We keep a team with everything in it until it is deleted; leaving a team or deleting your account takes your place, your answers and your messages out of it. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Who else is involved

  • Microsoft Azure hosts YowzaMap and stores the data above in data centres in the European Union. The website itself is delivered from Microsoft's servers nearest to you.
  • Google or Microsoft, whichever you sign in with, handle the sign-in under their own privacy terms.
  • Map providers. Our own map is drawn in your browser from OpenFreeMap's map data, with elevation data for the shaded hills and contour lines from Amazon Web Services (AWS Open Data); it is also the map on pages of shared routes. The other basemaps come from Mapy.com (Seznam.cz, a.s.), Thunderforest (Gravitystorm Limited) and Mapbox (Mapbox, Inc.). All of them send their tiles straight to your browser, so they see your IP address and which part of the map you are looking at.
  • Place search. What you type into the search, and a spot you press and hold on the map to have it named, go from your browser to Mapy.com (Seznam.cz, a.s.) over Czechia and Slovakia and to Photon (komoot GmbH) elsewhere. When you look for a kind of place – pubs, cafés – that our own map doesn’t show in the part you are looking at, your browser asks the Overpass API (overpass-api.de, run by FOSSGIS e.V.) for them there. These services see your IP address and what you asked for.
  • MET Norway (the Norwegian Meteorological Institute) receives, from our server, the points along a route you ask the weather for, rounded to about 5 km - not your IP address or anything else that identifies you.
  • Strava, through the YowzaMap Heatmap extension. If you install it, the extension uses the strava.com session signed in in your browser to fetch Strava's heatmap - the global heatmap and, with a Strava subscription, your personal heatmap - and hands it to the YowzaMap page open in that browser. Strava receives those requests from your browser, as it would on strava.com; our server never contacts Strava. To know which personal heatmap is yours, the extension reads your Strava profile settings each time YowzaMap opens and keeps your athlete ID in the browser only. Nothing the extension handles is sent to us. Strava's own terms and privacy policy apply to your Strava account.

Cookies and browser storage

We use only what YowzaMap needs to work: a cookie that keeps you signed in, and your browser's storage for a copy of your routes and settings, so the app opens without waiting for the network. No advertising or tracking cookies.

How long we keep it

Your account, request for access, routes and settings: for as long as you have access. If you ask us to delete them, we do so within 30 days; when the preview ends, we either delete them or ask whether you want to keep your account. Usage data, including the points of routes that failed to calculate: 1 year, so that one season can be compared with the next.

Recorded rides: until you delete them, at the latest for as long as you have access. Signed-in devices: until you sign them out, at the latest for as long as you have access.

Planning tables: an open one for 24 hours from its last use, a closed one for 90 days; messages in a table's chat for 90 days from when they were written.

Teams: until they are deleted; your place in a team, your answers and your messages until you leave it or delete your account.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to object to processing based on our legitimate interest, and to data portability. Write to info@brebis.cz. You can also complain to the Czech Office for Personal Data Protection (uoou.gov.cz).

Changes

We will update this notice as YowzaMap changes; if a change affects what you agreed to, we will ask you to confirm the new version.