Privacy policy

Last updated 23 September 2026

This policy explains what Maze collects, why, where it is kept and how to get it deleted. It covers the iPhone and Android apps, the web app at https://app.ridemaze.com and this website. It is written to match what the app actually does. If you find a place where it doesn't, please tell us.

The short version

You can use Maze without an account. Your data is then tied to a random ID the app creates on your phone, not to your name.
Maze uses your precise location. It needs it to show you on the map, plan and navigate. While the app is open and you are moving, it also saves road-usage dots so we learn which roads get ridden. Ghost Rider in Settings turns that off.
It records a ride, including with the screen off, only when you start a recording or turn on Auto-record.
The points you save on the map (gravel, a pothole, a view, a like and its note) are visible to every rider, without your name or email. The ones you keep for yourself, such as your own place, are not.
Your data is stored on our server in Germany, with backups in Latvia. If you make an account, sign-in is handled by Google Firebase.
No ads, no selling of data, no analytics or tracking tools, no cookies.
You can ask us for a copy of your data or for its deletion at any time: [contact email].

1. Who we are

Maze is run by Klavs Buss, Barona iela 76, Rīga, Latvia, who is responsible for your data (the "controller" under the EU General Data Protection Regulation, GDPR). Write to [contact email] about anything in this policy.

2. What we collect, when and why

What	When	Why
Device ID: a random code the app creates the first time it starts.	Sent with every request that reads or saves your data on our server.	Keeps your rides, routes and vehicles yours when you have no account.
Road-usage dots: position, speed, direction, GPS accuracy, altitude, time and the vehicle you picked.	While the app is open (on screen) and you are moving: at most one dot every five seconds, and one when you save a point. Short trips (under about ten dots) are never sent. Off with Ghost Rider.	To count how often each road is ridden, which with riders' likes tells us which roads are worth riding.
Recorded rides: the same fields, about one per 10 metres ridden, and whether the app was in the background.	Only while a recording runs: you started it, or Auto-record did (off by default). With "Always" location permission, it continues when the screen is off. A recording stops by itself after a long stop, and after 12 hours at most.	So you can see where you rode, your speed and climbs, and ride it again or in reverse.
Steepness dots: the same fields, about one per 10 metres.	Only on steep stretches (8% or more over at least 20 metres), while the app is open or a recording runs. Off with the Altitude meter switch or Ghost Rider.	To mark steep roads from real measurements.
Route requests: start, finish, stops and the ride style you chose.	When you ask for a route while online. The iPhone app can plan routes on the phone with a downloaded map; then nothing is sent.	To compute routes. Not stored unless you save, favourite or start a route.
Saved routes: the line, its distance and stats, and the name of an imported GPX file.	When you save, favourite or start a route, or import a GPX file.	So your routes are there next time, on every device you sign in on.
Points: category (a road mark such as gravel or a pothole, a view, a like), place, time, the road and direction it applies to, and an optional note of up to 500 characters.	When you save a point or like a road. To work out your direction, the app also sends your last 90 seconds of movement with it. We use that once and do not store it.	To show riders what is on a road, and to learn which roads riders love. Points are public, except the ones you keep for yourself (see section 6).
Vehicles: type (motorcycle, car, bicycle), top speed, and brand and model if you add them.	Asked the first time you open the app; editable in the app.	To tell your rides apart by vehicle.
Account (optional): email address and password, your account ID, when the account was created and when you signed in.	When you create an account or sign in. Your password goes to Google Firebase Authentication. We never see or store it.	To back up and sync your routes and rides across devices. When you sign in, what you saved on that phone before is moved into your account.
Map requests: which map tiles you load.	When you look at an area you haven't downloaded (always on the web app).	To draw the map.
Server logs: IP address, time, the address requested (which can include your device ID) and your app or browser version.	With every request to our server.	To keep the service running and secure, and to find faults.
Messages to us: whatever you write.	When you email us.	To answer you.

We don't collect your name, phone number, contacts, photos or camera, microphone, motion sensors or advertising ID. We don't track you across other apps or websites.

3. Location in detail

Your phone asks your permission before Maze can use your location, and you can change it at any time in the phone's settings.

"While using the app" is enough for the map, route planning, navigation, road-usage dots and steepness dots. Road-usage dots are never collected in the background.
"Always" is needed only to keep recording a ride while the screen is off or another app is open. A ride recorded that way also saves its steepness dots. Without "Always", a recording pauses when you leave the app.
Most of the time your position stays on the phone. It shows where you are, how fast you go, which road you are on and its speed limit. Your position leaves the phone only in the cases in the table above, and in one more:
Getting back to the route. When you leave the route while navigating, the app asks the public OSRM routing service (router.project-osrm.org) for a way back. It sends your current position and the point where you rejoin the route. No ID is sent, but the service sees your IP address.
Place search runs on your phone. What you type is never sent.

4. What stays on your phone

So that Maze works without a signal, it keeps things on your phone: your settings and device ID, copies of your routes, rides, vehicles and the points on the map, downloaded maps, and the last five places you picked in search. It also keeps anything not yet sent. It keeps a diagnostics log of errors and app events, which never contains your route lines. The log stays on the phone unless you copy it yourself. The web app keeps the same things in your browser's storage. We don't use cookies, on this site or in the app.

Offline mode pauses sending, not collecting: what is collected meanwhile is sent when you go back online.

5. Legal basis

To provide what you ask for (GDPR Art. 6(1)(b)): route planning and navigation, recording your rides, saving routes, points and vehicles, your account and syncing. Showing your points to other riders is part of the points feature.
Our legitimate interests (Art. 6(1)(f)): road-usage and steepness dots, which make routes better for every rider, and server logs, which keep the service secure. You can object at any time. Ghost Rider and the Altitude meter switch stop these dots at once and cost nothing. To have what was already collected deleted, write to us.
Legal obligations (Art. 6(1)(c)), when the law requires us to keep or hand over data.

Other riders see the points you save: category, place, time and note. They don't see who saved them. Points you keep for yourself go to no one else: your own place (Property), places to explore (Explore here) and your own markers (Other). Other riders never see your rides, routes, vehicles, road-usage dots or account.
Our hosting provider. Our server is a rented machine in a data centre in Germany. The provider stores the data but may not use it.
Backups of the database are copied weekly to storage we control in Latvia.
Google (Firebase Authentication) handles sign-in if you create an account. It receives your email address, your password and technical details of each sign-in, such as your IP address. Google may process this in the United States, under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
The OSRM routing service receives two positions, as described in section 3.
The people who run Maze can see the data on the server when they need to, to operate, fix and improve the service.
Authorities, only when the law obliges us.

We don't sell your data, show ads or share your data with anyone for marketing.

7. How long we keep it

Rides, routes, vehicles, points, road-usage and steepness dots are kept until they are deleted. You can delete them in the app where it offers that. Otherwise we delete them when you ask, one by one or together with your account.
When you delete your account in the app (Settings → Account → Delete account), we delete your email address and name, your recorded rides, your saved routes and GPX files, the points only you see (Property, Explore here, Note) and your sign-in with Google. Your road-usage and steepness dots, likes, the points you shared on the map, your vehicles and the dates you signed in stay, under an account number with no email or name, because road scores are built from them. To have those erased too, write to us with your device ID (Settings → Device ID); we then delete everything. Data saved while signed out on a phone is tied to that phone's device ID, and we delete it the same way.
Route requests are kept in memory for a few minutes while the route is computed.
Server logs are deleted after at most 14 days.
Database backups are kept for up to six months. So deleted data can remain in a backup for up to six months, until that backup expires. We don't restore it from there except to recover from a failure.
Emails are kept as long as needed to deal with your message.

8. Your controls in the app

Ghost Rider (Settings) stops road-usage dots and hides the like buttons.
Altitude meter (Settings) stops steepness dots.
Recording is manual unless you turn on Auto-record. You can stop it at any time.
Delete a recorded ride or a saved route in the app. Removing a vehicle hides it from your list. It stays attached to the rides you recorded with it until those are deleted. Delete account (Account) deletes your account as described in section 7. To delete a point, your road-usage dots or everything, write to us.
Location permission can be changed in your phone's settings.

9. Your rights and how to use them

Under the GDPR you have the right to:

get a copy of your data and have it sent to you in a machine-readable format;
have wrong data corrected;
have your data deleted;
have its use restricted;
object to the uses based on our legitimate interests (section 5).

Write to [contact email]. If you have an account, write from the address on the account. If you don't, include the device ID from Settings → Device ID, because it is the only way to find your data. We answer within one month.

You can also complain to a data protection authority: ours is the Data State Inspectorate of Latvia (Datu valsts inspekcija), or you can go to the one in the country where you live.

10. Children, security, changes

Children. Maze is not meant for children under 16, and we don't knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

Security. Data travels encrypted (HTTPS). Access to the server and the backups is limited to the people who run Maze. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authority as the law requires.

Changes. When what Maze collects changes, this policy changes first. The date at the top shows the last change. For a change that matters, we will give notice before it takes effect.