Privacy Policy

1. Who is responsible for your data

RouteFix is operated by SK Sidratul Islam Priyo and Shihab Mohammad Humayan, two individuals based in Saskatchewan, Canada. For the purposes of Canadian privacy law (PIPEDA) and the EU and UK General Data Protection Regulation, they are jointly accountable for the personal information described here and act as joint data controllers.

Contact for any privacy question, access request, correction, deletion request, or complaint: support@routefix.net.

2. Who can use RouteFix

RouteFix is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has created an account, email support@routefix.net and we will delete the account and its data.

3. What RouteFix collects

Account information:

• Your first name, last name, and email address.
• An account identifier issued by Supabase Auth, which manages sign-in on our behalf. We never see or store your password.
• If you sign in with Google, Google provides your name, email address, and profile picture. RouteFix requests only your basic profile and email. It cannot read your Gmail, Drive, Calendar, Contacts, or any other Google data, and it never asks for that access.

Trip information:

• Trips you build or generate: origin, destination, travel dates, number of travellers, budget, and currency.
• The stops in your plan: names, locations, times, durations, priorities, and estimated costs.
• Draft trips you have started but not finished.
• Travel interests and pace you choose during onboarding, such as food, culture, or nightlife.

Live trip information:

• When you start, pause, resume, or end a live trip.
• When you tap I am Late, which recovery options RouteFix offered, and which one you chose.
• Your device timezone, read so your plan can be compared against your local clock.
• A summary of a trip after it finishes.

Technical information:

• Your IP address and browser user agent, recorded alongside certain actions in an internal activity log. This exists to protect the service: to enforce rate limits, to detect abuse, and to investigate problems. It is not used to build a profile of you and it is not used for advertising.

Analytics information:

• RouteFix uses Google Analytics to count visits and understand which pages people use. It records the pages you open, the site or search that sent you, your approximate city, and your device, browser, and screen size. It also records ordinary interactions such as how far down a page you scroll and when you follow a link away from RouteFix.
• Google Analytics works out your approximate location from your IP address and then discards the address. It is not stored in your analytics data and it is not linked to your account.
• This is counting, not profiling. Analytics is never joined to your name, your email address, or your trips, and it is not used for advertising.

If you contact us:

• If you email us or use a contact form, we keep your name, email address, and the content of your message so we can reply and keep a record of the issue.

4. What RouteFix does not collect

• GPS or any device location. The live engine works entirely from the clock.
• Camera, microphone, contacts, photos, or files.
• Background activity. RouteFix only does anything while you have it open.
• Your browsing history or data from other apps and sites.
• Advertising identifiers. RouteFix contains no advertising, no ad networks, and no ad tracking.
• Session recordings. Nothing records your screen, your mouse movements, or what you type.
• Payment or card details. RouteFix takes no payments.

5. Why we use your information, and our legal basis

Where the GDPR applies to you, these are the legal bases we rely on.

• To provide the service: creating your account, saving your trips, running the live engine, and showing recovery options. Legal basis: performance of our contract with you.
• To keep the service working and safe: rate limiting, abuse prevention, and diagnosing faults. This is why the activity log records IP address and user agent. Legal basis: our legitimate interest in operating a secure service.
• To personalise your trips: using the interests and pace you selected. Legal basis: your consent, which you gave by choosing them and can change at any time.
• To answer you: replying to support and privacy requests. Legal basis: performance of our contract and, for privacy requests, our legal obligation.
• To understand how RouteFix is used: counting visits and page views through Google Analytics, so we can see what people actually use and where they give up. Legal basis: our legitimate interest in improving the service. You can stop it entirely by installing Google's opt-out browser add-on, or by blocking analytics in your browser or an extension. Nothing in RouteFix stops working if you do.

We do not sell your personal information, and we do not share it with anyone for advertising or marketing.

6. Who your information is shared with

Providers that host RouteFix. These companies process data on our behalf under their own security and privacy commitments. They are not permitted to use it for their own purposes.

• Supabase: database and authentication. Your account and trip data are stored here.
• Vercel: hosting for the RouteFix web app.
• Render: hosting for the RouteFix backend service.

Data sources RouteFix queries for you. To build a real trip, our server looks up real places, routes, weather, and flight times. These lookups are made by our server, not by your browser, so these services do not receive your IP address, your name, or your account. They receive only the search itself, such as a city name, a place category, a pair of coordinates, a date, or an airport code.

• OpenStreetMap, through the Nominatim and Overpass services and community-run Overpass mirrors, for real places and coordinates.
• Photon, operated by Komoot, for place search suggestions as you type.
• OpenRouteService for real road routes and driving times.
• Open-Meteo for weather forecasts on your travel dates.
• AviationStack for real airline schedules and flight times.
• Wikidata, Wikipedia, and Wikimedia Commons for information and photographs about destinations.
• An exchange rate service for currency conversion.

Place data from OpenStreetMap is used under the Open Database License. Where it appears in RouteFix it is credited to © OpenStreetMap contributors.

Services your browser contacts directly. A small number of things load straight into your browser rather than through our server. Those providers can see your IP address, because that is how the internet works, not because RouteFix sends them anything about you.

• Supabase, for signing in and for app requests.
• Wikimedia, when a destination photograph is displayed.
• Google Fonts, for two typefaces used on the live trip screen.
• Google Analytics, on every page, for the visit counting described in section 3.
• Google, only if you choose to sign in with Google.

We may disclose information if we are legally required to, or where it is necessary to protect our rights or someone's safety. If RouteFix is ever sold or transferred, account data would move with it, and you would be told before that happened.

7. Where your information is stored

RouteFix is operated from Canada, but the providers above store and process data on servers outside Canada, currently in the United States. Information held in another country can be accessed by the courts and law enforcement of that country under its own laws. By using RouteFix you accept that your information is handled this way.

8. How long we keep it, and how to have it deleted

Your account and trip data are kept for as long as your account exists. You can delete individual trips yourself from inside the app.

You can delete your account yourself at any time, from the You screen, under Your data. It happens immediately. There is no waiting period, no deactivation state, and no way to undo it.

Deleting your account removes your profile, your trips and their stops, your drafts, your travel interests, your live sessions and their history, your completed trip summaries, any support messages you sent us, and the technical log entries holding your IP address. Your sign-in identity is deleted from Supabase Auth at the same time, so the email address is no longer held there either.

If you tell us why you are leaving on the way out, that answer is stored with no link to you or your account, and it cannot be traced back to you afterwards. Answering is optional and never required to delete.

If anything goes wrong during deletion we will tell you plainly rather than reporting success. Email support@routefix.net and we will finish it by hand.

9. Your rights

Under Canadian privacy law you can ask what personal information we hold about you, ask for a copy of it, ask us to correct anything inaccurate, and withdraw consent where we rely on it.

If the GDPR applies to you, you also have the right to erasure, to restrict or object to processing, and to receive your data in a portable form.

Email support@routefix.net to exercise any of these. We will respond within 30 days. We will not charge you, and we will not treat you differently for asking.

10. If you are unhappy with how we handled it

Email support@routefix.net first and describe the problem. We will investigate and write back to you within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or by telephone at 1-800-282-1376. If you are in the EU or UK, you may instead complain to your national data protection authority.

11. How your information is protected

Traffic to and from RouteFix is encrypted in transit. Passwords are handled by Supabase Auth and are never stored by RouteFix. Access to the database is restricted by row-level security so an account can only reach its own records. Internal logs record only what is needed to run the service.

No service can promise perfect security. If a breach ever affects your personal information, we will notify you and the appropriate regulator as the law requires.

12. Cookies and browser storage

RouteFix uses browser storage to keep you signed in and to remember small preferences, such as your currency and whether you have dismissed the install prompt. Sign-in is handled by Supabase Auth, which sets its own first-party storage for your session. Your acceptance of these terms is recorded on your account, not in your browser.

Google Analytics sets two cookies of its own, named _ga and _ga followed by our measurement code. They exist to tell a returning visitor from a new one so visits are counted correctly, and they expire after two years. They are set by RouteFix rather than by another website, and they carry a random identifier, not your name or your email address.

There are no advertising cookies and no cross-site tracking in RouteFix. Nothing follows you to other websites. If you would rather not be counted at all, install Google's opt-out browser add-on or block analytics in your browser, and RouteFix will keep working exactly as before.

13. Real data and estimates

Places, routes, weather, and flight schedules in RouteFix come from the real sources listed above. Some values that no free source publishes are estimates calculated by RouteFix, including how long a visit takes, how much an activity or hotel is likely to cost, and how busy somewhere may be. Estimates are always shown as estimates.

RouteFix does not guarantee that any place, price, duration, route, or schedule is accurate or current. Check anything you are relying on.

14. Changes to this policy

If this policy changes in a way that affects you, we will update the version date at the top and tell you in the app. Continuing to use RouteFix after a change means you accept the updated policy.

15. Contact

Questions about this policy, or about your data: support@routefix.net.