Who handles the data

Ondivento is a personal project by Daniel Paniagua. For any question, or to exercise your rights over your data, write to privacidad@ondivento.com.

Planning a route neither asks for nor stores your identity

This comes first because it's what actually matters: you can plan routes, see the forecast and export the GPX without creating an account. The start point, the distance and the route coordinates are sent to our server only to work out the route, and passed on to the map and weather providers listed below — they aren't stored in any database tied to you. Your rider profile (height, weight, FTP, bike) stays in your own browser, not on our servers, unless you decide to create an account. The one exception is pressing "Share": that deliberately stores a copy of that route, because it's exactly what makes the link work. It's explained in full below.

If you create an account

The account is optional and exists to carry your profile, your bikes and your routes from one device to another. When you create it we store:

Basic identity: your email, and if you sign in with Google, your name and profile picture as Google passes them to us. If you sign in by email link, just your address.
Rider profile: height, weight, FTP and intensity factor.
Bikes: name and components (frame, wheels, tyres...) to work out their aerodynamics. None of this identifies anyone on its own.
Saved routes: name, distance and the coordinates of the track.
Wind alerts: if you turn on alerts for a route, we store that you want them, when you were last alerted (so we don't repeat ourselves) and the language you were using the app in, so we can write to you in it.

You can delete each bike or route individually from the app itself, and switch alerts off under "My routes". To delete the whole account, write to privacidad@ondivento.com — there's no self-service button for that yet.

Routes you share by link

Sharing doesn't require an account. Pressing "Share" stores a frozen copy of that route on our server and generates a link. Without that copy, whoever opened it would see a different route, because the wind would have changed.

What's stored: the route's name, its coordinates, the distance and the climbing. Nothing about you. If you have an account we also record that it was yours, so you can recognise it.
Who can see it: anyone with the link. The identifier is long and random, so it can't be guessed by trying, and shared routes aren't listed or indexed anywhere — but if you pass the link on, whoever gets it can pass it on too. Treat it as public.
Think twice if it starts at your house. A route's start point says a fair bit about where you live. Sharing one that begins at your front door is your call, but it's better to know that beforehand than afterwards.
How long it lasts: it doesn't expire on its own, so a link you sent months ago still works. If you want a shared route deleted, write to privacidad@ondivento.com with the link and it'll be removed.

What third parties receive, and why

Ondivento doesn't exist without leaning on external services. Each one receives only what it needs to do its part:

Open-Meteo, OpenRouteService, BRouter and OSRM receive coordinates to work out the wind and the route — never your identity, not even if you have an account.
Google, if you choose that way in, to confirm who you are.
Resend to send the sign-in link and, if you turn them on, the wind alerts.
CARTO serves the map tiles; it receives the coordinates shown on screen, like any web map.
Vercel hosts the application and, like any server, sees the IP of whoever uses it in its technical access logs. It also collects aggregated, anonymous usage statistics.

Cookies

Only the strictly functional ones: the session cookie, to keep you signed in if you have an account, and the language one, to remember whether you prefer Spanish or English. No advertising, no cross-site tracking.

Your rights

Access, rectification, portability and erasure of your data, under the GDPR. Write to privacidad@ondivento.com and it's handled directly, with no middlemen — this is one person's project, not a company with a support department.

Privacy