Privacy

Topovelo is a cycling map. It has no accounts, no analytics, no cookies and no advertising, and it does not track anyone. This page explains what that means in practice, and is specific about the one thing a map unavoidably touches: where you are.

Last updated 7 August 2026

Who is responsible

Lukas Pellegrini · lukas.a.pellegrini@gmail.com
Topovelo is a personal, non-commercial project. Write to that address with any question about this page, or to ask what data exists about you and to have it deleted.

This page covers home-map.peluan.com (this site), map.peluan.com (the map) and tvtest.peluan.com (an unlisted checklist used by invited testers). It does not cover peluan.com, which is a private family calendar unrelated to Topovelo and, unlike everything above, does set a cookie in order to sign its members in.

The short version

• No account. There is nothing to sign up for, so there is no profile to build.
• No cookies, no analytics, no advertising, no third-party trackers. None of these sites set a cookie or load a tracking script.
• Your location is never stored on our servers. It is used on your device, and briefly in transit to find nearby junctions or a route. It is not logged, not retained, not linked to you.
• Nothing is sold or shared with anyone for advertising or any other purpose.

Your location

The map asks for your location only when you press a button that needs it — From my location, or the locate control. Your browser asks you first, and the answer is yours; refuse it and everything else still works. Location is read only while the map is open in front of you. There is no background tracking, and the app cannot see where you are when it is closed.

When you do use it, your position is handled two ways:

• On your device — drawing your position, following you while navigating, measuring how far you are off the route.
• Sent to a server to answer a question you asked — for example, an area around your position goes to our routing service to find the nearest cycling junction, and the start and end points of a Zürich route go to the safest-route service. These requests are answered and discarded. They are not written to any database.

Map data comes from other organisations

Topovelo does not host its own maps. It shows official maps from national mapping agencies, which means your browser requests map tiles directly from them. Those requests necessarily reveal your IP address and the part of the map you are looking at, and they are subject to each organisation's own privacy terms:

• PDOK (Netherlands) — topographic maps, aerial imagery, the cycle-junction network, and address search. Searching an address, or tapping the map to ask what is there, sends that text or that coordinate to PDOK.
• swisstopo / geo.admin.ch (Zürich) — Swiss maps, imagery and place search.
• Esri — the optional satellite layer.

Ordnance Survey (United Kingdom) is different, deliberately: UK map tiles are fetched by our server on your behalf rather than by your browser, so Ordnance Survey sees our server and not you.

What is stored on your device

Not cookies — three small values in your browser's local storage, which never leave your device on their own and which clearing your browser data removes:

• the region you last used (Netherlands, UK or Zürich);
• a short list of recent technical errors, so that a problem can be described accurately if you choose to report one;
• a flag, only if you have opted in as a tester.

If you send a problem report

Testers invited to tvtest.peluan.com can submit a report. This only ever happens when you fill the form in and press send. A report contains the app version, the region, your browser's user-agent string, your screen size, the checklist answers you gave, whatever you typed, and the recent technical errors described above. It does not contain your location and it does not contain your name unless you write it yourself. Reports are deleted automatically after 90 days.

Server logs

Our web servers keep ordinary short-lived request logs, which include IP addresses, as any web server does. They are not analysed, not aggregated into profiles, and not kept beyond the life of the running service. IP addresses are also counted in memory for a short period to stop one source flooding the report form.

Where this runs

Topovelo runs on self-hosted infrastructure in Switzerland. The map data requests described above go to the mapping organisations named, in the Netherlands, the United Kingdom and Switzerland.

Your rights

Under the GDPR and the Swiss Federal Act on Data Protection you may ask what personal data is held about you, and have it corrected or erased. In practice there is very little to ask about: with no accounts and no stored location, the only personal data that exists is a problem report you chose to send, and transient server logs. Write to the address above and it will be dealt with.

The legal basis for handling the little that is handled is legitimate interest in running the service securely, and your consent in the two cases where you are asked directly: sharing your location, and sending a report.

Children

Topovelo is a map. It is not aimed at children, collects no personal details from anyone, and has nothing to sign up for.

Changes

If this page changes, the date at the top changes with it. The page is kept in version control alongside the code it describes, so its history is as auditable as the software.