Privacy Policy
Fly My Route turns your runs, rides, walks and hikes into short films, drawn on your iPhone. I built it to need as little of your data as possible. This page says exactly what it uses, where that goes and what you can do about it.
The short version
- Your films are made on your iPhone. Your activities are not uploaded to make them.
- From Apple Health, the app reads only your workouts and their routes. Nothing from Apple Health ever leaves your iPhone.
- The map comes from Apple. To draw it, your iPhone asks Apple for the map of the area the camera shows.
- If you buy Pro, Apple takes the payment, and RevenueCat keeps track of your subscription for me.
- "Start with a selfie" is optional and happens only on your iPhone: no photo or face scan is ever saved or sent.
- Backup is optional. If you sign in with Apple, your avatar, your films' settings and the routes of the files you imported are kept on my server, so a new iPhone brings them back.
- No ads, no tracking, no analytics, and I never sell your data.
Who is responsible
Fly My Route is made by me, Oktay Kurt, as an individual developer. I am the controller of your personal data under the EU General Data Protection Regulation (GDPR).
Oktay Kurt
hello@flymyroute.com
What stays on your iPhone
Most of what the app uses never leaves your iPhone. It is kept in the app's own storage, which other apps can't read and which is left out of iCloud and computer backups of your iPhone.
- Apple Health. When you choose Apple Health and allow it, the app reads your workouts (their type, start time, duration, distance and the app that recorded them) and their GPS routes. It uses them only to list your workouts and to make your films. It never writes anything to Apple Health. More under "Apple Health" below.
- Files you import. GPX, FIT and TCX files you open in the app are copied into its storage. The app reads the route, the times and the heights in them. A file from a watch can also hold other things, such as heart rate, cadence, power or the name of the device; the app does not use those.
- Your avatar, projects and films. Your avatar's look, each film's settings and title, films being made and finished films.
- Settings, such as kilometres or miles, and whether you want new-run alerts.
- New-run alerts. If you turn them on, Apple Health wakes the app when a new workout with a route arrives, the app checks it on your iPhone and shows a notification from your iPhone. No push service is involved.
- Crash and performance reports. iOS gives the app reports when it crashes, hangs, runs out of memory or starts slowly (Apple's MetricKit). They hold technical data only: call stacks, device model, iOS and app version, memory figures. They are kept on your iPhone. When you email me from the app, they go with that email only if you turn on Include diagnostic reports.
- Photos. The app asks only to add to your photo library, to save your films and their covers. It can't see your photos.
- Camera. Only if you choose "Start with a selfie", and nothing from it is kept. See below.
You can delete all of this in the app: Settings › Delete all films and projects removes every project, film and imported file. Deleting the app removes everything it kept on your iPhone. Films you saved to Photos stay there.
What leaves your iPhone, and why
The map, from Apple
The map in your films is Apple Maps, which the app draws with Apple's MapKit. To do that, your iPhone asks Apple's servers for the map imagery of the area the camera shows, so Apple learns which area is being viewed. Once for each film's activity, the app also asks Apple for the name of the city and the country at one point of your route, for the film's title and flag.
These requests go from your iPhone to Apple and are handled under Apple's Privacy Policy. Apple says Maps does not associate your data with your Apple Account. I don't receive or keep them. The app saves nothing of the map except the frames of your film.
Purchases: Apple and RevenueCat
If you buy Fly My Route Pro, Apple takes the payment through your Apple Account. I never see your payment details or your Apple Account.
RevenueCat, Inc. (USA) checks and keeps your subscription for me, as my processor. It receives:
- a random identifier the app makes for you, and your Fly My Route account's identifier (below);
- your App Store purchases and subscription history for this app: plan, price, currency, dates, trial, renewals, cancellations, refunds and your App Store country;
- the technical data every request carries: device model, iOS version, app version, language and IP address.
I use this to give you Pro, restore it on another iPhone and show where your subscription stands (contract, GDPR Art. 6(1)(b)), and to see totals such as how many trials turn into subscriptions in RevenueCat's dashboard (my legitimate interest in running the business, Art. 6(1)(f)). RevenueCat's Data Processing Addendum includes the EU Standard Contractual Clauses for data handled in the USA.
Your account and backup: Supabase
An account without your name. The first time you open the app it makes an account for you in the background, with no name, email or password: just a random identifier. It lets your subscription and, if you turn it on, your backup follow you. You never have to sign in.
Sign in with Apple, if you want backup. Signing in with Apple is optional and only needed for backup. Apple gives me a stable identifier for your Apple Account. I don't ask Apple for your name or your email address.
What the backup keeps, once you have signed in:
- your avatar's look;
- each project's settings: the title and subtitle you typed, the map look, camera, length, figures shown, trim, privacy zone, units and sound, and which activity the film is of;
- the routes of the files you imported, and of the films made from them: each one's positions, times and heights, with its name and kind, as a plain GPX file, and the file's name and a fingerprint of it (a SHA-256 hash, so the same file picked again on a new iPhone is recognized). Never the file as it came: no heart rate, no device name. These routes are whole and precise: the privacy zone hides the start and end only in the films, not in the backup. They are kept in storage that only your account can read.
What it never keeps:
- Anything read from Apple Health. For a film made from an Apple Health workout, the backup keeps only the workout's identifier and your own choices. On a new iPhone the app reads the workout from Apple Health again.
- Your films. They are made again on the new iPhone.
Heart rate in an imported file is health data under the GDPR, and it is never backed up: only the route is. Everything in the backup is there because you asked for the backup (Art. 6(1)(b)). Deleting your account deletes it.
Supabase, Inc. stores the accounts and backups for me, as my processor, in the EU (Ireland). Any access from outside the EU is covered by the EU Standard Contractual Clauses in Supabase's Data Processing Addendum. Supabase keeps technical logs of requests (IP address, time, kind of request) for up to 7 days for security and troubleshooting.
When you share a film
When you share a film, iOS hands it to the app or service you pick: Instagram, TikTok, YouTube, WhatsApp, Messages and so on. From then on that service's own privacy policy applies. The Instagram buttons tell Instagram which app the film came from (my app's identifier at Meta); Fly My Route sends nothing about you to Meta.
When you email me
An email from the app's Settings › Help & Support gives the app's version, your iPhone's model and its iOS version, and the crash and performance reports described above only if you choose to attach them. You see all of it in the email before you send it.
hello@flymyroute.com is hosted by Zoho Mail in its EU data centre. I use what you write only to answer you (Art. 6(1)(b) and (f)), and I delete the conversation 24 months after it ends, unless I need it longer for a legal claim.
The website
flymyroute.com is hosted on my own server at DigitalOcean, in its data centre in Frankfurt, Germany, and delivered through Cloudflare, Inc. (USA), which protects it from attacks and so handles every request to it. The site sets no cookies and uses no analytics or trackers; Cloudflare may set a security cookie only if it has to check that a visitor isn't a bot. The server keeps standard logs (IP address, time, page requested) for up to five weeks, for security.
Apple Health
- Fly My Route reads only Workouts and Workout Routes, and only after you choose Apple Health in the app and allow it on Apple's screen. It never writes to Apple Health.
- It uses that data only to list your workouts in the app and to make your films.
- It never uses data from Apple Health for advertising, marketing or data mining, never sells it, never shares it with anyone, never stores it in iCloud and never sends it to my servers.
- You can change what the app may read at any time in Settings › Health › Data Access & Devices › Fly My Route.
Start with a selfie
"Start with a selfie" is optional. You choose it when you make your avatar, and the app asks you on its own screen, every time, before it opens the camera.
- What it reads. One photo from the front camera and, while you line up your face, the camera's picture a few times a second. Apple's Vision framework, on your iPhone, finds your face in them: the positions of your eyes, brows, nose, mouth and the outline of your face (a scan of face geometry), and the colours of your skin, hair, brows, eyes and beard. On an iPhone with Apple Intelligence, Apple's on-device model may also look at the photo to tell the hairstyle, the beard and the glasses.
- What it's for. Only to suggest your avatar's look: a skin tone, hair, eye and brow colours, a hairstyle, a beard, glasses, and positions for the face sliders. Nothing else.
- Where it happens. On your iPhone only. The photo, the camera's picture, the face geometry and the colours are never saved and never sent anywhere, to me or anyone else.
- How long it's kept. Only in your iPhone's memory while the suggestion is made, a second or two. It is destroyed as soon as the suggestion is made, or when you close the camera.
- What is kept. The avatar settings it picks, in the same form as the ones you set by hand, rounded to the editor's steps. They are part of your avatar's look: you can change them at any time, they are backed up with your avatar if you back up, and they are deleted with your avatar or your data. They can't be used to recognise you. The app also keeps the date you last agreed, as the record of your consent.
- Never used to identify or recognise you, to verify who you are, or for advertising, marketing or profiling. Never sold, shared or disclosed, and never sent to RevenueCat, in crash reports or to any analytics.
- Your choice. You can skip it and build your avatar yourself, and stop at any time by closing the camera. Since nothing of your face is kept, there is nothing of it to delete afterwards; to change the settings, change your avatar.
If you live in Illinois, Texas, Washington or Colorado. The face geometry described above may be biometric data under your state's law. The app reads it only after you agree on its screen, only for the purpose stated there, keeps it no longer than the moment the suggestion takes and then destroys it, and never sells, leases, trades or discloses it. This section is my public policy for keeping and destroying it.
What I don't do
- No ads and no advertising SDKs.
- No tracking across apps or websites, so the app never asks for permission to track.
- No analytics SDK.
- No selling or sharing of personal data.
- No profiling or automated decisions about you.
How long data is kept
| Data | Kept |
|---|---|
| Everything on your iPhone | Until you delete it in the app or delete the app |
| Start with a selfie: the photo, the camera's picture, the face geometry and the colours | Never saved; destroyed in memory once the suggestion is made |
| Subscription records at RevenueCat | Until you ask me to delete them or delete your account; what tax and accounting law make me keep, for as long as it says |
| An account that never signed in | It holds no backup: only its random identifier and when it was made and last used. Kept until you ask me to delete it |
| An account with backup | Until you delete the account |
| Support emails | 24 months after the conversation ends |
Your rights
Under the GDPR you can ask me for a copy of your personal data, to correct it, to delete it, to limit how I use it, to receive it in a usable format, and you can object to uses based on my legitimate interest. Where you gave consent, you can withdraw it at any time; that does not undo what was done before. I give the same rights to everyone, wherever they live.
Write to hello@flymyroute.com. I answer within one month. I may ask you to show that the account is yours.
You can also complain to a data protection authority, in particular in the EU country where you live or work.
You don't have to give me any data to use Fly My Route. Without a purchase record, you can't have Pro; without signing in, you can't have a backup.
Deleting your data
- On your iPhone: Settings › Delete all films and projects; an imported file can also be removed alone in New video › Files. Deleting the app removes everything it kept on your iPhone.
- Your account: Settings › Account › Delete account. It deletes your account, your backup and your record at RevenueCat, and ends the app's access to your Apple Account's sign-in. A subscription is billed by Apple, so cancel it in your Apple Account's subscription settings; deleting the account does not cancel it.
- By email: write to hello@flymyroute.com.
Children
Fly My Route is not made for children, and I don't knowingly collect personal data from children under 16. If you think a child has given me personal data, write to me and I'll delete it.
Security
Data that leaves your iPhone travels encrypted (HTTPS). The server only lets each account read its own backup. I keep as little as I can, which is the best protection there is.
Changes
If I change this policy, I'll update the date at the top. If a change affects what is collected, I'll say so here and in the app's release notes before it applies.
Contact
Oktay Kurt · hello@flymyroute.com