Privacy Policy · OffMap

This is an English translation provided for convenience. In case of any discrepancy, the Italian version prevails.

1 · Data controller

The data controller for the data collected through the OffMap website and application is:

Federico Trenta, domiciled in Lodi (LO).

For any questions or to exercise your privacy rights, you can contact the data controller at the email address: support@offmap.eu.

2 · What personal data we process

To provide you with the service and ensure the security of the platform, we process the categories of data listed below. The data are divided into those needed for the account, those you choose in your profile and those created as you use the service.

Account data (required)

Sign-up: email address and username. The password is stored exclusively as a one-way hash (bcrypt): OffMap cannot read your password in plain text.
Proof of acceptance: the IP address of the device at the time of sign-up, the date and time, and the version of the Terms and Conditions accepted and of the Privacy Policy read (the two documents share a single version number). Each later acceptance of a new version updates the recorded date and version.
Address confirmation: the date on which you confirmed your email address through the link you received and, if you asked to change it, the new address awaiting confirmation.

Data you choose in your profile (optional)

The vehicle you explore with and your garage (category, make and model, if you enter them), your home region, your consent to receive news and offers with the date of the last change, your choice to receive the email about new events from saved businesses (on at the start), your choice to make public the map of your unlocked stretches and your saved itineraries (both off at the start), your participation in challenges, the date on which you saw the introductory guide.

Data created as you use the service

Single itineraries and transactions: the single itineraries on your account (how you received them: purchase, code, invite, conversion of credits or administrator intervention; when you use them and the download they are linked to) and the record of financial transactions (single itineraries bought and used, conversion of the credit balance, activation, cancellation and end of the Explorer Plus plan and of the Plus Trial, administrator interventions, promo codes activated, invite rewards; for transactions before version 1.3 also the credits received, purchased and spent).
Promo codes: for each code you activate we keep the code, the promotion, the date, the reward (single itineraries or the end date of the Plus Trial) and the version of the Terms accepted; if you activate a code before confirming your email address, the code stays pending on your account for at most 30 days.
Invites: your personal invite code and, for each person who signs up from your link, who invited whom, the dates of sign-up and of address confirmation, the outcome and the reward (single itineraries or a month of Explorer Plus with the new renewal date). When the address of the person who signs up is confirmed we keep a fingerprint of it, derived in the same way as the Plus Trial one, to apply the “one invite reward per person” rule (Terms, art. 15.2). The person who invites only sees how many people have signed up and the rewards received, never their names; the person who signs up does not see the name of whoever invited them. OffMap does not receive or keep the addresses of people who do not sign up.
Plus Trial: to apply the “one Plus Trial per person” rule (Terms, arts. 4.5 and 14.4), on sign-up and when you activate a trial code we keep a fingerprint of your email address: a code derived with a secret key, from which the address cannot be rebuilt, together with your username, the trial dates and the dates of the trial emails.
Downloads and unlocked stretches: the history of GPX files generated (name, date, kilometres, stretches included and the ‘recipe’ that allows the same file to be regenerated) and the list of dirt-road stretches you have unlocked and, for each network, the date of your first download (it is also used for the download limits in art. 7.2 of the Terms).
Points, levels and challenges: the record of points awarded (kilometres of new dirt road, reviews, events and the two points for the first sign-in of each day: this record therefore contains the dates on which you used the app), the total, and, for challenges, the group you were placed in, your score and your position in each period.
Saved itineraries (name, date, kilometres, stretches and recipe) and your choice to make them public.
Saved networks, places, events and businesses: the networks, events and businesses you save with the bookmark, with the date, and the places you save from the map (the name you choose, the place label, the coordinates, the type of place and the date). A saved place may be a personal location, such as your home: this is why what you save is visible only to you, does not appear in your public profile or in shared links, and is deleted together with your account. Event organisers don’t know who saved their event; a business only sees how many people saved it, never who.
Events: the events you organise (title, description, municipality and meeting point, date and time, pace, vehicles allowed, track, minimum number of participants, any link to the WhatsApp or Telegram group), the events you join, the questions you ask and the answers you give, the reports you send about an event or a review.
Reviews: a rating from 1 to 5 stars, a comment and up to three photographs uploaded voluntarily; the photographs are stored on Cloudflare R2 and can be reached at a public address that cannot be guessed.
Obstacle reports: when you report a closed or open gate, an obstacle, a ford, a pedestrian gap or a cattle grid on the road, or an obstacle on the map that is no longer there, or confirm another explorer’s report, we keep your username, the type of report, the network, the point on the map and the date of each confirmation. There is no free text.
‘Report a problem’: the title and text of the report, together with the technical context collected by the app to help us reproduce it (page open, screen size, browser version) and its processing status.
Email log: for each service email we send you, we keep the recipient, subject, type, date and delivery outcome.
Technical logs: when you use the app, the server records for each request the IP address, the date and time, the address of the page or service requested without parameters, the browser type, the outcome and the response time, to investigate errors and abuse. It does not record cookies, the referring page or request parameters. The servers’ operating logs (errors and technical events) contain no email addresses.
Payments (Stripe): we do not collect or store your card details. Payments are handled by our partner Stripe; OffMap keeps only the customer identifier assigned by Stripe to link your account to your purchases and subscription. For each single itinerary bought we also keep the Stripe identifiers of the session and of the payment, to link it to the purchase and to any refund. On your first purchase we pass your email address to Stripe, and we update it if you change it, so that receipts and invoices reach the right address.
Rate limits: to protect the service from abuse, your IP address and username are used in memory to count requests over a window of a few minutes; these counters delete themselves.
Location (GPS): the app asks for access to the device’s location to show where you are on the map and, in the Android app, for guidance along an itinerary, a network or a GPX file. These coordinates stay on your device and are not recorded, not even during guidance. There are three exceptions: the ‘Near me’ filter of the events board, which sends your location to our server only to find the region you are in, without saving it; ‘My location’ as the start, finish or stop of a ‘Route’, which the server uses to calculate the itinerary and keeps in the recipe of your history, like any other point you choose; and, in the Android app, the paved road of guidance (‘Take me there’, starting guidance away from the track and recalculating when you leave the route on a paved road), for which the app sends your location and direction of travel at that moment to our server only to calculate a route on paved roads to the track or to the chosen point: the server does not save them, does not write them in your history or in its logs and forgets them as soon as it has answered.
Android app: region maps, itineraries saved for use without a connection and GPX files you open with the app stay in the phone’s storage and are not sent to OffMap; they are deleted from the ‘Offline maps’ page or by uninstalling the app. During guidance the app shows a persistent notification until you end it. During guidance the location comes from the phone’s Google Play Services location services, which combine GPS, Wi-Fi and mobile networks to find it sooner, according to the phone’s location settings; OffMap sends Google neither your account data nor your location. On a phone without Google Play Services the app uses the phone’s GPS and network.

2 bis · What other explorers see

OffMap is also a community: some information is visible to other registered users, always and only with your username (never your email address).

Reviews and questions: reviews with their photographs, and questions and answers on events, are visible to all users, with your username.
Obstacle reports: a report appears on the map straight away to every explorer as ‘to be confirmed’, with its type, the number of confirmations and the date of the latest, credited to ‘explorers’: never your username. Once a second explorer or OffMap confirms it, it also appears on the network’s card, in shared links and in the GPX, and an obstacle that is no longer there no longer appears in any of them. For a gate, the latest confirmed state applies, closed or open.
Events: anyone who opens an event sees the organiser and the list of riders; the group link appears only to riders who have joined when the event reaches the minimum number of participants.
Leaderboard: the Top 100 by points shows username, points and kilometres unlocked.
Challenges: the members of your group see each member’s username, level, points and position.
Public profile: anyone who taps your username sees your plan, sign-up date, level and points, leaderboard position, the vehicles in your garage, home region, kilometres and networks explored, number of events organised, itineraries made public and latest reviews.
Map of stretches and itineraries: the map of your unlocked stretches and your saved itineraries are private until you make them public from your profile (Settings → Privacy).

3 · Cookies and local storage

OffMap uses the bare minimum:

A technical session cookie, set by the app when you sign in. It contains a signed session token (it does not contain your password), can be read only by the server (HttpOnly), travels only over encrypted connections (Secure), is restricted to our site (SameSite=Lax) and renews itself, at most once a day, while you use OffMap. In the Android app it expires after 90 days without use and in any case after one year; in the browser, with ‘Keep me signed in’ (ticked by default), after 30 days without use and in any case after 90; without the tick it is deleted when you close the browser and lasts at most 12 hours. It is revoked when you sign out, when you change your password and with ‘Sign out of all devices’ (Settings → Account), and in the Android app it is left out of the phone’s backup.
A technical language preference cookie (offmap_lang), written when you choose the language on the website or in the app and when you sign in (with your profile’s language). It contains only the language code (it or en), applies to the whole offmap.eu domain, so that the website and the app show you the same language, and lasts 12 months; signing out does not delete it.
Browser local storage for technical preferences that do not leave your device: the map’s difficulty filters and quick filters, the last points award you have already seen and the language you chose (a backup copy of the preference cookie).
The public website (www.offmap.eu) sets no cookies other than the language one, and only if you choose a language; the sign-in and sign-up window talks to the app, which sets the session cookie described above.
Cookie-free statistics: we count visits to the website, the app and the network pages with Umami, an open-source program installed on OffMap’s servers: the data does not go to third parties. Umami does not use cookies or store identifiers on your device and does not keep your IP address: it uses it only at the moment of the visit, to work out country, region and city and to calculate an anonymous session code with a secret value that changes every month, so that visits in different months cannot be linked to each other. We record the page viewed, the referring site, the link parameters that show the channel (for example utm_source=instagram), browser, operating system, device type, language and the “sign-up completed” event; every other parameter of the address is removed before sending, and the code inside promo links (app.offmap.eu/r/…) is replaced with a placeholder. If your browser sends the Do Not Track signal, the visit is not counted. The statistics are deleted after 13 months.
No profiling: we do not use advertising, retargeting or commercial profiling, nor third-party traffic analytics tools. For this reason, under the ePrivacy Directive and the guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali), the platform does not show a cookie consent banner.

4 · Legal basis for processing

We process your personal data on the basis of the following lawful grounds:

Performance of the contract: to provide the service you requested (account, single itineraries, Explorer Plus subscription, generation and download of itineraries, events, reviews, points and challenges, service communications by email). Service emails also include the email about new events from the businesses you have saved: at most one a day, only when one of them publishes an event; you turn it off from Settings → Account → Email or by removing the business from your saved ones.
Legal obligation: to fulfil tax and accounting obligations and to keep proof of acceptance of the Terms.
Legitimate interest: to prevent fraud and abuse, ensure the security of the platform (rate limits, blocking mass extraction), stop the Plus Trial, from sign-up or from a code, or an invite reward being obtained more than once by the same person (email fingerprint, § 2), handle reports and measure, in aggregate form, how the website is used and which channel brings visits (cookie-free statistics, § 3).
Explicit consent: only if you have given your consent, at sign-up or later from Settings → Account → Email, do we use your email address for OffMap news and offers. You can withdraw your consent at any time from the same place: the withdrawal applies from that moment and does not affect emails already sent.

5 · Providers that receive data, and transfers

To work, OffMap relies on a number of providers. Below you will find who receives what. OffMap’s servers (application, database, route calculation engine) are hosted in the European Union.

Stripe (payments): receives the account’s email address and handles card details with complete autonomy and security; it acts as an independent data controller.
Brevo (sending service emails): receives email address, username and the content of the emails (for example the title of an event or a question).
Cloudflare (storage): hosts the map files (OffMap’s roads and the base map) and the review photographs. Each time you open the map or a photograph, your browser downloads the data from Cloudflare, which receives your IP address and the technical parameters of the request.
Google (Google Play and Google Play Services, for the Android app only): installation and updates go through Google Play, which processes your Google account data under its own privacy policy. The app contains no analytics or advertising tools, from Google or anyone else; it uses the phone’s Google Play Services location services only for the guidance location (§2), which Google processes according to the phone’s settings and its own privacy policy.
Amazon Web Services (digital terrain model for the 3D relief): the browser requests the relief tiles directly from it; it receives your IP address, the area in view and the zoom level. The style, the fonts and the base map tiles are served by OffMap. This also applies to the demo on the public website.
Esri ArcGIS (satellite imagery): as above, only when you turn on the satellite view in the app.
OpenStreetMap Foundation, Nominatim (the name of a point you tap on the map or of coordinates you paste): our server requests it with only the coordinates of the point, never with your IP address or your account data. Searches for places and addresses, by contrast, run on OffMap’s servers (Photon, with OpenStreetMap data): the text you search for does not leave OffMap.
Open-Meteo (weather forecasts): queried by our server with the coordinates of the centre of the road network, never with your data.
AI agent (Explorer Plus only, only at your request): our server sends the name of the municipality, the name of the road, nearby places, the network’s map data (bans, protected areas, regional rule) and the text of the public pages found to Serper (web search), to Google (Gemini model) and, for pages that are hard to read, to Jina Reader. No data about you is sent to these providers.
Anthropic (Claude model): writes part of the text of the posts on our social pages from the network data alone (name, municipality, kilometres, elevations, levels, access). No data about you is sent to Anthropic.

Partners that distribute promo codes are told only how many codes have been activated, never who used them.

None of the mapping services sets cookies or receives your account data. Some providers (Stripe, Cloudflare, Amazon Web Services, Esri, Google, Serper, Meta, Anthropic) are based in, or have servers in, the United States: the related transfers take place on the basis of the standard contractual clauses adopted by the European Commission or of the provider’s participation in the EU-US Data Privacy Framework.

OffMap has a Facebook Page (“OffMap”) and an Instagram account (@offmap.eu) where each week it features a few dirt road networks to ride by motorbike and by bike. If you visit these pages, like, comment or share, your data is processed by Meta Platforms Ireland Limited under its own privacy policy. For the page statistics (Insights), which reach us only in aggregate form (reach, views, interactions), OffMap and Meta are joint controllers under Meta’s joint controller addendum, which gives Meta primary responsibility and the handling of requests about your rights: you can contact Meta or us.

OffMap also has a LinkedIn Page (“OffMap”), where it presents the project to people who work in the field. If you visit it, follow it or interact with its content, your data is processed by LinkedIn Ireland Unlimited Company under its own privacy policy. For the Page statistics, which reach us only in aggregate form (for example the country, industry and job function of the people who visit or follow it), OffMap and LinkedIn are joint controllers under LinkedIn’s joint controller addendum, which gives LinkedIn primary responsibility and the handling of requests about your rights: you can contact LinkedIn or us.

We do not copy the profiles or comments of people who interact with these pages into OffMap’s systems. The links in the posts carry parameters that show the channel (§ 3). The text of the Facebook and Instagram posts is partly written by an Anthropic model (§ 5) from the network data alone: no data about you.

6 · How long we keep data

Account and activity data: kept for as long as your account exists. You can close your account at any time from Settings → Delete account, confirming with your password: profile, garage, download history, unlocked stretches, points and challenges, itineraries, reviews and photographs, events organised (the riders are notified), events joined, questions, reports and unused single itineraries are deleted immediately, all your sessions are closed and any Explorer Plus subscription is cancelled. You can also request deletion by writing to support@offmap.eu: we carry it out within 30 days.
Proof of acceptance and transaction record: after the account is closed, we keep for 10 years, for accounting obligations and legal protection, a separate record with username, email address, sign-up IP, date and version of the Terms accepted, Stripe customer identifier and the record of financial transactions. This record is not linked to any active profile.
Promo codes: activated codes are kept while the account exists and are deleted when it is closed (the record of financial transactions follows the rule in the previous point). The email fingerprint of the Plus Trial (from sign-up or from a code), with username and dates, is kept for 10 years from the end of the trial, even after the account is closed, for the sole purpose of the “one Plus Trial per person” rule.
Invites: the invite code is deleted with the account. The link between the person who invites and the person who signs up is kept while both accounts exist; when either of them is closed, its username is removed. The fingerprint of the address of anyone who received an invite reward is kept for 10 years from confirmation, even after the account is closed, for the sole purpose of the rule in art. 15.2.
Email log: 12 months from the date of sending, then automatic deletion.
Sign-in sessions: for each sign-in the server keeps the type (Android app or browser), the start date, the day of last use and the expiry, without IP address, device model or location. It is deleted when you sign out, when you change your password, with ‘Sign out of all devices’ and when you close your account; an expired session is deleted within two days.
Technical logs: 14 days, then automatic deletion; the servers’ operating logs are overwritten on a rolling basis.
Review photographs: when you delete a review or your account, or when a photograph is removed after a report, we delete it from storage straight away and from then on it can no longer be reached; a copy may remain briefly only in the browser memory of someone who had already opened it.
Reports (‘Report a problem’, reports of events and of reviews): 12 months from when the report is closed, then automatic deletion.
Obstacle reports: a closed or open gate and an obstacle stay reported for 90 days from the last confirmation, a ford, a pedestrian gap or a cattle grid for 12 months from the last confirmation, and an obstacle that is no longer there stays off the map for 12 months; each report is deleted with its confirmations 12 months after it expires or is removed, including when the opposite state of the same gate replaces it. Your confirmation is deleted straight away when you close your account.
Events: 12 months from the meeting date (or from cancellation by the organiser), then automatic deletion of the event with its registrations, questions and saves; the points earned remain.
Visit statistics (Umami, § 3): 13 months, then automatic deletion.
Rate-limit counters: a few minutes.

As a data subject, you have the right to request access to, rectification, erasure (right to be forgotten), restriction or portability of your personal data, to object to processing based on legitimate interest and to withdraw any consent you have given, by writing to: support@offmap.eu. We will respond promptly and within 30 days of the request.

If you believe that the processing infringes the law, you have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), under art. 77 of the GDPR.

The service is reserved for adults: we do not knowingly process data of people under 18 and, if we become aware of an account opened by a minor, we close it.

8 · Changes to this policy

We may update this policy, for example for new features of the Service or changes in the law; each version shows its number and date at the top of the page. Changes are shown to you in the app at your next sign-in, together with the Terms and Conditions (art. 13 of the Terms). If a change concerns processing that requires your consent, we ask for it before starting.