Vistavel

Privacy Policy

Version of 2026-11-01. It applies to the vistavel.com website and to the Vistavel apps for Android and iOS.

1. Who is responsible

The data controller is Copdrive SAS (SIRET 841 900 707 00016, registered office: 25 rue Pierre et Marie Curie, 94200 Ivry-sur-Seine, France), which publishes the Vistavel service. For any question about your data, or to exercise your rights: contact@vistavel.com.

2. What we do not do

No advertising, no profiling, no third-party audience measurement, no sale of data. The only cookie set is the account session cookie (section 3.2); members of the Vistavel team receive a second one, for their administration, moderation or support session (section 3.10); if you sign in with Google or Apple, a technical sign-in cookie, which expires at the latest 10 minutes after that service's answer, or 10 minutes after it was set if the service does not answer (section 3.23).

3. The data processed

Email addresses and clubs: each membership has a separate, optional consent, off by default, allowing the responsible people and administrators of that organisation to export your email address. You can withdraw it in your account, including during suspension. Exports contain the visible name, role and status; an email address is included only for an active member with consent. Withdrawing consent does not recall files already downloaded. The export log retains only the organisation and actor's technical identifiers, the date and the number of rows for 90 days, including after the actor deletes their account. It contains no email address or copy of the file. Automatic cleanup removes expired events. Consent is removed with the membership or account.

Emergency contact for clubs' outings: optional. For an outing you are registered for, you may leave a contact to be alerted (name, telephone number, relationship to you; no medical data). It is up to you to inform the person you name. Only the organisers of that outing (pace group leaders, co-leaders, sweeper) can read it, from 24 hours before the start until it is erased; each reading is logged without its content, and the number of readings is shown to you. It is erased 48 hours after the planned end of the outing (or the planned return time if that is later), and also as soon as you erase it, unregister or answer “maybe” or “no”, when the outing is cancelled, when your membership ends and when your account is deleted. It is included in the export of your data.

Attendance at clubs' outings: for an outing you take part in, those of its organisers (pace group leaders, co-leaders, sweeper) who manage the club's outings mark your presence at the start, then your return; when none of them does, the club's outing managers mark it. The sheet keeps, for each participant, present or absent, back, and the time of each mark — for a mark made without network in the app, the time of the gesture and the time our server received it; no position and no medical data. It is read by the club's outing managers, on the outing's page and in its attendance sheet as a PDF; the club dashboard shows only numbers from it. In the app, a mark made without network stays on the organiser's phone until it is sent, when the network is back: the gesture, its time, your display name in the club and the code that designates you on the sheet (never your e-mail address); it is erased from the phone as soon as it is saved or refused, at sign-out or when another account signs in, and at the latest twelve hours after the gesture, or two hours after the planned end of the outing if that is later. Twelve months after the end of the outing, the names are erased: the sheet keeps only its numbers (present, absent, back). Your line is also erased when your membership ends or is suspended and when your account is deleted. It is included in the export of your data. A presence checked at the start earns you points: your progress keeps its club, outing and time of the check (section 3.24).

Weather of clubs' outings: 72, 48, 24 and 12 hours before the start of a club outing, our server asks for the weather along its routes (points of the routes, rounded to about one kilometre, sent to MET Norway and Bright Sky as for the site's weather, section 4 — and, for a point in or near the United States, to the National Weather Service when MET Norway does not answer, never to the other fallback services; no member data). When it becomes unfavourable, those of the outing's organisers (pace group leaders, co-leaders, sweeper) who manage the club's outings receive an e-mail — when none of them does, the club's responsible person —, unless they have stopped all outing e-mails. Only the last level read and the outcome of the e-mail are kept, until one day after the start, and erased as soon as the outing is cancelled; the copy of the e-mail is kept like that of our other e-mails (section 3.14).

Membership expiry: a club's managers and administrators may record the expiry date of your membership (a date, with no document attached); only they see it. If the club has chosen so, an expired membership closes sign-up to its outings until the club changes the date; you can still answer “maybe” or “no” and leave an outing. The date goes with your membership.

Creating groups and clubs: we only retain cumulative counts of creations started, submitted for review and abandoned at each step. These counters contain no entered names, account, community or session identifiers, IP addresses, fingerprints, individual dates or cookies. There is no event log or third-party analytics service. Requests omit cookies and the referring page URL; failures never prevent creation.

Club dashboard: for each club's dashboard, Vistavel counts every month the number of members who leave the club, with no name or identifier.

Site errors and contact messages: we only retain cumulative counts of the technical errors that occur in the browser, by broad category (script, promise, resource, network), and of the messages sent through the contact form. These counters contain no error message, page address, message content, account or session identifiers, IP addresses, fingerprints, individual dates or cookies. There is no event log or third-party analytics service. Requests omit cookies and the referring page URL; failures have no effect on the site.

3.1 The account

Profile photo (optional): your photo is cropped and resized on your device before upload. The original file and its metadata, including GPS location, are not retained. Only the small profile image is stored with your account at Cloudflare. It is visible only to you, never in groups, shares or the administration dashboard. You can replace or remove it in your account; deleting your account also deletes the photo.

Data: e-mail address; account identifier (drawn at random); password hash (salted PBKDF2-SHA256: the password itself is never kept; an account created with Google or Apple has none until you create a password); if you sign in with Google or Apple, the link to that account (section 3.23); language; date and version of the Terms of Use accepted; current plan, subscription state and end date; Stripe customer, subscription, invoice and payment identifiers, if you have any.
Why: to open and secure your account, to recognise the features it gives access to, and to find your content on all your devices.
Legal basis: performance of the contract (the Terms of Use).
Retention: until the account is deleted. An account whose address was never confirmed is deleted 7 days after it was created.

Address check: when you register, and when you ask for a code, only the domain name of your address (the part after “@”) is checked with Cloudflare's DNS resolver, to refuse an address that cannot receive any email. The full address is not sent.

Account e-mails: we write to you for five reasons only — a code to confirm your address when you sign up, a code to change your password, a message telling you that an account already exists with your address, a code to link a Google or Apple sign-in to your account, and a code to delete an account that has no password. These messages are delivered by Resend (Resend, Inc., United States), which receives your address, the subject and the text of the message, and nothing else: not your account identifier, not your routes, not your IP address. At most three messages per address per hour.
A code you receive has 6 digits, is valid for 15 minutes and works only once; after 5 wrong attempts it is cancelled and the address is blocked for 15 minutes. We do not keep the code itself, only its hash (HMAC-SHA-256, computed with a secret server key): anyone reading our database would get no usable code from it. To limit attempts, we count those of each IP address for one hour, as a hash, never the IP address itself.
Legal basis: performance of the contract (opening your account and letting you back into it); legitimate interest for counting attempts (account security).
Retention: the code's hash is erased as soon as the code is used, and at the latest 15 minutes after it was sent; the count of an address's requests and attempts, at the latest 15 minutes after the last attempt or the end of the block; that of an IP address, at the end of the hour.

3.2 The session

A cookie named evtp_session (HttpOnly, secure) keeps you signed in: in the app, and on the website if you tick “Remember me”, for up to one year without use (each visit extends this period); on the website without that box, until you close the browser, 12 hours at most. It contains only your signed account identifier. It is strictly necessary for the service and is removed when you sign out.

3.3 Sign-in security

We count failed sign-ins attached to an e-mail address: at the fifth, sign-in is blocked for 15 minutes. This counter is erased at the next successful sign-in, when the account is deleted, and at the latest 24 hours after the last failure or the end of the block. Legal basis: legitimate interest (protecting accounts).

3.4 Your saved content

Data: the routes you save (track, start and end points, settings, associated places and photos), including the GPX tracks you import and then save; your favourite places (name and coordinates); your private places (name, position of the centre and radius), used to remove these places from your shares and proposals; the rides you record while riding and choose to keep (time-stamped GPS track, distance, duration, elevation).
Where: always on your device; also in your account when you are signed in, so that you find them on your other devices.
Legal basis: performance of the contract.
Retention: withdrawn rides are hidden, not erased. Account copies remain accessible to moderators until permanent erasure or account deletion. When not signed in, hidden copies remain only on the device. Removing a favourite or a private place deletes it from the account.

Share links: when you share a route or a ride, a copy (name, track, distances, elevation, estimated time, photos and date) is published at an address under /s/ that anyone with the link can read, without signing in; the parts inside your private places are removed before sending. Published with it are the municipality (and the country) of its first public point, which your device asks of Photon (section 4), your distance unit and, only if you tick “Show my pseudonym” (unticked by default), your public pseudonym, the one of the gallery — never your name or your email address. The link's page and its preview image (the track and its figures, drawn by our server from the copy and kept at Cloudflare) present this information to the messaging apps and sites that display a preview of links. The link's page also offers anyone who opens it “Share as a story”: the same image in a vertical format, drawn and kept in the same way, which their device hands to the app of their choice, or downloads. Only if you tick “Allow embedding on other sites” (unticked by default — your device then remembers your last choice —, and you can untick it at any time in Account › Shares), any website can show the route in an embedded frame that shows what the link's page shows, nothing more; this frame sets no cookie, contains no tracker, loads nothing from another site and is served like any page of the site (section 3.9). Without this box, our server refuses to show the route in another site's frame; a withdrawn permission applies from the next load of the page that embedded it. The link does not expire: it remains valid until you withdraw it or delete your account. After a withdrawal, the copy is no longer public and our server no longer serves its images or its embedded frame (a messaging app or site that already displayed the preview, an app the story was handed to, or a person who downloaded it may keep its own copy); each image is erased from our storage at the latest 30 days after it was drawn; the copy remains accessible to moderators (section 7).

Added to the catalogue: moderators may add to the site's public catalogue an anonymous copy of a route or ride that you deleted or hid, including before the version of the terms that provides for it (terms, section 4). The copy is made by our server and keeps neither your identifier, nor the name you gave it, nor its dates and times, nor its speeds, nor its passages through your private places; 500 m are removed at the start and at the end of the track and, for a loop, replaced by a computed section that avoids those surroundings. To produce it, our server sends the routing and geography services (section 4) only elements of the copy (a few of its points, the rectangle around it, waypoints computed outside the removed surroundings), never the original track. Its name and description are produced automatically from the places it passes through. As an added copy is no longer linked to your account, it can neither be returned to you nor withdrawn at your request, and it stays in the catalogue after the account is deleted.

Catalogue ratings: your score from 1 to 5, the route and the modification date are stored with your account identifier to allow one editable vote per route. Only the average and voter count are public. When the account is deleted, the account link and vote date are erased; the score joins an anonymous counter for its number of stars. It remains included in the average and voter count. Ratings are erased if the route is permanently deleted by moderation.

3.5 Your precise location

Vistavel uses your device's location only if you allow it, to choose the starting point, to guide you during a ride and to record a ride. It is processed on your device. It only leaves the device in the following cases:

Legal basis: your consent, given through the location permission and withdrawable at any time in the settings of your device or browser.

3.6 Support messages

Data: what you write in the contact form or to contact@vistavel.com (message, optional rating, topic); your e-mail address if you give it to receive an answer; the type of browser; and, only if you tick the box (unticked by default), the settings of the current route: starting point, end, distance, type of bike. If you are signed in, a start or end located in one of your private places is attached only as “lieu privé” (private place), and the name of a private place is removed from the other names; if the list of your private places cannot be read, the route is not attached, and the confirmation says so. Without an account, the starting point may be your home: only tick the box if you agree to share it. If you write while signed in, we only check whether your account manages an organisation whose subscription includes priority support: the subject of the message then reads “[Prioritaire · offer name]”; nothing else from your account is attached to the message and this check is not kept.
Where: sent by e-mail to our mailbox, with a copy in a Gmail mailbox (Google).
Legal basis: legitimate interest (answering you and improving the service).
Retention: 3 years after the last exchange.

3.7 Payment

Payment for a plan is processed by Stripe, which acts as the controller of its own processing. We never receive or store your card number: only the customer, subscription, invoice and payment identifiers (section 3.1). Stripe keeps payment data according to its legal obligations. When the account is deleted, your customer record at Stripe is anonymised: your name is replaced by “Compte supprimé” (French for “account deleted”), your e-mail address, billing address and VAT number are erased from it, and your saved payment methods are detached from it. Your invoices already issued remain intact at Stripe, with the data they bear, for our accounting obligations. If Stripe does not respond, the anonymisation is resumed automatically; until then, we keep only the identifier of the record. The customer record of a club or organisation at Stripe, created at its first purchase, belongs to the organisation: it bears the e-mail address to which Stripe sends its invoices and credit notes — that of the account that made that first purchase, then, after each accepted handover of the responsibility, that of the new manager, which we then pass on to Stripe. Deleting your account does not touch it; if it still bears your e-mail address, write to us to have it replaced.

Billing and VAT. Data: the billing country you give before payment; the country of your connection at the time of purchase, derived from your IP address by Cloudflare (the IP address itself is not kept); the place of the billing address you enter on our purchase page (its country, or the territory its postal code designates; not the address itself); if you give a VAT number, its type, its last four characters, and the result and date of its check — a European Union number is checked by our server with the European Commission's VIES register, when you save it and at each purchase, and we keep the consultation number the register returns (the proof of the check); when the billing address or the place given before payment is outside the European Union VAT area (a non-EU country, or a territory such as the Canary Islands or Livigno), the result of the check of the place of purchase (for a business, only when such a territory is involved), the amount of VAT charged by Stripe and, if that address is outside that area and the country of your connection is not enough to establish it, the issuing country of your payment method, read from Stripe; for a subscription, the VAT amount of its last paid invoice. Your name, the full billing address — entered on our purchase page, passed to Stripe by our server, which does not keep it, then shown on the invoice; our server reads it back from Stripe to prefill the page at the next purchase —, the full VAT number and the invoices are kept by Stripe, which has United Kingdom numbers checked by the UK's official register (HMRC).
Why: to apply the right VAT, show the mandatory statements on invoices and keep proof of the place of each sale.
Legal basis: legal obligation (VAT and invoicing rules).
Retention: the country and VAT number of your account, until they change or the account is deleted; the details kept with each purchase, as long as the account exists, then 10 years after its deletion (and never less than 10 years after the end of the year of the purchase), the retention period for tax evidence, in a separate archive reserved for tax obligations: there they remain linked to your customer record at Stripe by its identifier alone and to the invoice by its own, without your name, your address or your e-mail address; then erased automatically. Only the Vistavel administrator can export this archive, for the accountant or a tax audit: each export requires a one-time code and is recorded, with its reason, in the administration access log (section 3.10).

3.8 The number of visitors present

The website and the Android app show how many people are using Vistavel right now. This number relies on a truncated, non-reversible hash of the IP address, the browser and the date. It identifies no one, is never logged, and disappears 90 seconds after the last sign of life of the page or the app.

3.9 Hosting

Discover catalogue: searched areas and their public OpenStreetMap routes are kept in your browser cache (a few areas and the routes of the itineraries you last opened). Data older than 30 days is no longer reused and is replaced on the next search. This cache stays on your device and can be removed by clearing site data. The area searched, rounded to a grid of a few kilometres, is first requested from our server — and, at the 50 and 100 km radii, the route of an itinerary you open, by its OpenStreetMap number — which keeps the public itineraries already built for 30 days; otherwise it is sent to Overpass through the chain described in section 4, and your browser then deposits the routes it built on our server. To protect this shared route cache, a hash of the prefix of your network address is kept for 24 hours, never the address itself.

Our host, Cloudflare, processes IP addresses to route requests and protect the service. We keep no request logs. It also derives the country and the continent of the connection from the IP address: the continent sets the currency of the offers shown on the website (euro in Europe, dollar elsewhere); the country goes into the visit counters (section 3.11). Neither is kept with your account.

3.10 Account administration

The Vistavel team, that is the administrator and the people they appoint for moderation and for support, can view an account's record for support, moderation, running the service and the requests you send us. Each sees only what their role requires.

Moderation can suspend or reactivate an account, and support can require you to set a new password; exporting and deleting an account remain with the administrator. Each access requires a password and a one-time code (second factor); it closes after 30 minutes of inactivity.
Every consultation is recorded in a log that no one can modify: date, author, action, identifier of the account viewed and, for a search, the text searched, which may be an e-mail address. This log is kept for 10 years, including after the account concerned is deleted.
Legal basis: legitimate interest (securing the service, answering your requests and being able to account for every access).

Hidden rides: a separate administration section allows authorised moderators to inspect retained routes, including private geometry, and decide whether to erase them permanently. Every read and erasure requires the second factor and is logged. These archives are never published in the catalogue. An old ride identifier may remain marked as withdrawn, without its geometry, to prevent automatic re-upload from another device.

3.11 Visit, sign-up and revenue measurement

Site visits. We count, per day, the pages viewed on vistavel.com: the type of page (home, offers, catalogue…) and its language, the type of device (phone, tablet, computer), the country and, if you arrive from another site or from an app, the name of that site or service when it is on our list of search engines (including the AI assistants ChatGPT and Perplexity), social networks, messaging services and webmail services (otherwise only “another site”), and the campaign named in the link that brought you (utm_source, utm_medium and utm_campaign parameters). We also count, per day and per language, the displays of the website's sign-up form. These counters contain no IP address, no identifier and no cookie, and nothing is written on your device.

Sign-up. When you create an account, we record the platform used (website, iPhone, Android) and, for the Android app, its version, the language chosen and, if you answer the website's optional question, how you heard about us; then the dates of confirmation, first route, first subscription and first purchase, with the plan chosen. This information is linked to a pseudonym, never to your email address. It is used only to know which channels bring us members. You can object to it in “My data” on the Account page of the vistavel.com website, including for an account created in the app. It is made anonymous 25 months after the account is created, as soon as it is deleted or as soon as you object; your answer to the question is then no longer kept.

Revenue. To follow our revenue, we count per day each subscription payment, each failed payment and each one-off purchase, with the plan and the amount; every night, we note the number of subscribers and the monthly revenue, from which we deduce new subscriptions, changes and cancellations. These counters are linked neither to your account nor to a pseudonym.
Legal basis: legitimate interest (knowing which channels bring us members and following the activity of the service).

3.12 The microphone and voice commands

During a ride, you can speak a command (microphone button, or hands-free mode), only if you allow the microphone. Speech recognition is the one of your device or browser: its provider (often Google, or Apple on iPhone) may process the sound on its servers, under its own policy. Vistavel only receives the recognised text, analysed on your device to find the command: neither the sound nor the text is sent to Vistavel, or kept.
Legal basis: your consent, given by allowing the microphone and revocable at any time in the device or browser settings.

3.13 Reports

The “Report” button of a shared link, of a participant in a live ride, of a route proposed for the catalogue, of a club, of a challenge, of a name shown on a challenge's ranking, of a photo or a photo link of an outing's gallery, of a carpool notice, of a message of a club outing's live, of a photo of the public gallery or of a pseudonym sends us the reason chosen, your optional details and the content concerned: the link; the participant's first name and account identifier; the route's name and the identifier of the account that proposed it; the club's name and the identifier of one of its club leads; the challenge's name and the identifier of the account that proposed it; the name shown, the challenge and the identifier of the account that chose that name; the photo, its caption, the outing and the identifier of the account that sent it; the address of the photo link, its caption, its credit, its licence, the outing, the first name and the identifier of the account that added it; the direction of the carpool notice, its seats, its meeting place, its details, the outing, the first name and the identifier of the account that published it; the kind and the text of the live's message, the outing and, if its author still takes part in the live, their first name and account identifier; or the public photo (or the pseudonym shown under it) and the identifier of the account that published it. Reporting a participant in a live ride, a club, a photo, a photo link, a carpool notice or a message of an outing requires an account; a shared link, a route proposed for the catalogue, a public challenge, a name shown on its ranking, a photo of the public gallery and a pseudonym can also be reported without one. With an account, your identifier is attached; without one, we only keep a fingerprint of your IP address that changes every day, to limit the number of reports, never the address itself. Only moderators read reports; the person reported does not know who reported them. A route or a challenge withdrawn by the moderators leaves the catalogue; a withdrawn club is no longer public; a name removed from the ranking is erased, while the participation in the challenge and its progress remain. A photo reported with the reason “I am in this photo without my consent” is hidden for everyone at once, until the moderators decide: keep it (it is shown again) or delete it. If you report that you appear in a photo without your consent, you can mark the area where you appear: this rectangle is kept with the report. The moderators may blur this area; the blurred version is then the only one shown, to everyone, its author included; the original is visible to the moderators only and is deleted with the photo. A photo link or a carpool notice removed by the moderators is deleted from the outing.
Warning: when content you published (challenge, route proposed for the catalogue, correction of a place), or a group or club you are responsible for, does not comply with our terms of use, the moderators may send you a warning by email, in your account's language: the content concerned and the rule breached, without the name of the person who sends it. The same content receives only one warning in 24 hours. The sending, then whether it left, are recorded in the administration access log (section 3.10) with your account identifier, the content's identifier and the rule; its copy is kept like that of our other emails (section 3.14).
Removal of public content: when the moderators remove content that you published and that was already public (a route proposed for the catalogue, a challenge, a correction of a place), they choose its reason from a fixed list and send you by email, in your account's language, a statement of their reasons: the content removed, the reason, its ground in our terms of use, the origin of the decision (a report, or a check made by the moderators), the fact that the decision was taken by a person, and how to contest it; the name of the person who took it is not included. For a club's contribution to a place sheet, this statement, which also names the club and the place, is sent to one of the club leads; when the moderators remove a group or a club, one of its leads likewise receives the statement of reasons, which also names its contributions to place sheets that left the public with it. When the moderators suspend your account, they likewise choose the rule breached from this list and send you the statement of reasons for the suspension, which also names the content not yet checked that left the public with it. The list of your routes proposed for the catalogue and that of your proposed challenges also show this removal. The sending and its outcome are recorded in the administration access log (section 3.10) with the identifier of the recipient account, that of the content (or of the suspended account) and the reason; its copy is kept like that of our other emails (section 3.14); the reason, and whether the statement was sent, stay noted on the removed content as long as it is kept.
Legal basis: legitimate interest (protecting users and enforcing the rules on published content); for the statement of reasons of a removal or a suspension, legal obligation (Regulation (EU) 2022/2065 on digital services, Article 17).
Retention: reports, until the moderators' decision, then erased; the administration log keeps the decision (section 3.10).

3.14 Copies of the emails we send

We keep a copy of every email Vistavel sends you (account, outings, clubs, challenges, offers): your address, the language, the type of email, its subject, its text, the date and whether it was delivered. The codes (address confirmation, password change) and invitation links they contain are masked in it. Only Vistavel's administration, moderators and support can view these copies, and every view is logged (section 3.10). They serve support, so that we know what we wrote to you, and as proof of sending, in particular of the reminder before a yearly subscription renews and of purchase confirmations.
Legal basis: legitimate interest (answering your support requests, proving that the information owed to customers was sent).
Retention: as long as your account exists, then 5 years after it is deleted, the limitation period for a dispute; 1 year after sending for an email sent to an address without an account, such as an invitation to join a community. They are then erased automatically.

3.15 Photos of outing galleries

When you take part in a club outing (as a member or as a guest), you can add photos to its gallery, from its start until 30 days after its end: at most 10 photos per person and 100 per outing, with an optional caption.
Data: each photo, reduced on your device to at most 1,600 pixels per side (and a 400-pixel thumbnail), its caption, the date it was added, your account identifier and your two declarations: that you took the photo or have the right to share it; that the recognisable people agreed. To suggest a caption, your device reads from the photo the time and place it was taken (for a photo taken with the page's camera that has no position, your device's position, if you allow it); this place, rounded to about a hundred metres, is sent to Photon (section 4) to get the locality and municipality, and no place is suggested inside one of your private places. This caption stays editable and is sent only if you keep it. The suggested locality and municipality are also kept with the photo, apart from the caption, to be shown with it if you publish it in the public gallery (section 3.19); they are shown nowhere else. The photo itself is re-encoded on your device before sending: the original file and its metadata (GPS position, camera model, date taken) are not sent to us, and the server refuses any image that would still carry them. The only exception: if you publish the photo in the public gallery and choose to show where it was taken, that place, rounded to about a hundred metres, is sent to us separately (section 3.19). A caption that names one of your private places is refused.
Storage: at Cloudflare, in a private storage space (Cloudflare R2): the photos have no public address and are read only through Vistavel, after the session is checked. They stay on that server: Vistavel records no copy of them on your device, neither in the browser nor in the app, not even in their cache, whether of your photos or of the other participants' photos; they are only displayed while you view them.
Recipients: the participants of the outing and its organisers, signed in; your account identifier is never shown to them, only your display name in the club. The moderators see a reported photo.
Photo protection: a photo shown to anyone but you carries, in its file, the notice of your rights, in French — “© l'auteur — publié sur vistavel.com. Tous droits réservés.” (“© the author — published on vistavel.com. All rights reserved.”; in the public gallery, your pseudonym instead of “the author”: section 3.19) and the prohibition to reproduce it without your consent — as well as an encrypted signature that lets the Vistavel team, and only it, tell which photo a copy found elsewhere comes from: the photo's identifier, its gallery, its placement in that gallery (for an outing, the club and the outing; for an album, the album) and the day it was shown, never your account nor that of the person looking at it. No geographic position or other information is written into it, and the photo kept on the server is not changed: you see it as it is in your own galleries. Every check of a signature by the team is recorded in the administration access log (section 3.10). The pages block the ordinary saving of other people's photos (browser menu, dragging, long press); a screenshot remains possible.
People in the photos: with every upload, you declare that the recognisable people agreed that the photo be shown to the participants of the outing. A person who appears in a photo without their consent can report it with the reason “I am in this photo without my consent”: the photo is hidden for everyone at once, then the moderators decide to show it again or to delete it. They can also write to contact@vistavel.com, with or without an account.
Legal basis: performance of the service you ask for (sharing your photos with the participants of the outing); for the people photographed, their consent, collected by the person who sends the photo and attested by their declaration.
Retention: until the photo is deleted, with no maximum period. A photo is deleted, with its thumbnail, when its author or an organiser of the outing deletes it, when the moderators remove it, when its author's account is deleted, when the outing is cancelled or deleted, or when the club is deleted. It stays online if its author leaves the outing or the club, or if their invitation ends: as long as they are a member of the club, the author keeps access to their own photos to delete them.

3.16 People you block

The “Block this person” button, next to “Report” (photo or photo link of an outing gallery, photo of the public gallery, carpool notice, name on a challenge's ranking, proposed challenge, published sub-group, participant or message in a live ride), hides from each other what you and that person publish: their photos and photo links, their carpool notices, their name on rankings, their challenges and sub-groups are no longer shown to you, nor yours to them, and, in a live ride, neither their first name, nor their position, nor their messages reach your device any more, nor yours theirs. Your own memberships and participations stay in your lists. Nothing is hidden in an outing that either of you organises, nor on a club's management screens.
Data: for each block, the identifier of the blocked account (never shown to you), the name you had in front of you (at most 40 characters), the kind of content and the date; on the blocked person's side, a mirror row carrying your account identifier, to hide what you publish from them. During a live ride, the room keeps, next to your participation, the list of the account identifiers blocked in either direction, never broadcast, and forgets it when you leave the ride or after 5 minutes of silence. At most 500 blocks per account.
Recipients: only you see your blocks, in “Account”, “My data” section, “Blocked people”. The blocked person is not told and nothing tells them who blocked them. The moderators see no block: harassment is reported with “Report”.
Legal basis: performance of the service you ask for (blocking a person); for the blocked person, legitimate interest (protecting users).
Retention: until you unblock the person (“Unblock”), or until either account is deleted, which erases the block in both directions.

3.17 The camera: reading a QR code and the photos of “Start riding”

In a treasure-hunt booklet, “Scan the QR code” opens the camera, only if you allow it, to read the code displayed on site. The image is analysed on your device, never recorded or sent; only the text of the code read fills in the field.
In “Start riding”, 📷 opens the camera, only if you allow it, to take a photo of the ride. The camera image stays on your device; only the photo you save, with “Save in “My photos””, is prepared on the device and then saved in “My photos” (section 3.18) or, during a club outing’s live session, in the outing photos if you ticked them (section 3.15). The camera turns off as soon as the photo is taken or the window is closed.
Legal basis: your consent, given by allowing the camera and revocable at any time in the device or browser settings.

3.18 My photos

You can keep photos in “My photos”, an album only you see, sorted by day, from the Account page, from an outing gallery when you send a photo to it, or from “Start riding”: 10 photos a day at most.
Data: each photo, reduced on your device to at most 1,600 pixels per side (and a 400-pixel thumbnail), its caption, the suggested locality and municipality (section 3.15), its day (the day it was taken, otherwise the day it was added), the date it was added and your account identifier. The suggested caption and the metadata follow the rules of section 3.15: the original file and its metadata are not sent to us. A caption that names one of your private places is refused.
Storage: at Cloudflare (section 4), in the private storage of photos (Cloudflare R2): no public address, read only through Vistavel, with your session.
Recipients: you only; neither other accounts nor clubs see “My photos”.
One photo, several galleries: a photo of “My photos” can also be shown in the gallery of an outing you took part in (section 3.15) or in the public gallery (section 3.19), without being kept twice; in these galleries, those who see it can report it. Removing it from one gallery leaves it in the other; cancelling the outing or deleting the club does not remove it from “My photos”; withdrawn by moderation, it disappears everywhere.
Legal basis: performance of the service you ask for (keeping your photos).
Retention: until you remove a photo from every gallery that shows it, or until your account is deleted, which deletes them all. The export of your data lists them (identifier, day, caption, place, date).

3.19 The public gallery

You can show a photo to everyone on Vistavel's “Gallery” page, from “My photos”, an outing's gallery or “Start riding”: at most 20 photos a day.
Data: the photo (the same as in your other galleries, never copied: sections 3.15 and 3.18), its caption, the locality and municipality suggested from the photo (if any), its day, its publication date, your account identifier, your two declarations and your pseudonym (2 to 30 characters, chosen at your first publication, changeable in “Account”). Also shown with it: its activity (cycling, hiking, walk), taken from the outing or the “Start riding” recording, or chosen by you; if you choose so, the place where it was taken, rounded to about a hundred metres, on a map — never in one of your private places; the number of likes. The route the photo was taken on (the outing's route at your pace, the “Start riding” one) is kept with it: only a route of the public catalogue is shown, with a link to its page; for any other, the page only says the photo was taken on a private route, showing nothing of it. Neither your name nor your email address is shown.
Storage: at Cloudflare (section 4), in the photos' storage (Cloudflare R2); a public photo is read without an account, through Vistavel.
Recipients: anyone who visits vistavel.com, with or without an account. The page is not offered to search engines; it blocks the ordinary saving of the photo, whose file carries your pseudonym in the notice of your rights (section 3.15), but a public photo can still be seen, and copied by a screenshot, by anyone who looks at it. The moderators see a reported photo or pseudonym.
People in the photos: with every publication, you declare that the recognisable people agreed that the photo be shown to everyone. Anyone, with or without an account, can report a public photo; with the reason “I am in this photo without my consent”, it is hidden for everyone at once, then the moderators decide to show it again or to remove it. People can also write to contact@vistavel.com.
Legal basis: performance of the service you ask for; for the people photographed, their consent, collected by the person who publishes and attested by their declaration.
Retention: until you remove the photo from the public gallery, the moderators remove it or your account is deleted. The pseudonym is kept with your account; the moderators can erase it if it is reported. The export of your data lists them.

3.20 Group albums

When you join a group by its code in “Start riding”, Vistavel adds you to the people present in that group's album for that day: one album per code and per day (a code reused another day opens a new album). The people present see the album with no time limit and can save photos to it from “Start riding” or from the Account page: at most 10 photos per person, 100 per album.
Data: your presence (your account identifier, the group's code, the day and the first name shown in the group); for each photo, the same photo as in your other galleries, never copied (sections 3.15 and 3.18), its caption, the suggested locality and municipality, the date it was added and your two declarations.
Storage: at Cloudflare (section 4), in the photos' private storage (Cloudflare R2), with no public address, read only through Vistavel with a session.
Recipients: the accounts present in the group that day; the moderators for a reported photo. Each person present can report a photo or block its author; with the reason “I am in this photo without my consent”, it is hidden for everyone at once, then the moderators decide to show it again or to remove it.
Retention: your presence as long as your account exists; each photo until it is deleted by you, by the moderators or with your account.
Legal basis: performance of the service you ask for.

3.21 Likes in the public gallery

Signed in, you can like a photo of the public gallery: one heart per photo, which you can take back.
Data: your account identifier, the photo and the date.
Recipients: nobody sees who liked a photo, not even its author; only their number is shown to everyone.
Legal basis: performance of the service you ask for.
Retention: until you take your heart back, the photo leaves the public gallery or your account is deleted; the export of your data lists them.

3.22 Route requests

Signed in, under a photo taken on a private or club route, you can ask to see that route: one request per photo, 10 a day, without a message.
Data: the request, your account identifier, the photo, the date, its state.
Recipients: the photo's author, or for a club route its managers, by an e-mail from Vistavel and in “Account”; they only see that a Vistavel user asks for it, never who. Accepted, you are told by e-mail; a refusal is not notified to you.
What becomes public: accepted, the route is shown under the photo, without its first and last 500 metres nor its passages through its author's private places, and an anonymous copy is proposed to the “Routes” catalogue, reviewed by the team before it appears.
Legal basis: performance of the service you ask for.
Retention: 90 days after the request, then erased; the route shown stays until its author removes it.

3.23 Signing in with Google or Apple

If you choose “Continue with Google” or “Continue with Apple”, you sign in with that service, under its own privacy policy: Vistavel never sees your Google or Apple password. We only ask for your e-mail address: not your name, your photo or your contacts.
Data received: from Google, the identifier of your Google account (the same for every service where you use it), your e-mail address and whether it is verified; from Apple, the identifier of your Apple account specific to Vistavel, your e-mail address — or the private relay address Apple creates if you hide yours — and whether it is verified.
Data kept: the service (Google or Apple), the identifier it gives us, the date of the link and, for Apple, whether a relay address is used; for an account created this way, the address received becomes the account's address (section 3.1); to link an existing account, it is not kept. During a sign-in: the start of the sign-in (the page to return to and, to link, your account), erased when the service answers, otherwise at our server's next clean-up; the outcome of the sign-in (the service, the identifier it gives us, the address received), usable for 10 minutes at most after the service's answer, erased as soon as you sign in or cancel, otherwise at our server's next clean-up; and a technical cookie vv_oauth (HttpOnly, secure, limited to the sign-in addresses) that ties the service's answer to your browser, erased when you sign in, otherwise expired at the latest 10 minutes after that answer, or 10 minutes after it was set if the service does not answer. To limit abuse, we count the sign-ins started with Google or Apple from each IP address for one hour, as a hash, never the IP address itself. No token of the service is kept.
An existing account with the same address is never linked without your proof: its password, or a code sent to that address. An account with the same address that was never confirmed is replaced by the new one.
Why: to sign you in and create your account at your request.
Legal basis: performance of the contract (the Terms of Use); legitimate interest for counting the sign-ins started (account security).
Retention: the link, until you remove it (“Account”, “Security” section, “Unlink”) or until the account is deleted; the start of a sign-in, erased when the service answers, otherwise at our server's next clean-up; the outcome of a sign-in, unusable after 10 minutes and erased at the latest at our server's next clean-up; the cookie, 10 minutes after the service's answer (after it was set, if the service does not answer); the count of an IP address, at the end of the hour.

3.24 Points, levels and badges

When you are signed in, the rides you record and keep in your account (“Start riding”, “Start walking”), your presence checked at a club outing and the challenges you complete earn you points, a level and badges, shown in “Account” (“Progress”) and at the end of a ride.
Data: computed by our server from what your account already keeps (your recorded rides, section 3.4; your presence at club outings; your challenges; your passes): for each recorded ride that our server has judged, counted or not, its start, its end, its activity, its points and, if there is one, the reason why it was not counted, or not in full, with what specifies it (simulated ride, too short, speed too high for the activity and that speed, inconsistent times, duplicate ride and the start of the ride it overlaps, GPS jumps, implausible elevation gain, daily cap); each club outing at which your presence was checked (the club, the outing and the time of the check) and each challenge completed (the challenge and the date); your totals (distances, elevation gain, number of rides), the weeks and seasons in which you went out, your badges and their date, your latest gains; the map squares (about 1.7 km per side in France) that your rides crossed, for the exploration badges — never a copy of your tracks.
Recipients: you only; at the end of a ride, the screen congratulates you by your public pseudonym (section 3.19) if you have one. The Vistavel team (administration, moderation, support) can read them in your account's record, and administration and support can reset them, with a reason; they are then computed again from what your account still keeps. Every reading and every reset is written to the administration access log (section 3.10).
Legal basis: performance of the service you ask for.
Retention: as long as your account exists, including for a ride you remove from your account (its points stay earned) — the club outings and challenges counted also remain after the names are erased from the attendance sheet (twelve months after the end of the outing), after your membership ends and after the challenge ends, so that their points stay earned and are counted only once; the export of your data contains them; they are erased with your account.

3.25 The authenticity QR code of PDFs

Every PDF created on the vistavel.com website (topo, booklet, club route print, attendance sheet, outing programme) carries on each page a QR code leading to the document's record, so that whoever receives it can check that this file was registered on Vistavel and has not been modified. The PDFs of the Android and iOS apps do not have this QR code yet; they will add it in a future update. The PDF is always made on your device: our server never receives the file, only the information below.
Data: the type of the document, its title (the name of the route, outing or booklet; the club and season of a programme), its language, your device's time zone, the date and time of creation, the number of pages, the file size and its fingerprint (SHA-256: 64 digits and letters computed on your device, from which the document cannot be rebuilt); for a club document, the name of the club, only when our server has checked that you are an active member and, for an attendance sheet or a programme, that you manage the club's outings (your session is read for this, without being kept). The record contains neither your account identifier, nor your e-mail address, nor your name. To limit abuse, a fingerprint of the network of your IP address counts the PDF requests of the hour (120 at most); it is erased at our server's next housekeeping after the end of the hour.
Recipients: anyone who opens the address of the QR code sees the record (type, title, club, date and time of creation with your device's time zone, language, number of pages, size, fingerprint); they can compare a PDF file with it, on their own device, without sending it. A record names no account: to have one removed, write to us with the address of its QR code.
Legal basis: performance of the service you ask for (the PDF and its QR code); for the hourly count, the legitimate interest of protecting the service against abuse.
Retention: 5 years after the creation of the PDF, then erased (sooner if our team removes it, at your request or because it serves an abuse; the removal is written to the administration journal with the record's identifier and its reason, section 3.10); a record started but never completed (an interrupted PDF) is never shown and is erased at our server's next housekeeping, after one hour.

4. Services that receive data

To build and display a route, your device queries the services below directly. Each receives your IP address and the request described. None receives your e-mail address or your account identifier.

Our processors: Cloudflare (hosting of the website, the accounts, your saved content, group rides, and the photos of outing galleries in a private storage space, Cloudflare R2), Resend (delivery of account e-mails, section 3.1), Google (Gmail mailbox receiving a copy of support messages). Stripe processes payments (section 3.7). The official VAT registers receive the VAT number you give, to check it (section 3.7): VIES (European Commission) from our server, for a European Union number; HMRC (United Kingdom) from Stripe.

Google (Google Ireland Limited, Ireland; Google LLC, United States) and Apple (Apple Distribution International, Ireland; Apple Inc., United States), as identity providers, only if you choose to sign in with them: you sign in with them, then our server receives the data described in section 3.23; it only sends them the technical elements of that sign-in. If you hide your address with Apple, your account's e-mails (section 3.1) go through Apple's private relay service, which forwards them to your real address.

5. Transfers outside the European Union

Cloudflare, Resend, Google, Apple, Stripe, Wikimedia, Amazon Web Services and Esri may process data in the United States. Depending on the provider, these transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses. Switzerland, the United Kingdom and Norway benefit from an adequacy decision. The maps.mail.ru mirror (Russia) receives no personal data: only the area of a request, without IP address or identifier.

6. Retention periods

7. Deleting your data

A recorded ride, route or imported GPX track: "Hide" removes the item from your library without erasing its retained copy. If signed in, that copy remains accessible to moderators; otherwise it remains on this device. A failed withdrawal is reported and does not silently discard the ride.

A shared link or catalogue submission: withdrawal makes the copy unavailable to the public. It remains accessible to moderators, who alone can erase it permanently. Account deletion erases its private archives and shared-link copies; the routes you published to the catalogue stay there, attached to Vistavel's administration account, with no link to you.

A favourite place: in "Map content", section "My favourite places", tap ✕ ("Remove from favourites"), or use the same button in the place's bubble on the map.

A photo of an outing's gallery: in the gallery, “Delete” on each photo you sent, even if you no longer take part in the outing, as long as you are a member of the club. Deleting your account deletes all your photos.

Your account: on the vistavel.com website as in the Vistavel app, open "Account", then "Delete my account", and confirm with your password (an account without a password, created with Google or Apple: with the deletion code received by e-mail). You can also write to contact@vistavel.com from your account's address. Deletion immediately erases the account, your routes, your favourite places, your private places, your share links, your recorded rides, the photos you sent to outing galleries, your blocks and those aimed at you, your session and the related indexes; a current subscription is cancelled before erasure. Copies of the emails we sent you are kept for 5 years after deletion, for support and as proof of sending (section 3.14). Data kept on your device is erased by uninstalling the app, or by clearing the website's data in your browser. The ways to delete, what is erased and what is kept, with the durations, are gathered on the page Delete your account.

8. Your rights

You can ask for access to your data, its rectification, erasure, portability and the restriction of its processing, object to processing based on legitimate interest, and withdraw your consent to location. Write to contact@vistavel.com or use the Support page: we answer within one month. The “Export JSON” file of your account includes the list of the photos you sent to outing galleries (club, outing, caption and date) and that of the people you blocked (name seen, kind of content and date), never the identifier of their account nor the blocks aimed at you. You may also lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.

9. Data on your device

Vistavel keeps your routes, your favourites, your display preferences, the draft of the ride being recorded and, if you mark the attendance of a club outing in the app, the marks made without network until they are sent (section 3, “Attendance at clubs' outings”) on your device, so that it works offline. This data is only sent to our server in the cases described above.

10. Changes

We may change this policy. The version in force is the one published on this page; its date is shown at the top. An important change is announced when you sign in.