Privacy Policy

BitesOf is operated by Bytes Of(“we”, “us”), a sole proprietorship registered in Denmark under CVR number 46709551. Bytes Of is the data controller for the personal data described here. For anything in this policy, write to contact@bitesoftravel.com or use the contact form.

• Account details. Your email address, display name, and profile picture, passed to us by Auth0 when you sign in. We never see or store your password.
• What you create. Trips, days, routes, waypoints, places, accommodation, notes, expenses, photos, and anything else you type or upload.
• Social activity. Follows, likes, comments, and collaboration invites, where you use those features.
• Connected services. Activities and routes imported from Strava, if you choose to connect it.
• Technical data. IP address, browser and device type, and error logs, which we need to run and secure the service.
• Usage analytics. Which pages get used and how often - aggregate, consent-based, and never used to profile you.

Location data is only collected while you actively start a tracking session, and it is stored against that trip alone. We do not track your location in the background.

• To provide the service - storing your trips, drawing your routes, sharing what you choose to share. This is necessary to perform our contract with you.
• To keep it working and secure - diagnostics, abuse prevention, backups. Our legitimate interest in running a reliable service.
• To take payment for a paid plan, where you have one. Necessary to perform our contract.
• To understand usage through analytics, and to send optional product email. Both on the basis of your consent, which you can withdraw at any time.

We do not sell your personal data and we do not share it for advertising. We use the following providers to run the service, each only for the purpose listed:

• Auth0 (Okta) - Sign-in, sessions, and password or social login
• Mapbox - Map tiles, place search, and driving directions
• BRouter, GraphHopper, OpenRouteService - Calculating cycling, hiking, and walking routes from the points you place
• Open-Meteo - Weather forecasts for the dates and locations in your trip
• Amazon S3 - Storing cover images and photos you upload
• Stripe - Subscription payments - card details go to Stripe, never to us
• Resend - Sending account, invitation, and contact-form emails
• Strava - Importing your activities, only if you connect your account
• Google Analytics - Aggregate usage statistics, only with your consent

Some of these providers are based outside the UK and EEA. Where personal data is transferred there, it is covered by the provider’s standard contractual clauses or an equivalent safeguard. We may also disclose data where the law requires it.

Every trip starts private. It becomes visible to other people only when you change its visibility or invite a collaborator. If you make a trip public, its content, cover image, and your profile name are visible to anyone with the link and may be indexed by search engines - that is the point of a shared link, but it is not reversible for anyone who has already seen or copied it. A trip shared with anyone with the link is readable by whoever has that link, no account needed, but stays out of Explore and search engines.

We set a session cookie so you stay signed in, and a preference cookie for your theme. Both are strictly necessary and cannot be turned off while using the app. Analytics cookies are only set if you consent to them.

Your content is kept while your account is open. Deleting a trip marks it as deleted and removes it from every view immediately; it is purged from our systems within 30 days. Deleting your account removes your profile and content on the same timetable, except where we must keep records longer - payment records, for example, which tax law requires us to retain for five years. Backups roll off within 30 days.

If you are in the UK or EEA you have the right to access your data, correct it, have it erased, export it in a portable format, restrict or object to how we use it, and withdraw consent at any time. Exercise any of these by emailing contact@bitesoftravel.com; we will respond within one month. You can also complain to a data protection authority - our lead authority is the Danish Datatilsynet, or you can go to the authority in your own country.

BitesOf is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has an account, contact us and we will remove it.

If we change this policy we will update the date at the top and, for anything that materially affects you, tell you by email or in the app before it takes effect.