1. In short
- We only process what Scenicway needs to work.
- No tracking, no analytics tools, no advertising cookies. We only count anonymously how often something happens (for example "app opened"), without cookies and without any link to you. Fonts and scripts come from our own domain (exception: the Turnstile bot check when you sign in, see below).
- Your wishes for a route (places, text, screenshot) are sent to Google Gemini so that the AI can suggest a route.
- You can delete your account yourself in the app at any time.
2. Controller
Alen Kvakić, Mollardgasse 49-51, 1060 Wien, Austria. Email: [email protected]. We have no data protection officer because we are not required to have one. Just write to the email address with any question.
3. What we process, why, and on what legal basis
"GDPR" is the EU General Data Protection Regulation. "Contract" means: we need the data to provide the service to you (Art. 6 (1) (b) GDPR). "Legitimate interest" means Art. 6 (1) (f) GDPR, "legal obligation" means Art. 6 (1) (c) GDPR.
3.1 Visiting the website
For every page request our host Cloudflare processes technically necessary data: IP address, time, requested address, browser and operating system. Purpose: delivering the page and fending off attacks. Basis: legitimate interest in secure operation. We do not keep access logs ourselves.
3.2 Account and sign-in
- Data: email address, display name, language, time of sign-up and of last use. If you sign in with Google, also the ID of your Google account (no contacts, no password).
- Sign-in link by email: we send you a link via Resend. It is valid for 15 minutes and works once. To prevent abuse we store the IP address the link was requested from.
- Bot protection: in the sign-in form, Cloudflare Turnstile checks that a human is asking. For this your browser loads a script from Cloudflare, and Cloudflare processes your IP address and browser characteristics, among other things. Basis: legitimate interest in preventing spam and mass sign-ups.
- Purpose and basis: providing your account and linking purchases to it (contract).
3.3 Cookies and browser storage
__Host-sw_session: keeps you signed in. Strictly necessary, valid for 30 days or until you sign out. On the server we only store a hash of it, together with the IP address and browser string of the sign-in for security.__Host-sw_oauth: only when signing in with Google, protects the flow against forgery. Valid for 10 minutes.- Local storage (localStorage, sessionStorage): language, preferences, demo state and the last result, plus, while you sign in or pay, your unfinished route form (including a screenshot, if any) until you come back. This data stays on your device. You can delete it in the app settings or in your browser.
All of this storage is strictly necessary for the service you asked for, so no consent is needed (§ 165 (3) of the Austrian Telecommunications Act 2021, TKG 2021). We set no other cookies.
3.4 Route planning with AI
- Data: start, destination, stops, vehicle, preferences, departure time, your free text and, if you upload one, a screenshot.
- Recipient: we send these inputs through our server to Google's Gemini API, including "Grounding with Google Maps", so that Google can check real places. Your IP address is not passed to Google.
- On our side: we do not store screenshots. We keep the result of a request for up to 10 days without any link to you, so that identical requests are answered faster and at lower cost. Our server also keeps identical place searches, routes and weather answers in a cache for up to 30 days, without any link to you.
- On Google's side: we use the paid Gemini API. Under Google's terms, inputs are not used there to train models, but Google keeps them for a limited time to detect abuse.
- Basis: contract. Please do not put sensitive data (for example health data) into your wishes and do not upload screenshots that contain other people's personal data.
3.5 Voice input and location
Voice input uses your browser's speech recognition. Depending on the browser, its maker (for example Google for Chrome, Apple for Safari) processes your voice recording. We receive no recording, only the recognised text. If you are signed in, we instead record up to 30 seconds and send the recording to Google Gemini only to turn it into text. We do not store it. The app only asks for your location when you tap "My location" and allow it in your browser. It is then used as the starting point. Basis: contract, at your request.
3.6 Map, place search, routing and weather
- Map images (OpenFreeMap, openfreemap.org): Your browser loads map tiles, fonts and symbols directly from there. OpenFreeMap receives your IP address, browser data (for example the browser type) and the map area shown. The map data comes from the contributors of OpenStreetMap.
- Place search, time zones and route calculation (Geoapify, KEPTAGO LTD, Cyprus, servers in the EU): These requests go through our own server. Geoapify receives the places, coordinates and waypoints searched for, but not your IP address, only the one of our server. According to its own statements, Geoapify stores the content, headers, IP address (that of our server) and time of each request for access control and usage counting.
- Weather (MET Norway, Norwegian Meteorological Institute, Norway): Our server sends coordinates rounded to about one kilometre and the identifier of our application. MET Norway does not receive your IP address or any other information about you.
- Basis: contract (showing the map and route) and legitimate interest in a working map.
3.7 Saved routes and preferences
When you are signed in, we store saved routes and your preferences (vehicle, stops, detour) in your account so you have them on all devices. Basis: contract.
3.8 Usage, limits and costs
We count how many routes you create per day and month, and for each creation we log time, type, AI model, duration and our cost. Purpose: applying the quotas of your plan and fair use, detecting abuse, keeping costs under control. Basis: contract and legitimate interest. For limits against abuse (for example when sign-in links are requested) we use counters linked to a hash of the IP address or the email address.
3.9 Feedback
If you rate a route ("Loved it" or "Not great") and optionally write a comment, we store this with the creation. Purpose: improving quality and giving the route back after "Not great". Basis: legitimate interest and contract.
3.10 Payments
Payments are handled by Stripe. You enter card and other payment details directly at Stripe, we never see them. Stripe sends us a customer ID and, where relevant, a subscription ID, the plan bought, amount, period and payment status. Stripe processes some payment data under its own responsibility, for example for fraud prevention and its own legal obligations. After each purchase we send you an order confirmation by email (via Resend). Basis: contract and legal obligation (keeping accounting records).
Invitations: if you sign up through another user's shared link, we note whose account the link came from, and whether and when your first purchase triggered the invitation reward. The inviter only sees the number of friends and free routes, never your name or email address. Until you sign in, the link ID stays in your browser only. Basis: contract (invitation reward, terms section 8). Deleted with your account.
3.11 Contact by email
If you write to us, we process your message and email address to reply. Basis: contract or legitimate interest.
3.12 Your own Gemini key (test mode only)
If you enter your own Gemini key in the settings, your browser sends your requests directly to Google. The terms you agreed with Google then apply. The key stays in your browser.
3.13 Shared routes
If you tap "Share" on a route, we store a copy of the route under a random link (/r/…). Anyone with the link sees the start, destination, the route with stops and notes, and the departure advice. Your name and email address are not on the page. Keep in mind: start and destination may be your home address, for example, if you entered it that way. We count how often the link is opened, but not by whom. The page is blocked for search engines. Basis: contract (you want to share the route). If you want a link removed, write to us; deleting your account removes all your links.
3.14 Anonymous counters
To see whether Scenicway works, we count per day and language how often certain things happen, for example "home page viewed", "app opened", "route started", "payment page shown", "purchase" or "opened in Google Maps". We store only the day, the event, the language and the number. No cookies, no identifier in the browser, no IP address, no link to you or your account. This does not allow anyone to identify a person. Basis: legitimate interest in a working service we can improve.
4. Recipients and processors
These service providers process data on our behalf and on our instructions:
- Cloudflare, Inc., USA: hosting, server functions, database (Cloudflare D1, stored in the EU region), Turnstile bot protection.
- Google (Google Ireland Limited, Ireland, and Google LLC, USA): Gemini API for route planning including Grounding with Google Maps. When you sign in with Google, you are also a direct customer of Google.
- Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA): payments, subscriptions, customer portal.
- Resend (Plus Five Five, Inc., USA): sending sign-in emails and order confirmations.
- Geoapify (KEPTAGO LTD, Cyprus): place search, time zones and route calculation.
- MET Norway (Meteorologisk institutt, Norway): weather data.
- OpenFreeMap (openfreemap.org; operated by Zsolt Ero, a private individual, seat not stated; no cookies): map tiles that your browser loads directly (see 3.6).
When you open Google Maps through our link, you leave Scenicway. Google's privacy policy then applies to Google Maps.
5. Transfers outside the EU
Google, Stripe, Resend and Cloudflare are companies based in the USA or with a US parent company, so data may reach the USA. Geoapify (Cyprus) and MET Norway (Norway, a member of the European Economic Area) are based in the EEA. For the USA we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the company is certified under it, and additionally on the European Commission's standard contractual clauses (Art. 45 and Art. 46 (2) (c) GDPR).
6. How long we keep data
- Sign-in links: valid for 15 minutes; the entry (email address, IP address) is deleted one day after it expires.
- Sign-in session (cookie, hash, IP address, browser string): 30 days or until you sign out.
- Google sign-in, cookie
__Host-sw_oauth: 10 minutes. - Counters against abuse: at most two days.
- Cached results without personal reference: 10 days; identical place searches, routes and weather answers up to 30 days.
- Usage counters, cost logs and feedback: 12 months.
- Account data, saved routes, shared routes and preferences: until you delete your account.
- Anonymous daily counters: without limit, they contain no personal data.
- Payment and accounting records (held at Stripe and in our bookkeeping, not in the app database): 7 years (§ 132 of the Austrian Federal Fiscal Code, BAO), even if you delete your account earlier.
- Emails to us: until the request is settled, then at most 3 years unless we must keep them longer.
Deleting your account: you can delete your account yourself at any time in the app under "Account". We then immediately delete your account, sessions, saved and shared routes and usage counters. A running Pro subscription is ended. In the cost logs we remove the link to you and your comments. What we must keep for legal reasons (payments) stays stored until the period ends.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). Write to [email protected].
You can also lodge a complaint with a data protection supervisory authority. In Austria this is the Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40-42, 1030 Vienna, dsb.gv.at.
8. Do you have to provide data?
For the demo routes you need no account and provide no data. For your own routes and purchases we need your email address. Without it we cannot create an account.
9. No automated decisions
We make no automated decisions within the meaning of Art. 22 GDPR that have legal effects on you or similarly significantly affect you. The AI only suggests routes. Technical limits (for example fair use) at most slow things down temporarily when usage looks unusual. If you think this happened wrongly, write to us.
10. Security
All connections are encrypted (HTTPS). We only store sign-in links and sessions as hashes.
11. Changes
If the service or the service providers change, we update this policy. The version on this page applies.