MyWayNoHighway® — Privacy policy

The controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR) is:

W.R.D. | finest arts at Open Minded Professionals
Person responsible for data protection / authorised representative: Werner R. Dibl
Address: Weppach 25, A-6850 Dornbirn, Austria (EU)
Privacy and contact page (German): open-minded.pro/app-pages/mywaynohighway/de/privacy/
Privacy and contact page (other languages): open-minded.pro/app-pages/mywaynohighway/privacy/
Contact is made via the contact form provided on the privacy and contact page above, as well as via the support channels linked from the App Store product page. Postal contact is additionally possible via the address above. A public email address is deliberately not provided in order to avoid spam and automated address harvesting; the contact form and the postal address ensure a direct and effective means of communication.

The privacy notices of the website apply additionally to the contact form and the website. When you use the contact form, the information you enter, as well as technical connection data (in particular IP address and time), is processed via the website's infrastructure; transmission is encrypted via HTTPS. Further details, including information on server log files and hosting, are contained in the website's privacy policy.

A data protection officer has not been appointed because the conditions of Article 37(1) GDPR are not met given the scope of processing. Please direct data protection enquiries via the contact channels stated above (contact form or postal address).

"We", "us" and "MyWay" in this policy refer to the controller named above and the app MyWayNoHighway.

This policy describes the processing of personal data during installation and use of the iOS/iPadOS app MyWayNoHighway, including its widget extension. It does not automatically apply to third-party websites or apps that users open themselves via a link or an Apple system dialog.

We follow a local, data-minimising architecture:

• Rides, profiles, settings, places and routes are, in principle, stored on the device.
• There is no MyWay user account, no MyWay-operated server, and no synchronisation via Supabase or CloudKit.
• The widget extension makes no network calls and no location requests.
• No advertising, tracking or analytics SDKs are used.
• External services are used only for clearly named functions. Where technically implemented, the user decides whether they are invoked.

"Local" means that MyWay does not transmit the data to its own backend service. Operating-system functions, device backups, Apple services and third-party apps chosen by the user may nevertheless process data independently; further details follow below.

Depending on the function, we base the processing in particular on:

• Article 6(1)(b) GDPR (performance of a contract or pre-contractual measures), where the processing is necessary to provide an expressly requested app function;
• Article 6(1)(a) GDPR (consent), in particular for optional location functions and the deliberate enabling of external route calculation;
• Article 6(1)(f) GDPR (legitimate interests), where a technically secure, abuse-free and stable provision is necessary and no overriding interests of data subjects prevail;
• Article 6(1)(c) GDPR, where legal obligations exist, such as tax or consumer-law retention obligations.

The app is provided on the basis of the App Store usage agreement (end-user licence agreement). Processing necessary to deliver the app functions actively used by the user is therefore based on Article 6(1)(b) GDPR. Optional functions with increased data relevance that must be activated separately — precise location access and external route calculation — are based on your consent under Article 6(1)(a) GDPR. We rely on legitimate interests under Article 6(1)(f) GDPR exclusively for the technical security, abuse prevention and stable provision of the app.

Consent can be withdrawn at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected. Regarding your right to object to processing based on legitimate interests, see the separately highlighted notice in Section 22.

4.1 App settings and display data

The app stores locally, among other things, language, theme, light/dark mode, map and route preferences, and interface states. The purpose is the configuration chosen by the user. The legal basis is Article 6(1)(b) GDPR. The data remain stored until they are changed, the app is deleted, or the app data are deleted.

4.2 User and bicycle profile

Voluntarily entered information may include name, notes, bicycle type, bicycle identifier, bicycle notes, experience level, weight, route purpose and further planning preferences. Free-text fields may also contain content that we neither request nor control. Please do not enter unnecessary sensitive data about yourself or third parties there.

These data serve personalisation, statistics and calorie calculation, and route planning. They are stored locally. Information such as weight or calorie values derived from it is used exclusively locally and solely for in-app calculation; processing as a special category of personal data for health or diagnostic purposes within the meaning of Article 9 GDPR does not take place. The legal basis is Article 6(1)(b) GDPR; for voluntary additional information, additionally Article 6(1)(a) GDPR.

4.3 Saved places and home location

The address, label, notes, category and geographic coordinates of saved places may be stored locally. This may allow conclusions to be drawn about place of residence, habits or regularly visited locations. Storage takes place only for the use in the app desired by the user. The legal basis is Article 6(1)(b) GDPR.

4.4 Rides, tracks and statistics

Where tracking is confirmed, the app processes in particular timestamps, route coordinates, distance, duration, elevation values, speed, average speed, elevation gain and statistics values derived from them. The ride data are stored locally in the app database. Recording begins only after a deliberate confirmation in the app. Starting navigation does not activate tracking automatically.

The purpose is the recording, display, analysis and user-initiated export of a ride. The legal basis is Article 6(1)(b) GDPR. Access to the device location requires the location permission granted via the iOS system dialog and is based on your consent under Article 6(1)(a) GDPR.

4.5 Route drafts and imported files

Waypoints, route segments and imported GPX or MyWay files are processed locally. On import, the user determines the file. Contents may include location and time data. As long as no external route calculation is enabled and triggered, the editing remains within MyWay on the device.

MyWay uses Apple Core Location for location centring, ride recording, navigation, weather at the current location and the local SOS location sharing. iOS asks for the location permission via a system dialog. This system permission is the technical prerequisite for location access; the data-protection basis for the respective processing follows from the legal bases stated in this policy (Article 6(1)(a) or (b) GDPR depending on the function). The permission can be changed or withdrawn under Settings > Privacy & Security > Location Services > MyWayNoHighway.

Without location permission, functions that do not require a current location remain usable. Depending on app state, weather may be loaded for the visible map section or a technical fallback location; before transmission to WeatherKit, this position is always rounded to approximately 0.01 degrees. A precise location is not sent to WeatherKit for this purpose.

MyWay does not use location data for advertising, profiling or cross-app tracking.

The app exclusively uses Apple MapKit as its native map component. It does not load map tiles from OpenStreetMap, CyclOSM or a proprietary server. Users can choose the Apple Standard or Hybrid presentation and the Flat (default) or Realistic terrain mode. This choice only changes Apple’s map presentation and does not activate another provider.

When maps are loaded or used, Apple or map service providers engaged by Apple may process technical connection data, device information, the visible map area and—depending on permission and function—location information. MyWay operates no map server and receives no Apple server logs. The purpose is the map display requested by the user; the legal basis is Article 6(1)(b) GDPR and, when the current location is used, the consent granted through iOS under Article 6(1)(a) GDPR. See Apple Privacy.

When a search is deliberately initiated, the app sends the entered search term through Apple’s `MKLocalSearch`, together with customary technical connection information, to Apple. Search terms may contain personal data; therefore do not enter unnecessary information. No data is sent to Nominatim or the OpenStreetMap Foundation. The purpose is to convert text into a map location; the legal basis is Article 6(1)(b) GDPR. Apple’s privacy terms also apply.

Weather is loaded exclusively in the main app through Apple WeatherKit. Before each request, MyWay rounds latitude and longitude to approximately 0.01 degrees (roughly one kilometre depending on latitude), limiting spatial precision to what is needed for weather. This rounded position, technical request parameters and customary connection data are transmitted to Apple. Apple may engage its own weather data providers; sources and legal notices are available through the Apple Weather attribution displayed in the weather view.

The data is used only for current and hourly weather, local safety notices and—where available—official weather alerts. Results are cached only briefly in memory or local app state, are normally refreshed no sooner than after 20 minutes or a significant location change, and are not used for advertising, profiling or cross-app tracking. MyWay operates no server for this purpose. The legal basis is Article 6(1)(b) GDPR and, when the current location is used, consent through iOS under Article 6(1)(a) GDPR.

The widget extension does not load weather, transmit coordinates or include weather data in its snapshot. Its weather button only opens the main app. Weather information and alerts are aids and do not replace official warning channels or the user’s own safety assessment. See Apple Weather and Apple Privacy.

External route calculation is not enabled by default. Only when the user deliberately activates the setting "Enable external route calculation", stores an API key and triggers a calculation does the app transmit the set start, intermediate and destination points (waypoint coordinates), the chosen route profile and technical request data to the openrouteservice API of HeiGIT gGmbH (Germany). At the provider, the IP address, timestamp and further server log data are also incurred.

The enabling can be withdrawn at any time in the API/routing setting. Without enabling, no ORS network request takes place; local straight-line planning, including the local round trip described in Section 9.1, remains possible. The local round trip does not use the ORS interface.

The purpose is the calculation of a rideable route carried out on request. The legal basis is Article 6(1)(a) GDPR. Provider information: HeiGIT/openrouteservice Transparency Statement and HeiGIT Privacy Policy.

The personal ORS API key is stored in the device's Apple Keychain and is not transferred to the widget data store.

The in-app setup path is Gear → Data & Subscription → External routing (ORS). The `info.circle` there explains every step. The user creates a personal account through the linked HeiGIT Account, confirms the activation email if needed, opens the `API Key` section and uses `Copy` for the automatically provided `Basic Key`. No custom key name is required. New keys may technically start with `eyJ`. Quotas and terms follow the user’s personal ORS account and are shown there in the `Plans` section.

The key is stored only in the iOS Keychain on this device with the accessibility level “this device only, when unlocked”, is never displayed again in plain text, and is excluded from `.myway` files, all other exports, the widget and screenshots. The separate approval can only be enabled after a key has been stored. Removing the key automatically withdraws that approval.

9.1 Purely local round trip

The "Local round trip" function generates a closed straight-line route from the current starting point, a deliberately chosen distance and geometrically calculated waypoints. Calculation and storage take place exclusively in the local app storage; neither waypoints nor result are transmitted to ORS or any other server for this purpose. The local round trip is unaware of roads, closures, gradients or actual rideability. It is therefore a planning draft that must be checked on the map and in the real environment before use. The legal basis of the local processing is Article 6(1)(b) GDPR.

The MyWay statistics widget shows exclusively locally calculated, minimised aggregate values. For this, the main app writes into a shared store protected by Apple App Groups only:

• distance of the current week and total distance,
• number of rides and current ride streak,
• distance and date of the last ride,
• update time as well as theme and display identifier,
• internal schema version.

The widget snapshot expressly contains no coordinates, tracks, waypoints, addresses, names, profile notes, API keys or weather data. The widget extension uses neither URLSession nor Core Location, Supabase, CloudKit, widget push or a server of its own. Its timeline provider reads only the local snapshot. The timeline is updated by the main app after a local change.

Statistics content is marked with Apple's `privacySensitive` designation. Whether and when iOS hides sensitive widget content on a locked device also depends on device settings and operating-system behaviour. Users should choose the display preview appropriately in the iOS notification/lock-screen settings.

The widget buttons use narrowly limited deep links. "Weather" opens the main app; only there can a weather retrieval take place. "Ride" opens the main app and shows the tracking confirmation before a recording begins.

The legal basis of the local processing is Article 6(1)(b) GDPR.

MyWay operates no emergency-call server and does not send any emergency call automatically. Before use, the name and telephone number of an emergency contact as well as the emergency number valid at the location — for example 112 in Europe — must be deliberately entered manually in the user profile and stored locally. The emergency function remains locked until all fields are plausibly filled in and the separate activation switch has been turned on. MyWay checks neither the identity nor the reachability or regional validity of the numbers.

The SOS view offers exclusively local handovers to Apple system functions:

• Before a call to the manually stored emergency number or to the emergency contact, a confirmation appears; the Apple telephone function is then opened.
• When sharing, MyWay locally generates a text with the emergency contact and the last available location. Only in the Apple share dialog does the user themselves choose a recipient and an app.

The chosen telephone, messaging or third-party app processes the data on its own responsibility or according to its terms. MyWay receives no delivery confirmation and keeps no emergency account. The function is not a certified emergency-call system and replaces neither Apple's built-in emergency functions nor a direct emergency call.

The legal basis of the local preparation is Article 6(1)(b) GDPR; the specific transmission is initiated by the user themselves. In life-threatening situations, Article 6(1)(d) GDPR and Article 9(2)(c) GDPR may additionally apply.

GPX, route, ride and migration files are generated or read locally. When "Share" is selected, MyWay hands the file to Apple's share dialog. Only the target app or person chosen there receives the content. Export files may contain precise coordinates, timestamps and movement profiles. Check the recipient and target app carefully.

For exports initiated by users, Article 6(1)(b) GDPR is the legal basis. After handover, the privacy terms of the chosen target app additionally apply. Temporary export files may remain in the temporary app directory until cleaned up by iOS or the app.

The user interface indicates a planned App Store subscription. As long as StoreKit is not connected in production and no purchase is offered, MyWay itself does not process any payment or purchase data. After activation, purchase, payment processing, receipt, subscription status and restoration are handled via Apple StoreKit or the App Store. Payment data are not transmitted to MyWay; however, MyWay may receive a transaction or entitlement status required for unlocking the function.

The legal basis is Article 6(1)(b) GDPR; a legally required retention under Article 6(1)(c) GDPR exists only where MyWay itself holds transaction or receipt data subject to retention obligations. Information: Apple App Store and Privacy.

MyWay contains no advertising networks, no analytics SDKs, no data-broker integration and no tracking in the sense of a linkage with data of other companies for targeted advertising or advertising measurement. The app therefore does not request App Tracking Transparency authorisation. Functional GPS tracking of a ride is to be distinguished conceptually from this and begins only after deliberate confirmation.

Depending on the function chosen or invoked, recipients may be the following bodies:

Internet services may process requests via infrastructure in states outside the European Economic Area or make them accessible from there. Where necessary, transfers take place on the basis of an adequacy decision under Article 45 GDPR, appropriate safeguards under Article 46 GDPR (such as standard contractual clauses, a copy of which can be requested via the contact address stated in Section 1), or a derogation under Article 49 GDPR.

Locally stored data are deleted as soon as you delete them in the app or uninstall the app. In detail, locally stored profile, place, route and ride data remain, in principle, until they are deleted in the app, overwritten on an import, the app data are removed by iOS, or the app is deleted. Withdrawing a permission does not automatically delete data already stored locally.

The widget snapshot is overwritten on changes; it contains only the respective current condensed state. Removing the app including the widget or the App Group deletes the associated local data as governed by iOS.

External providers determine their server and log retention according to their respective terms. In so far as we operate no servers of our own and control no provider logs, local deletion actions cannot directly delete these third-party logs.

How to delete your data:

• delete individual rides and saved places in the app;
• remove the API key and deactivate external routing enablement;
• withdraw the location permission in iOS;
• remove complete local data by deleting the app, unless iOS restores separately retained backups;
• delete exported files separately in "Files", target apps and backups.

Even without CloudKit synchronisation, iOS may include local app data in a device or iCloud backup, provided Apple and the device settings so provide. This processing takes place within the framework of the Apple account used by the user. Backups may restore data after a reinstallation. Backup settings can be managed in the iOS/Apple ID settings.

We employ appropriate technical and organisational measures. These include local storage in the app sandbox area, Apple Data Protection, storage of the ORS key in the Keychain, a minimised App Group structure, strictly permitted deep-link targets and the absence of a backend of our own. Network communication takes place via HTTPS.

No system is absolutely secure. In particular, an unlocked, compromised or shared device, as well as unencrypted exports, can impair protective measures. Users should use device locking, current operating-system versions and secure sharing channels.

There is in principle no legal obligation to provide personal data. Without certain data, permissions or a network connection, however, the associated functions cannot work or can work only in a limited way: without location no live tracking, without network no current Apple map or WeatherKit content, and without ORS enablement and an API key no external route calculation. Flat and Realistic are display modes of the same Apple map service and do not activate another provider. The more data-intensive additional services (precise location, external route calculation) remain voluntary independently of this.

No solely automated decision with legal or similarly significant effect within the meaning of Article 22 GDPR takes place. Route, weather, distance and statistics calculations serve exclusively the app function and are not binding safety, health or traffic decisions.

The app is not specifically directed at children. Location and movement data of minors are particularly worthy of protection. In so far as processing within the framework of a service of the information society directed directly at children is based on consent, this is effective under Austrian law (§ 4(4) DSG) only from the completed 14th year of age; before that, the consent of the person holding parental responsibility is required. In other countries of publication, differing age limits (between 13 and 16 years under Article 8 GDPR) may apply.

Data subjects have — depending on the statutory conditions — in particular the right to:

• access under Article 15 GDPR,
• rectification under Article 16 GDPR,
• erasure under Article 17 GDPR,
• restriction of processing under Article 18 GDPR,
• data portability under Article 20 GDPR,
• object under Article 21 GDPR,
• withdraw consent given, with effect for the future,
• lodge a complaint with a data protection supervisory authority under Article 77 GDPR.

> Separate right to object (Article 21 GDPR): In so far as we base processing on our legitimate interest (Article 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to such processing. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests.

Because most data are stored exclusively locally and without a MyWay account, we regularly can neither attribute them to a person nor view or delete them server-side. To that extent, the rights can be exercised directly via the local deletion, export and permission options. For matters going beyond this, please use the contact form on the privacy and contact page of MyWayNoHighway or the address stated in Section 1. To avoid unauthorised disclosure, we may require appropriate proof of identity.

Competent Austrian supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna, Austria
Email: dsb@dsb.gv.at
Information on complaints

Notwithstanding this, a complaint may in principle also be lodged with another supervisory authority competent under Article 77 GDPR.

We update this policy when functions, providers, the legal situation or data processing change. Material changes are announced in a suitable form. The respective valid version is available in the app and via the publicly accessible privacy URL stated in the App Store.

Please direct questions about data protection and the exercise of data subject rights to:

W.R.D. | finest arts at Open Minded Professionals
Person responsible for data protection: Werner R. Dibl, Weppach 25, A-6850 Dornbirn, Austria (EU)
Contact: contact form on the privacy and contact page below (no public email address for spam-protection reasons)
German: Privacy and contact page MyWayNoHighway
Other languages: Privacy and contact page MyWayNoHighway
The support channels indicated there lead to the provider's contact option on the App Store product page.

---

*Translation of the authoritative German version. In case of doubt, the German version prevails.*

*©2026 by Werner Dibl & the agency® of W.R.D. | finest arts @ Open Minded Professionals * All Rights reserved and held by the developers *