PedalArrow
EN App laden

Rechtliche Informationen

Datenschutz

· Version 4.00

Hier erfahren Sie transparent, welche Daten PedalArrow auf Android und iOS bei der Nutzung einzelner Funktionen verarbeitet, welche externen Dienste angesprochen werden und welche Rechte Sie haben.

English version

Datenschutzerklärung

05

Lokale Speicherung, Sicherheit und Löschung

Auf Android liegen Favoriten, bewusst gespeicherte Strecken sowie Termin-, Detail-, Ergänzungs- und Übersetzungscaches im privaten, von Backup und Geräteübertragung ausgeschlossenen App-Speicher. Sie sind mit getrennten, nicht exportierbaren Android-Keystore-Schlüsseln per AES-256-GCM verschlüsselt. Auf iOS werden die entsprechenden Inhalte authentifiziert mit AES-256-GCM verschlüsselt. Die Schlüssel liegen nicht synchronisierbar und gerätegebunden mit „When unlocked, this device only“ im Apple-Keychain; die Dateien verwenden vollständigen iOS-Datenschutz und sind von Backups ausgeschlossen. Das Übertragungsjournal für verbundene Gesundheits-Apps wird ebenfalls lokal geschützt gespeichert. Karten- und Bildcaches sowie kurzlebige Exportdateien sind privat; diese Aussage bedeutet nicht, dass alle Cachearten dieselbe Verschlüsselung verwenden.

GPX-Dateien werden über die Systemdateiauswahl eingelesen und nicht automatisch hochgeladen. Import, lokale Vorschau und reine Sortier- oder Löschaktionen an Wegpunkten bleiben auf dem Gerät. Beim Bearbeiten eines Adressfelds kann dessen Text an den Adressdienst gehen; erst eine bewusst gestartete Neuberechnung überträgt die benötigte Stoppliste an die genannten Adress- und Routingdienste. Dafür wird nicht die gesamte importierte GPX-Datei hochgeladen. Bewusst exportierte Dateien liegen außerhalb des privaten App-Speichers; ihr lesbarer Dateiname kann Datum sowie Start- und Zielbezeichnungen enthalten.

Such-, Routen- und Ergebnisdaten ohne ausdrückliche Speicheraktion bleiben grundsätzlich auf die App-Sitzung begrenzt. Gespeicherte Favoriten, Strecken und Übertragungsstände bleiben bis zur Löschung erhalten; fachliche Caches werden begrenzt, bei Aktualisierung ersetzt oder nach Ablauf verworfen. Übersetzungen werden nur bei übereinstimmendem deutschen Quelltext und passenden Textschutzregeln wiederverwendet. Übersetzungen und Sprachmodell können in den Einstellungen gelöscht werden; danach ist der automatische Neuabruf pausiert. Ein ausdrücklich freigegebener Offline-Kartenkorridor ist räumlich begrenzt. iOS entfernt Offline-Gebiete und Offline-Korridore nach 30 Tagen; Android behält vollständige Offline-Karten, bis die Karte oder alle lokalen App-Daten gelöscht werden. Ab Version 3.40 lassen sich auch ganze Regierungsbezirke offline speichern; sie bleiben auf beiden Plattformen, bis sie einzeln oder mit allen lokalen App-Daten gelöscht werden. Die genannten Standardkarten werden nicht pauschal für ein Offline-Vorabladen verwendet.

Die zentrale Funktion zum Löschen lokaler App-Daten entfernt lokale Favoriten, Strecken, fachliche Caches und temporäre Übergabedateien und beendet zuvor aktive Aufzeichnung, Wiedergabe und Sprachausgabe. Sie sperrt weitere Übertragung an verbundene Gesundheits-Apps. Bereits an Health Connect oder Apple Health übergebene Datensätze, exportierte Dateien, Cloud-Kopien und technische Protokolle externer Anbieter werden dadurch nicht rückwirkend gelöscht. Verwalten oder löschen Sie diese Inhalte beim jeweiligen Empfänger. Das Trennen einer Gesundheits-App entzieht nicht automatisch deren Systemberechtigungen. Eine Deinstallation entfernt den privaten App-Speicher; ein eventuell verbliebener Keychain-Eintrag enthält für sich allein keinen lesbaren App-Datenbestand.

Android blockiert reguläre Bildschirmaufnahmen und nicht systemeigene Overlays. Auf iOS werden Screenshots, Bildschirmaufnahmen, Spiegelung und App-Umschalter-Vorschauen nicht durch die App blockiert und können sichtbare Inhalte enthalten.

06

Rechtsgrundlagen

Die Verarbeitung erfolgt je nach Funktion zur Bereitstellung der ausdrücklich angeforderten Leistung auf Art. 6 Abs. 1 Buchst. b DSGVO, zur sicheren, sparsamen und funktionsfähigen Bereitstellung und Missbrauchsabwehr auf Art. 6 Abs. 1 Buchst. f DSGVO und, soweit erforderlich, zur Erfüllung gesetzlicher Pflichten auf Art. 6 Abs. 1 Buchst. c DSGVO. Berechtigte Interessen sind insbesondere IT-Sicherheit, Fehlerbegrenzung und ein ressourcenschonender Betrieb. Es findet keine ausschließlich automatisierte Entscheidung mit rechtlicher oder ähnlich erheblicher Wirkung statt.

Die freiwillige Übertragung von Fahrten an Health Connect oder Apple Health setzt Ihre ausdrückliche Einwilligung voraus. Rechtsgrundlagen sind Art. 6 Abs. 1 Buchst. a DSGVO und, soweit Gesundheitsdaten betroffen sind, Art. 9 Abs. 2 Buchst. a DSGVO. Sie können die Übertragung in den Einstellungen ausschalten, die Verbindung trennen und die Systemberechtigungen im Gesundheitsspeicher entziehen. Die Nutzung der übrigen App ist nicht von dieser Freigabe abhängig. Ein Widerruf wirkt für die Zukunft und berührt die Rechtmäßigkeit einer zuvor auf Einwilligung gestützten Verarbeitung nicht.

07

Empfänger und Drittländer

Die jeweiligen Betreiber der oben genannten Dienste erhalten die Daten direkt vom Gerät und können Verbindungsdaten nach ihren eigenen Bedingungen protokollieren. PedalArrow wählt Dienste für einen europäischen Betriebskontext aus. Eine Verarbeitung außerhalb des EWR durch Anbieter, technische Dienstleister oder Content-Delivery-Netze kann dennoch nicht pauschal ausgeschlossen werden. Soweit dies geschieht, gelten die vom jeweiligen Anbieter ausgewiesenen Garantien nach Art. 44 ff. DSGVO, etwa ein Angemessenheitsbeschluss einschließlich EU-US Data Privacy Framework oder EU-Standardvertragsklauseln. Maßgeblich sind Anbieter und Auslieferungsweg im Zeitpunkt des Abrufs.

Auftragsverarbeiter. Für eigene Dienste setzt PedalArrow Auftragsverarbeiter nach Art. 28 DSGVO ein: die Hetzner Online GmbH, Gunzenhausen, für die Server von live.pedalarrow.com (Gruppenfahrten, Offline-Karten, Termindienst, Ortsdienst, Begriffshilfe) und routing.pedalarrow.com (Fahrradrouting, ab Version 3.50 auch die PedalArrow-Fahrplanauskunft) in Nürnberg; ALL-INKL.COM – Neue Medien Münnich, Friedersdorf, für Website und E-Mail; Cloudflare, Inc., San Francisco (USA), als Schutzdienst vor diesen Servern und der Website.

Cloudflare wehrt Überlastungsangriffe ab, beendet dazu die verschlüsselte Verbindung und leitet die Anfrage erneut verschlüsselt weiter. Dabei verarbeitet Cloudflare IP-Adresse, Verbindungsdaten und die übertragenen Inhalte, bei Gruppenfahrten also auch Einladungs- und Mitgliedskennungen, bei Offline-Karten das gewählte Gebiet, beim Termindienst die angefragte öffentliche Termindatei, das Terminbild oder den MunichWays-Datensatz, beim Ortsdienst Kategorie und Rasterfelder der angefragten Ortsliste und beim Routing Start, Ziel, Wegpunkte und Routenoptionen sowie beim eigenen ÖPNV-Dienst Suchtext, Start, Ziel und Reisezeit. Zur Abwehr von Angriffen protokolliert Cloudflare im Auftrag von PedalArrow IP-Adresse, Zeitpunkt, aufgerufene Adresse und App- oder Browserkennung blockierter Anfragen und einer Stichprobe weiterer Anfragen. Beim Fahrradrouting und beim eigenen ÖPNV-Dienst auf routing.pedalarrow.com enthält die aufgerufene Adresse weder Start, Ziel, Wegpunkte noch Suchtext; diese werden nur im Inhalt der Anfrage übertragen, den Cloudflare nicht protokolliert. Die Verarbeitung erfolgt auf Grundlage des Cloudflare-Auftragsverarbeitungsvertrags und kann in Rechenzentren außerhalb der EU stattfinden. Cloudflare ist nach dem EU-US Data Privacy Framework zertifiziert; zusätzlich gelten die EU-Standardvertragsklauseln des Auftragsverarbeitungsvertrags. Rechtsgrundlage ist Art. 6 Abs. 1 Buchst. f DSGVO (Sicherheit und Verfügbarkeit der Dienste).

09

Änderungen

Diese Erklärung wird angepasst, wenn sich Funktionen, Empfänger oder Rechtslage ändern. Materielle Änderungen werden in der App über eine neue Version des Ersthinweises kenntlich gemacht.

01

Controller

Khashayar Nivipour
Pirmasenser Straße 8
81241 Munich
Germany

Email: info@PedalArrow.com
Website: https://www.PedalArrow.com/

No data protection officer has been appointed. PedalArrow is a privately developed, free and independent service. It is not an official or jointly published app of any named data or service provider.

02

Core principles

This policy applies to app version 4.00. Where earlier versions work differently, the entry names both cases: version 3.40 and later, and version 3.30 and earlier; for PedalArrow journey planning, version 3.50 and later, and version 3.40 and earlier.

PedalArrow requires no user account and uses no advertising ID. It operates no advertising, analytics, tracking, profiling or crash-reporting system of its own and no user-account, analytics or tracking server. Radio streams are started deliberately, are provided by the respective broadcaster and may contain broadcaster advertising. The English event view uses Google Translate with ML Kit on the device. Independently of the text that remains local, technical SDK data may be sent to Google; details are set out below.

An online fallback is available for twelve reviewed, non-personal cycling terms: only when on-device translation of an entire field fails does the app send its fixed term ID over HTTPS to live.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare). The server sends only the corresponding catalogue word and the German-to-English language direction to DeepL API. No free text, names, contact details, location, device data or user IP address is forwarded to DeepL. Hetzner and Cloudflare technically receive the user IP address, time and term ID; DeepL receives the term, operator account and server IP address. Connections are encrypted in transit, not end-to-end against these processors. The server reuses term results for 30 days without a user association; removing local translation data does not delete this shared cache. Selecting the German original or pausing translation prevents new term requests.

Events come from the published sources of ADFC, Landratsamt München, MünchenUnterwegs, MunichWays and Radentscheid München, from version 3.50 also of Critical Mass and VCD, from version 3.80 also of NaturFreunde, from version 4.00 also the city council and district committee sessions of the Landeshauptstadt München; from version 3.40 the app loads them only through the PedalArrow event service, version 3.30 and earlier primarily through it (section 03). Favourites, deliberately saved routes and functional caches are held locally on the device. Online features establish encrypted HTTPS connections to the listed services. Recipients technically receive at least the IP address and time, together with the inputs described for the feature used. A BayernInfo/Mobilithek adapter, if configured, supplies a fixed notice feed; it does not receive the route or location points for that request.

Acknowledging the initial disclosure is not consent under data-protection law. Permissions are requested for the relevant feature and can be withdrawn in system settings. Connecting Health Connect or Apple Health and automatically transferring rides are voluntary features activated separately.

03

Data flows by feature

Feature and recipient, Data and purpose, Trigger and retention in PedalArrow
Feature and recipientData and purposeTrigger and retention in PedalArrow
ADFC events and approved original imagesAllgemeiner Deutscher Fahrrad-Club e. V.; Allgemeiner Deutscher Fahrrad-Club Kreisverband München e. V.; api-touren-termine.adfc.de and approved original sources; some images via Microsoft Azure (adfcrtp.blob.core.windows.net)IP address, time, catalogue or detail request. The general catalogue request includes no location, route or search input. From version 3.40, catalogue, details and images come only from the PedalArrow event service (next entry); the portal and Microsoft Azure then receive no requests from the app and therefore no user IP address. Version 3.30 and earlier load catalogue and details primarily from the event service and directly from the portal only when the event service is unreachable or not current or does not hold the request (such as older event details); they load images directly from Microsoft Azure when shown, which receives the IP address, time and image address.After the initial disclosure is acknowledged, approximately every twelve hours under suitable network/battery conditions; encrypted private cache until refresh or central deletion.
Event service and further event sourcesPedalArrow event service on live.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare, see section 07); Landeshauptstadt München (risi.muenchen.de), Landratsamt München (muenchen.gremien.info), MünchenUnterwegs with its registration platform (veranstaltungen.muenchen.de), MunichWays, Radentscheid München, ADFC Munich bike coding (buchungen.adfc-muenchen.de), Critical Mass (criticalmass.in, criticalmass.de, criticalmass-muenchen.de), VCD (VCD Landesverband Bayern e. V., bayern.vcd.org), NaturFreunde (NaturFreunde Deutschlands e.V., naturfreunde.de)IP address, time and the requested public event file, and from version 3.40 also the requested ADFC event image. The event service itself fetches the public catalogues and bike-coding dates of Landratsamt München, MünchenUnterwegs, MunichWays, Radentscheid München and the ADFC and the public iCal calendar of the rides on the Mobilitätsreferat's registration platform every ten minutes and event details in turn at least hourly, and provides them unchanged. From version 3.50 it also checks the public Critical Mass (criticalmass.in, criticalmass.de, criticalmass-muenchen.de) and VCD (VCD Landesverband Bayern e. V., bayern.vcd.org) events itself about hourly. From version 3.80, the NaturFreunde Deutschlands e.V. (naturfreunde.de) events assigned to Bavaria are added, from version 4.00 the city council and district committee sessions of the Landeshauptstadt München KdöR from the two public session calendars of its council information system (risi.muenchen.de). It provides them as a list of their own with source pages and check time; the app uses this list for up to six and a half hours after the check. It fetches ADFC event images once from the portal's image storage at Microsoft Azure and keeps them until no event has referred to them for seven days. It receives no search, location or route input; the sources only see its server's address. From version 3.40, the app no longer contacts any event source itself: when the event service is unreachable, older than 30 minutes or does not hold a request, that request fails and events already loaded stay visible. Version 3.30 and earlier send such a request directly to the respective source, still without location, route or search text; when the MünchenUnterwegs calendar does not name a ride's meeting point, they load the registration platform's iCal calendar directly.When events are loaded or refreshed, including the background refresh, when event details are opened and, from version 3.40, when ADFC event images are shown. The event service writes no access logs; its snapshots contain only public data from the sources named. Booking a coding appointment takes place on the ADFC Munich website.
On-device translation in the English appGoogle ML Kit / Google TranslateGerman event text from ADFC, Critical Mass, Landeshauptstadt München, Landratsamt München, MünchenUnterwegs, MunichWays, NaturFreunde, Radentscheid München and VCD is translated into English locally on the phone. Tour text and results are not uploaded to Google or PedalArrow/ALL-INKL for translation. Language-model delivery and technical SDK functions involve connection data. According to Google, ML Kit may also process device and app information, installation identifiers, language configuration, technical events, error codes and performance data for diagnostics and usage analytics. Google data disclosures for Android and iOS.Automatically with the English app language and English event translation selected, after acknowledging the initial disclosure. The language model of about 30 MB is downloaded when needed, including over mobile data, without another download confirmation. Previously downloaded text can then be translated offline. Results remain encrypted in private app storage excluded from backups and are reused only for the matching German source text. Settings → Tour Details lets you select the German original. Deleting translations and the language model pauses further automatic downloads; it does not delete technical data already sent to Google.
Term fallbackPedalArrow / Hetzner / Cloudflare / DeepL APIOnly a fixed term ID to PedalArrow; technically IP address and time at Hetzner/Cloudflare. Only catalogue word and language direction to DeepL; operator account and server IP there, no user IP or free text.Only after local failure of an entire field matching one of the twelve terms. Selecting the German original or pausing translation prevents new requests. Server cache: 30-day reuse without user association.
Primary Android/iOS mapBavarian Surveying Administration / BayernWolkeIP address, time, visible map region and zoom level, plus derived style, font and vector-tile requests for Webkarte Vektor Bayern – Radln.When the primary map is displayed; private MapLibre cache and no offline preloading. Only one map source is active at a time. Switching sources removes the previous map view so it cannot keep loading invisibly. The meeting-point map does not require device location for this.
Alternative Android mapOpenStreetMap tile serviceIP address, time, visible tile coordinates and zoom level to display the map.When the map is shown; limited private cache. The standard service is not used for offline preloading.
Alternative Android/iOS mapOpenFreeMapIP address, time, visible map region and zoom level, plus derived style, font and vector-tile requests.Only while OpenFreeMap is visibly selected or activated after bounded map failures, or while the route, the ridden track, a marker or your location lies outside the coverage of Webkarte Vektor Bayern – Radln; private MapLibre cache and no offline preloading. The previous map is removed and does not keep loading in the background.
Alternative iOS mapApple MapKitTechnically necessary connection data, time and the visible map region to render the base map. PedalArrow neither requests nor uses device location for this meeting-point view.When the user deliberately opens the map section; processing and any retention by Apple follow Apple's applicable terms.
Official cycle network map layerBavarian Surveying Administration (geoservices.bayern.de, WMS “Freizeitwege”)IP address, time and the coordinates and size of each visible map tile, to draw the official cycling and leisure route network over the map.Only while this map layer is shown; tiles are kept in a bounded private image cache.
Offline mapsPedalArrow map service on live.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare, see section 07)IP address, time and retrieval of the map style, fonts and map tiles of the explicitly selected area or route corridor. The selected area can be inferred from the tiles requested.Only after an offline area or corridor has been explicitly approved; geographically limited. The maps are stored in private app storage. iOS removes offline areas and offline corridors after 30 days; Android keeps complete offline maps until the map or all local app data is deleted. From version 3.40, whole administrative districts can also be saved offline; on both platforms they remain until they are deleted individually or together with all local app data. The map service writes no access logs.
Address searchPhoton; explicit Nominatim on Android and iOSIP address, time, search text or address for geocoding. Entered coordinates are recognised locally.Photon after search input and, if Nominatim is unavailable, for the explicit full lookup; Nominatim only after an explicit full lookup and no more than once per second. Transient processing and short in-memory caching.
Bike routing and elevationPedalArrow routing service (Valhalla) on routing.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare, see section 07); BRouter (brouter.de) and OSRM/FOSSGIS only as fallbacksIP address, time, origin, destination, ordered waypoints and route options for planning, round trips and requested alternatives. PedalArrow’s own Valhalla service is attempted first; temporarily blocked services are skipped. BRouter and OSRM follow sequentially when needed, according to availability. For additional route attributes, only geometry previously calculated by Valhalla is sent back to its attribute service on the same host. Limited rerouting sends the current GPS point and remaining destinations.Deliberately initiated planning or navigation. The same routing request is not sent to all services in parallel. Automatic rerouting requires confirmed deviation and has a limited retry budget. A replacement is adopted only after local validation; permanent storage requires an explicit save action.
Official roadworks, closures and restrictionsBayernInfo/Mobilithek adapter; Munich GeoPortal WFSA configured BayernInfo/Mobilithek adapter receives the IP address, time and a fixed feed request, but no route or GPS points. Before requesting Munich roadworks, the app checks locally whether the route touches or crosses the official Munich administrative boundary. Only then does the municipal WFS receive the IP address, time and a slightly expanded route bounding box clipped to the outer extent of that boundary. The full route, individual GPS points and search text are not transmitted for this request.After route planning; this source is not requested if no BayernInfo adapter is configured. No municipal roadworks request is made outside Munich coverage. Responses and matching remain in memory. Comparison with the 150-metre route corridor is local. Sources, failures and partial coverage are displayed; the response time does not establish completely current or geographically complete notices.
External fallback planningRadlland BayernAfter your selection, up to seven fully resolved waypoint coordinates and labels are handed to the external Radlland website. It also receives the IP address and time. That website calculates its own route; PedalArrow does not use an embedded Radlland routing service for this.Only after the user deliberately selects the Radlland action. Unresolved points or points outside the reviewed Bavarian handoff envelope are not transferred. Processing follows the terms of Radlland Bayern.
Public transport outside the MVVMoBY, Bayerische Eisenbahngesellschaft (bahnland-bayern.de)After you select “Open in MoBY” in the public transport planner, the origin and destination (coordinates with a label or the place name entered) and the requested departure or arrival time are handed to the external journey planner. It also receives the IP address and time. That website searches for journeys itself; PedalArrow queries no MoBY timetable data.Only after the user deliberately selects the MoBY action; the browser opens the external website. PedalArrow stores nothing for this. Processing follows the terms of Bayerische Eisenbahngesellschaft.
Alternative navigation assistantFerrostar Core locallyAlready confirmed route, mandatory stops and the same quality-checked GPS fixes as PedalArrow's assistant; no external recipient.Session-only in the app process during deliberately started navigation. Ferrostar rerouting and network access are disabled.
Regional route qualityMunichWays Happy Bike Level; from version 3.40 through the PedalArrow event service on live.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare, see section 07)IP address, time and retrieval of the complete Upper Bavaria dataset. The route, location and search text are not sent; matching is local. From version 3.40, the app loads the dataset only from the event service, which checks it at MunichWays for changes every ten minutes and provides it unchanged; MunichWays then receives no requests from the app and therefore no user IP address. Version 3.30 and earlier load it directly from MunichWays.Optional supplement after route planning; the base route stays usable if the supplement fails. The validated dataset is held in memory only, never in device storage. From version 3.40, it is valid for 24 hours from loading and is discarded afterwards even if a new request fails; the central deletion of local app data discards it immediately, and it also lapses when the app process ends. Version 3.30 and earlier keep it until the app process ends and reload it at the first route planning after 24 hours; if that fails, they keep using the previous one.
Nearby places and places along the routePedalArrow places service on live.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare, see section 07) with data from the Geofabrik GmbH OpenStreetMap extract of BavariaIP address, time and the requested place lists, that is the selected category and the grid squares of about 5.5 × 5.5 km that the search area or route touches. They reveal the location only to within a few kilometres; GPS point, search radius, route and ride points are not sent. The app calculates distances and matches on the device. The places service itself prepares the places once a day from the extract.From app version 3.40, first for every deliberately started nearby search and search along the route; version 3.30 and earlier ask Overpass directly. The places service writes no access logs; loaded place lists stay in memory only.
Nearby searchup to two approved Overpass instances (version 3.80 and earlier: three)Only when the places service is unreachable or not current or the search reaches beyond the area of Bavaria covered completely, and for every search in version 3.30 and earlier: IP address, time, one fresh precise GPS point per request, the selected category and a technical search radius of up to 5 km. The full route, GPX file and earlier ride points are not sent. If Overpass fails near the state border, the app shows the places service’s places on the Bavarian side with a note.A deliberately started nearby search activates a session-based live search. Follow-up queries may use the then-current location. Each approved endpoint is attempted at most once per query. Results are processed for the session and are not permanently stored as a search history.
Search along the routeup to two approved Overpass instances (version 3.80 and earlier: three)Only when the places service is unreachable or not current, or the route reaches beyond the area of Bavaria covered completely or is too long for the places service, and for every search in version 3.30 and earlier: IP address, time, a simplified line of the planned route with at most 120 points (rounded to four decimal places, about 11 m), the selected category and the width of the search corridor. GPS location, GPX file and recorded ride points are not sent for this.Only after tapping search along a planned route. The route line and results stay in memory and are not stored.
Official cycling infrastructureCity of Munich GeoPortalIP address, time, requested layer and customary app/connection identifiers. The GPS point, route and radius are not sent; filtering is local.First deliberate lookup in an app process; repeat periods of seven or 30 days. Validated in-memory replacement only.
WeatherOpen-Meteo forecast and historical weather APIsIP address, time, coordinate, travel period and weather parameters.With route or travel requests; bounded in-memory forecast and historical caches.
Public transportMünchner Verkehrs- und Tarifverbund GmbH (MVV), EFAIP address, time, search text, origin, destination, travel date, departure/arrival time and options.User-initiated lookup; short in-memory caches for suggestions and results. Source and retrieval time are displayed.
PedalArrow journey planning outside the MVVPedalArrow’s own service, routing.pedalarrow.com/transit (Hetzner, Nuremberg; via Cloudflare)Search text, selected origin and destination stops or coordinates, requested travel time, language, and technically the IP address and request time. The PedalArrow service calculates journeys from open timetable and map data (GTFS.DE/DELFI, OpenStreetMap). Individual searches are not forwarded to GTFS.DE or Transitous.From version 3.50: the origin search asks MVV and this service; this service calculates journeys that are clearly outside the MVV or that MVV reports as outside its area. If this service has no timetable for the travel day yet, the app asks MVV once for the same journey. Version 3.40 and earlier send no requests to this service. Suggestions and results remain in bounded session memory, cleared when the origin is removed. The own journey service does not log search text, coordinates or complete query URLs.
Bavaria RadioBayerischer Rundfunk and its current delivery network, including RNDfnkIP address, time, station playlist and stream request; no route or location points.Only after deliberate playback. On Android, a visible media foreground service continues playback while the app is minimised or the screen is locked, until pause/stop. No audio recordings or listening/title history are created. The broadcaster’s and delivery network’s terms also apply to the received stream.
External links, calendar, contacts, save/share and SOS coordinatesdestination app or document provider selected by the userOnly the deliberately transferred link, event, contact, GPX file or WGS-84 coordinates with GPS accuracy and UTC time. No address is resolved for SOS. A document provider may be cloud storage.Only through Android or iOS system dialogs. A private Android hand-off file is revoked and deleted after ten minutes; maintenance removes remnants after no more than one hour. The destination's policy then applies; PedalArrow cannot retrieve or erase a copy created there. SOS coordinate copying is available on Android 13 and newer only; the entry is marked sensitive and removed automatically by the system. Older Android releases retain the targeted share sheet. iOS assigns the local clipboard a two-minute expiration date.
Connected appsHealth Connect (Android) / Apple Health (iOS)The original GPS track with actual observation times, workout time, distance and speed calculated from recorded points of successfully saved cycling rides. Heart rate, cadence and power are included only when genuine timestamped measurements exist and write access is granted. Planned routes, pure GPX imports and older recordings without documented timestamps are not automatically transferred. PedalArrow requests write access; on iOS it checks only its own previously exported objects to prevent duplicates. Other health data is not imported. These health data are not used for advertising or analytics and are not sent to PedalArrow servers.Off initially. First connect the health store, grant system permissions and separately enable automatic transfer in Settings → Connected Apps. Suitable rides successfully saved afterwards are transferred; existing rides are not enrolled retrospectively. Original data and transfer status are encrypted in private app storage. Retries are limited; “Try again” is an explicit manual action. Switching off or disconnecting stops further transfer steps, although a write already accepted by the system may finish. Previously transferred data, deletion and synchronisation are managed in Health Connect or Apple Health. System permissions must be withdrawn there separately.

ADFC events and approved original images

Allgemeiner Deutscher Fahrrad-Club e. V.; Allgemeiner Deutscher Fahrrad-Club Kreisverband München e. V.; api-touren-termine.adfc.de and approved original sources; some images via Microsoft Azure (adfcrtp.blob.core.windows.net)

Data and purpose
IP address, time, catalogue or detail request. The general catalogue request includes no location, route or search input. From version 3.40, catalogue, details and images come only from the PedalArrow event service (next entry); the portal and Microsoft Azure then receive no requests from the app and therefore no user IP address. Version 3.30 and earlier load catalogue and details primarily from the event service and directly from the portal only when the event service is unreachable or not current or does not hold the request (such as older event details); they load images directly from Microsoft Azure when shown, which receives the IP address, time and image address.
Trigger and retention in PedalArrow
After the initial disclosure is acknowledged, approximately every twelve hours under suitable network/battery conditions; encrypted private cache until refresh or central deletion.

Event service and further event sources

PedalArrow event service on live.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare, see section 07); Landeshauptstadt München (risi.muenchen.de), Landratsamt München (muenchen.gremien.info), MünchenUnterwegs with its registration platform (veranstaltungen.muenchen.de), MunichWays, Radentscheid München, ADFC Munich bike coding (buchungen.adfc-muenchen.de), Critical Mass (criticalmass.in, criticalmass.de, criticalmass-muenchen.de), VCD (VCD Landesverband Bayern e. V., bayern.vcd.org), NaturFreunde (NaturFreunde Deutschlands e.V., naturfreunde.de)

Data and purpose
IP address, time and the requested public event file, and from version 3.40 also the requested ADFC event image. The event service itself fetches the public catalogues and bike-coding dates of Landratsamt München, MünchenUnterwegs, MunichWays, Radentscheid München and the ADFC and the public iCal calendar of the rides on the Mobilitätsreferat's registration platform every ten minutes and event details in turn at least hourly, and provides them unchanged. From version 3.50 it also checks the public Critical Mass (criticalmass.in, criticalmass.de, criticalmass-muenchen.de) and VCD (VCD Landesverband Bayern e. V., bayern.vcd.org) events itself about hourly. From version 3.80, the NaturFreunde Deutschlands e.V. (naturfreunde.de) events assigned to Bavaria are added, from version 4.00 the city council and district committee sessions of the Landeshauptstadt München KdöR from the two public session calendars of its council information system (risi.muenchen.de). It provides them as a list of their own with source pages and check time; the app uses this list for up to six and a half hours after the check. It fetches ADFC event images once from the portal's image storage at Microsoft Azure and keeps them until no event has referred to them for seven days. It receives no search, location or route input; the sources only see its server's address. From version 3.40, the app no longer contacts any event source itself: when the event service is unreachable, older than 30 minutes or does not hold a request, that request fails and events already loaded stay visible. Version 3.30 and earlier send such a request directly to the respective source, still without location, route or search text; when the MünchenUnterwegs calendar does not name a ride's meeting point, they load the registration platform's iCal calendar directly.
Trigger and retention in PedalArrow
When events are loaded or refreshed, including the background refresh, when event details are opened and, from version 3.40, when ADFC event images are shown. The event service writes no access logs; its snapshots contain only public data from the sources named. Booking a coding appointment takes place on the ADFC Munich website.

On-device translation in the English app

Google ML Kit / Google Translate

Data and purpose
German event text from ADFC, Critical Mass, Landeshauptstadt München, Landratsamt München, MünchenUnterwegs, MunichWays, NaturFreunde, Radentscheid München and VCD is translated into English locally on the phone. Tour text and results are not uploaded to Google or PedalArrow/ALL-INKL for translation. Language-model delivery and technical SDK functions involve connection data. According to Google, ML Kit may also process device and app information, installation identifiers, language configuration, technical events, error codes and performance data for diagnostics and usage analytics. Google data disclosures for Android and iOS.
Trigger and retention in PedalArrow
Automatically with the English app language and English event translation selected, after acknowledging the initial disclosure. The language model of about 30 MB is downloaded when needed, including over mobile data, without another download confirmation. Previously downloaded text can then be translated offline. Results remain encrypted in private app storage excluded from backups and are reused only for the matching German source text. Settings → Tour Details lets you select the German original. Deleting translations and the language model pauses further automatic downloads; it does not delete technical data already sent to Google.

Term fallback

PedalArrow / Hetzner / Cloudflare / DeepL API

Data and purpose
Only a fixed term ID to PedalArrow; technically IP address and time at Hetzner/Cloudflare. Only catalogue word and language direction to DeepL; operator account and server IP there, no user IP or free text.
Trigger and retention in PedalArrow
Only after local failure of an entire field matching one of the twelve terms. Selecting the German original or pausing translation prevents new requests. Server cache: 30-day reuse without user association.

Primary Android/iOS map

Bavarian Surveying Administration / BayernWolke

Data and purpose
IP address, time, visible map region and zoom level, plus derived style, font and vector-tile requests for Webkarte Vektor Bayern – Radln.
Trigger and retention in PedalArrow
When the primary map is displayed; private MapLibre cache and no offline preloading. Only one map source is active at a time. Switching sources removes the previous map view so it cannot keep loading invisibly. The meeting-point map does not require device location for this.

Alternative Android map

OpenStreetMap tile service

Data and purpose
IP address, time, visible tile coordinates and zoom level to display the map.
Trigger and retention in PedalArrow
When the map is shown; limited private cache. The standard service is not used for offline preloading.

Alternative Android/iOS map

OpenFreeMap

Data and purpose
IP address, time, visible map region and zoom level, plus derived style, font and vector-tile requests.
Trigger and retention in PedalArrow
Only while OpenFreeMap is visibly selected or activated after bounded map failures, or while the route, the ridden track, a marker or your location lies outside the coverage of Webkarte Vektor Bayern – Radln; private MapLibre cache and no offline preloading. The previous map is removed and does not keep loading in the background.

Alternative iOS map

Apple MapKit

Data and purpose
Technically necessary connection data, time and the visible map region to render the base map. PedalArrow neither requests nor uses device location for this meeting-point view.
Trigger and retention in PedalArrow
When the user deliberately opens the map section; processing and any retention by Apple follow Apple's applicable terms.

Official cycle network map layer

Bavarian Surveying Administration (geoservices.bayern.de, WMS “Freizeitwege”)

Data and purpose
IP address, time and the coordinates and size of each visible map tile, to draw the official cycling and leisure route network over the map.
Trigger and retention in PedalArrow
Only while this map layer is shown; tiles are kept in a bounded private image cache.

Offline maps

PedalArrow map service on live.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare, see section 07)

Data and purpose
IP address, time and retrieval of the map style, fonts and map tiles of the explicitly selected area or route corridor. The selected area can be inferred from the tiles requested.
Trigger and retention in PedalArrow
Only after an offline area or corridor has been explicitly approved; geographically limited. The maps are stored in private app storage. iOS removes offline areas and offline corridors after 30 days; Android keeps complete offline maps until the map or all local app data is deleted. From version 3.40, whole administrative districts can also be saved offline; on both platforms they remain until they are deleted individually or together with all local app data. The map service writes no access logs.

Address search

Photon; explicit Nominatim on Android and iOS

Data and purpose
IP address, time, search text or address for geocoding. Entered coordinates are recognised locally.
Trigger and retention in PedalArrow
Photon after search input and, if Nominatim is unavailable, for the explicit full lookup; Nominatim only after an explicit full lookup and no more than once per second. Transient processing and short in-memory caching.

Bike routing and elevation

PedalArrow routing service (Valhalla) on routing.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare, see section 07); BRouter (brouter.de) and OSRM/FOSSGIS only as fallbacks

Data and purpose
IP address, time, origin, destination, ordered waypoints and route options for planning, round trips and requested alternatives. PedalArrow’s own Valhalla service is attempted first; temporarily blocked services are skipped. BRouter and OSRM follow sequentially when needed, according to availability. For additional route attributes, only geometry previously calculated by Valhalla is sent back to its attribute service on the same host. Limited rerouting sends the current GPS point and remaining destinations.
Trigger and retention in PedalArrow
Deliberately initiated planning or navigation. The same routing request is not sent to all services in parallel. Automatic rerouting requires confirmed deviation and has a limited retry budget. A replacement is adopted only after local validation; permanent storage requires an explicit save action.

Official roadworks, closures and restrictions

BayernInfo/Mobilithek adapter; Munich GeoPortal WFS

Data and purpose
A configured BayernInfo/Mobilithek adapter receives the IP address, time and a fixed feed request, but no route or GPS points. Before requesting Munich roadworks, the app checks locally whether the route touches or crosses the official Munich administrative boundary. Only then does the municipal WFS receive the IP address, time and a slightly expanded route bounding box clipped to the outer extent of that boundary. The full route, individual GPS points and search text are not transmitted for this request.
Trigger and retention in PedalArrow
After route planning; this source is not requested if no BayernInfo adapter is configured. No municipal roadworks request is made outside Munich coverage. Responses and matching remain in memory. Comparison with the 150-metre route corridor is local. Sources, failures and partial coverage are displayed; the response time does not establish completely current or geographically complete notices.

External fallback planning

Radlland Bayern

Data and purpose
After your selection, up to seven fully resolved waypoint coordinates and labels are handed to the external Radlland website. It also receives the IP address and time. That website calculates its own route; PedalArrow does not use an embedded Radlland routing service for this.
Trigger and retention in PedalArrow
Only after the user deliberately selects the Radlland action. Unresolved points or points outside the reviewed Bavarian handoff envelope are not transferred. Processing follows the terms of Radlland Bayern.

Public transport outside the MVV

MoBY, Bayerische Eisenbahngesellschaft (bahnland-bayern.de)

Data and purpose
After you select “Open in MoBY” in the public transport planner, the origin and destination (coordinates with a label or the place name entered) and the requested departure or arrival time are handed to the external journey planner. It also receives the IP address and time. That website searches for journeys itself; PedalArrow queries no MoBY timetable data.
Trigger and retention in PedalArrow
Only after the user deliberately selects the MoBY action; the browser opens the external website. PedalArrow stores nothing for this. Processing follows the terms of Bayerische Eisenbahngesellschaft.

Alternative navigation assistant

Ferrostar Core locally

Data and purpose
Already confirmed route, mandatory stops and the same quality-checked GPS fixes as PedalArrow's assistant; no external recipient.
Trigger and retention in PedalArrow
Session-only in the app process during deliberately started navigation. Ferrostar rerouting and network access are disabled.

Regional route quality

MunichWays Happy Bike Level; from version 3.40 through the PedalArrow event service on live.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare, see section 07)

Data and purpose
IP address, time and retrieval of the complete Upper Bavaria dataset. The route, location and search text are not sent; matching is local. From version 3.40, the app loads the dataset only from the event service, which checks it at MunichWays for changes every ten minutes and provides it unchanged; MunichWays then receives no requests from the app and therefore no user IP address. Version 3.30 and earlier load it directly from MunichWays.
Trigger and retention in PedalArrow
Optional supplement after route planning; the base route stays usable if the supplement fails. The validated dataset is held in memory only, never in device storage. From version 3.40, it is valid for 24 hours from loading and is discarded afterwards even if a new request fails; the central deletion of local app data discards it immediately, and it also lapses when the app process ends. Version 3.30 and earlier keep it until the app process ends and reload it at the first route planning after 24 hours; if that fails, they keep using the previous one.

Nearby places and places along the route

PedalArrow places service on live.pedalarrow.com (Hetzner, Nuremberg; via Cloudflare, see section 07) with data from the Geofabrik GmbH OpenStreetMap extract of Bavaria

Data and purpose
IP address, time and the requested place lists, that is the selected category and the grid squares of about 5.5 × 5.5 km that the search area or route touches. They reveal the location only to within a few kilometres; GPS point, search radius, route and ride points are not sent. The app calculates distances and matches on the device. The places service itself prepares the places once a day from the extract.
Trigger and retention in PedalArrow
From app version 3.40, first for every deliberately started nearby search and search along the route; version 3.30 and earlier ask Overpass directly. The places service writes no access logs; loaded place lists stay in memory only.

Nearby search

up to two approved Overpass instances (version 3.80 and earlier: three)

Data and purpose
Only when the places service is unreachable or not current or the search reaches beyond the area of Bavaria covered completely, and for every search in version 3.30 and earlier: IP address, time, one fresh precise GPS point per request, the selected category and a technical search radius of up to 5 km. The full route, GPX file and earlier ride points are not sent. If Overpass fails near the state border, the app shows the places service’s places on the Bavarian side with a note.
Trigger and retention in PedalArrow
A deliberately started nearby search activates a session-based live search. Follow-up queries may use the then-current location. Each approved endpoint is attempted at most once per query. Results are processed for the session and are not permanently stored as a search history.

Search along the route

up to two approved Overpass instances (version 3.80 and earlier: three)

Data and purpose
Only when the places service is unreachable or not current, or the route reaches beyond the area of Bavaria covered completely or is too long for the places service, and for every search in version 3.30 and earlier: IP address, time, a simplified line of the planned route with at most 120 points (rounded to four decimal places, about 11 m), the selected category and the width of the search corridor. GPS location, GPX file and recorded ride points are not sent for this.
Trigger and retention in PedalArrow
Only after tapping search along a planned route. The route line and results stay in memory and are not stored.

Official cycling infrastructure

City of Munich GeoPortal

Data and purpose
IP address, time, requested layer and customary app/connection identifiers. The GPS point, route and radius are not sent; filtering is local.
Trigger and retention in PedalArrow
First deliberate lookup in an app process; repeat periods of seven or 30 days. Validated in-memory replacement only.

Weather

Open-Meteo forecast and historical weather APIs

Data and purpose
IP address, time, coordinate, travel period and weather parameters.
Trigger and retention in PedalArrow
With route or travel requests; bounded in-memory forecast and historical caches.

Public transport

Münchner Verkehrs- und Tarifverbund GmbH (MVV), EFA

Data and purpose
IP address, time, search text, origin, destination, travel date, departure/arrival time and options.
Trigger and retention in PedalArrow
User-initiated lookup; short in-memory caches for suggestions and results. Source and retrieval time are displayed.

PedalArrow journey planning outside the MVV

PedalArrow’s own service, routing.pedalarrow.com/transit (Hetzner, Nuremberg; via Cloudflare)

Data and purpose
Search text, selected origin and destination stops or coordinates, requested travel time, language, and technically the IP address and request time. The PedalArrow service calculates journeys from open timetable and map data (GTFS.DE/DELFI, OpenStreetMap). Individual searches are not forwarded to GTFS.DE or Transitous.
Trigger and retention in PedalArrow
From version 3.50: the origin search asks MVV and this service; this service calculates journeys that are clearly outside the MVV or that MVV reports as outside its area. If this service has no timetable for the travel day yet, the app asks MVV once for the same journey. Version 3.40 and earlier send no requests to this service. Suggestions and results remain in bounded session memory, cleared when the origin is removed. The own journey service does not log search text, coordinates or complete query URLs.

Bavaria Radio

Bayerischer Rundfunk and its current delivery network, including RNDfnk

Data and purpose
IP address, time, station playlist and stream request; no route or location points.
Trigger and retention in PedalArrow
Only after deliberate playback. On Android, a visible media foreground service continues playback while the app is minimised or the screen is locked, until pause/stop. No audio recordings or listening/title history are created. The broadcaster’s and delivery network’s terms also apply to the received stream.

External links, calendar, contacts, save/share and SOS coordinates

destination app or document provider selected by the user

Data and purpose
Only the deliberately transferred link, event, contact, GPX file or WGS-84 coordinates with GPS accuracy and UTC time. No address is resolved for SOS. A document provider may be cloud storage.
Trigger and retention in PedalArrow
Only through Android or iOS system dialogs. A private Android hand-off file is revoked and deleted after ten minutes; maintenance removes remnants after no more than one hour. The destination's policy then applies; PedalArrow cannot retrieve or erase a copy created there. SOS coordinate copying is available on Android 13 and newer only; the entry is marked sensitive and removed automatically by the system. Older Android releases retain the targeted share sheet. iOS assigns the local clipboard a two-minute expiration date.

Connected apps

Health Connect (Android) / Apple Health (iOS)

Data and purpose
The original GPS track with actual observation times, workout time, distance and speed calculated from recorded points of successfully saved cycling rides. Heart rate, cadence and power are included only when genuine timestamped measurements exist and write access is granted. Planned routes, pure GPX imports and older recordings without documented timestamps are not automatically transferred. PedalArrow requests write access; on iOS it checks only its own previously exported objects to prevent duplicates. Other health data is not imported. These health data are not used for advertising or analytics and are not sent to PedalArrow servers.
Trigger and retention in PedalArrow
Off initially. First connect the health store, grant system permissions and separately enable automatic transfer in Settings → Connected Apps. Suitable rides successfully saved afterwards are transferred; existing rides are not enrolled retrospectively. Original data and transfer status are encrypted in private app storage. Retries are limited; “Try again” is an explicit manual action. Switching off or disconnecting stops further transfer steps, although a write already accepted by the system may finish. Previously transferred data, deletion and synchronisation are managed in Health Connect or Apple Health. System permissions must be withdrawn there separately.

04

Location, ride recording and speech

With an already granted approximate or precise location authorization, the Home tab uses a current location only in the foreground to order events on the same day by approximate distance; the days stay in date order. All matching events across Bavaria remain available; without location they remain in chronological order. This does not request a new permission, store or transmit location. Leaving the Home tab, backgrounding, revocation and turning off location services clear the location; stricter rules of other location features remain unchanged.

Maps, address search and route planning do not require location permission for manually entered places. Precise location is requested for deliberately started ride recording, navigation, nearby search, explicitly enabled group sharing, showing your own position while exploring the map or choosing an offline area around your current location; both map features use it only on the device. Recording initially processes GPS points, observation times and available elevation and accuracy information for the session. Only an explicit save action stores the recording and related data encrypted under “My routes”, or the user deliberately exports it.

Android does not request separate background-location permission. An actively started ride uses a visible location foreground service; on Android 13 or later PedalArrow requires notification permission for it. Active navigation can continue with the app minimised or the screen locked. On iOS, location permission remains “While Using the App”. An actively started ride uses background location mode with a visible system indicator and continues recording with the screen locked. Manual pause, stopping or withdrawing permission stops the corresponding iOS recording updates; independently enabled group sharing is paused or ended separately; during automatic pauses, location observation continues to detect resumed movement.

Navigation speech uses a voice reported by the system speech engine as installed and offline. PedalArrow stores the guidance language, no technical voice ID and no guidance history. Actual text processing depends on the installed speech engine. The SOS view locally displays a fresh, quality-checked GPS point with WGS-84 coordinates, accuracy and UTC time. It does not resolve an address or send these details to a PedalArrow server. Only an explicit share or copy action hands them to the selected app or clipboard.

05

Local storage, security and deletion

On Android, favourites, deliberately saved routes and event, detail, supplementary and translation caches are held in private app storage excluded from backup and device transfer. They are encrypted with separate, non-exportable Android Keystore keys using AES-256-GCM. On iOS, the corresponding content uses authenticated AES-256-GCM encryption. Keys are non-synchronising and device-bound in Apple Keychain with “When unlocked, this device only”; files use complete iOS Data Protection and are excluded from backups. The journal for transfers to connected health apps is also protected locally. Map and image caches and short-lived export files are private; this does not mean that all cache types use the same encryption.

GPX files are read through the system file picker and are not automatically uploaded. Import, local preview and actions that only reorder or remove waypoints stay on the device. Editing an address field may send that text to the address service; a deliberately requested recalculation sends the required stop list to the stated address and routing services. This does not upload the entire imported GPX file. Deliberately exported files are outside private app storage; their readable names may contain a date and origin/destination labels.

Search, route and result data that have not been explicitly saved generally remain limited to the app session. Saved favourites, routes and transfer status remain until deletion; functional caches are bounded, replaced on refresh or discarded on expiry. Translations are reused only for the matching German source text and text-protection rules. Translations and the language model can be deleted in settings, which pauses automatic downloading. An explicitly approved offline map corridor is geographically limited. iOS removes offline areas and offline corridors after 30 days; Android keeps complete offline maps until the map or all local app data is deleted. From version 3.40, whole administrative districts can also be saved offline; on both platforms they remain until they are deleted individually or together with all local app data. The stated standard map services are not used indiscriminately for offline preloading.

The central local-data deletion function removes local favourites, routes, functional caches and temporary hand-off files, first stopping active recording, playback and speech. It blocks further transfers to connected health apps. It does not retrospectively delete records already sent to Health Connect or Apple Health, exported files, cloud copies or external providers’ technical logs. Manage or delete those items with the respective recipient. Disconnecting a health app does not automatically withdraw its system permissions. Uninstalling removes private app storage; a Keychain entry that might remain does not by itself contain readable app data.

Android blocks ordinary screen capture and non-system overlays. On iOS, screenshots, screen recording, mirroring and app-switcher previews are not blocked by the app and may contain visible content.

06

Legal bases

Depending on the feature, processing is based on Article 6(1)(b) GDPR to provide a service explicitly requested, Article 6(1)(f) GDPR for secure, economical and reliable operation and abuse prevention, and Article 6(1)(c) GDPR where needed to meet legal obligations. Legitimate interests include IT security, bounded failure handling and resource-efficient operation. There is no solely automated decision with legal or similarly significant effects.

Voluntarily transferring rides to Health Connect or Apple Health requires your explicit consent. The legal bases are Article 6(1)(a) GDPR and, where health data is concerned, Article 9(2)(a) GDPR. You may switch off transfers in settings, disconnect the service and withdraw system permissions in the health store. Use of the remaining app does not depend on that permission. Withdrawal applies to the future and does not affect the lawfulness of earlier processing based on consent.

07

Recipients and international transfers

The operators named above receive data directly from the device and may log connection data under their own terms. Services are selected for a European operating context, but processing outside the EEA by a provider, technical service provider or content-delivery network cannot be ruled out categorically. Where applicable, the safeguard identified by that provider under Articles 44 et seq. GDPR applies, such as an adequacy decision including the EU-US Data Privacy Framework or EU Standard Contractual Clauses. The actual provider and delivery path at the time of a request are decisive.

Processors. For its own services, PedalArrow uses processors under Article 28 GDPR: Hetzner Online GmbH, Gunzenhausen, for the servers of live.pedalarrow.com (group rides, offline maps, event service, places service, term fallback) and routing.pedalarrow.com (bike routing and, from version 3.50, PedalArrow journey planning) in Nuremberg; ALL-INKL.COM – Neue Medien Münnich, Friedersdorf, for the website and email; Cloudflare, Inc., San Francisco (USA), as the protection service in front of these servers and the website.

Cloudflare mitigates overload attacks; to do so it terminates the encrypted connection and forwards the request over a new encrypted connection. Cloudflare thereby processes the IP address, connection data and the transmitted content, which for group rides includes invitation and member identifiers, for offline maps the selected area, for the event service the requested public event file, event image or MunichWays dataset, for the places service the category and grid squares of the requested place list and for routing the origin, destination, waypoints and route options and, for the own transit service, the search text, origin, destination and travel time. To defend against attacks, Cloudflare records, on behalf of PedalArrow, the IP address, time, requested address and app or browser identifier of blocked requests and of a sample of other requests. For bike routing and PedalArrow's own transit service on routing.pedalarrow.com, the requested address contains no origin, destination, waypoints or search text; these are sent only in the request content, which Cloudflare does not record. Processing is based on Cloudflare's data processing addendum and may take place in data centres outside the EU. Cloudflare is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses of the data processing addendum apply in addition. The legal basis is Article 6(1)(f) GDPR (security and availability of the services).

08

Your rights

Subject to Articles 15–22 GDPR, you have rights including access, rectification, erasure, restriction, portability and objection. Contact info@PedalArrow.com. You may lodge a complaint with the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, Germany. If an external provider is an independent controller, a request may also need to be directed to that provider.

You may withdraw consent at any time with effect for the future. Local deletion or withdrawal does not retrieve copies deliberately transferred earlier; those copies and system permissions must additionally be managed with the respective recipient.

09

Changes

This policy is updated when features, recipients or law change. Material changes are made visible in the app through a new version of the initial disclosure.

Zum Impressum →