Privacy

Last updated: September 20, 2026

The short version

The core trip builder works with no account, and the trips you make stay on your own device until you sign in. We collect what we need to run the map, save your trips, take payment, and keep the service working and free of abuse. That last part means we do store your IP address, and the section below says exactly where and for how long. We do not sell your personal data, and we do not use it for advertising.

Below is the long version, in plain English. If anything is unclear, email us at support@onemoreroad.com.

Who we are

One More Road (onemoreroad.com) is run by Mason M. and Michael C., who operate it together. We are the controllers of your personal data, and "we", "us", and "our" refer to us. For any privacy question or to exercise a data right, contact us at support@onemoreroad.com.

EU / UK representative. We have not appointed an Article 27 representative; we rely on the exemption for occasional, low-risk processing that does not involve large-scale special-category data.

We have not appointed a statutory Data Protection Officer; we do not believe our processing meets the threshold that would require one.

What we collect, and where it comes from

You can use the builder without an account. Even then, your browser generates a random, pseudonymous visitor ID so we can count usage, and your trips are stored locally on your device. The categories below cover both anonymous visitors and account holders.

Account data

If you sign up, we store your email address and a Cognito user ID. You can optionally add a first and last name, and you get a username (a public handle, defaulted from the part of your email before the "@", which you can change). We also store an optional "how did you find us" answer (reddit, google, tiktok, an ad, a friend, or other). Sign-in is handled by AWS Cognito, including "Continue with Google".

Billing data

If you buy a paid plan, we store a Stripe customer ID, your subscription status, plan interval (monthly, yearly, or lifetime), and the billing period dates. We do not store your card number. Stripe handles all card data; we never see it.

Trip and content data

Trip names, stops (coordinates, labels, notes), colors, routing preferences, the computed route geometry between stops, groups ("Past", "Planned", and custom groups), and routes you follow or share. Because trips are made of places and routes, they can reveal where you have been or plan to go. While signed out this lives in your browser; on first sign-in it is claimed onto your account and saved to our servers.

Map searches and routing coordinates

When you search for a place or build a route, the search text and your stop coordinates are sent to our mapping providers (see "Who we share data with") so we can return suggestions and compute the driving between stops. No account is required.

First-party product analytics

A random anonymous visitor ID (a UUID) is created in your browser and sent with unauthenticated requests so we can measure usage (daily, weekly, and monthly active users) and count product actions (creating a trip, adding a stop, exporting, computing a route). The ID itself carries no name, email, or device fingerprint, but the event row we write next to it does record your IP address, which is visible to an operator reviewing that event. When you sign up, the ID is linked to your account so pre-signup activity is attributed to you.

IP address

Every request reaches us with your IP address, and we store it in more than one place. It is written onto each product-analytics event (kept 180 days); onto the once-a-day activity marker for anonymous visitors, so one person cycling visitor IDs is not counted as several people (about 400 days); and into a per-IP index that links an IP to the visitor IDs and account IDs seen from it (30 days for anonymous entries, 90 days for account entries). If an IP is blocked for abuse, the address and the reason are stored on the block record (about 400 days). Your IP is also the key we count requests against for rate limiting. We use it for abuse prevention, enforcing blocks, rate limiting, deduplicating usage counts, and operator triage. We do not use it for advertising or profiling.

Third-party analytics (Google Analytics 4)

On the production site, Google Analytics 4 records high-level lifecycle and revenue events (sign-up, login, password reset, checkout start, purchase, share, trip creation). These carry plan names, opaque share IDs, and amounts, not your name or email. GA4 sets its own cookies and processes your IP and device data. Staging and development builds do not load it. See "Cookies" below for how consent applies in the EU and UK.

Operational logs

We log technical details of requests and errors: route and handler, HTTP method and status, latency, a request ID, a user ID where signed in, and for client errors the page URL, user agent, release, and error message. URLs are recorded with authentication and token parameters stripped. Some log entries carry content: when a place-search or geocoding provider fails and we fall back to another, we record the search text (trimmed to 120 characters) or the coordinate we looked up, so the failure is diagnosable. If you send feedback from an upgrade prompt, the full text you type is stored as a log entry as well as emailed to us.

Daily games

If you play Detour, Fog of Road, or Borderline, we store your play history (the day, your score, and the route you drew) and a ranking row carrying your display name and score. Ranking rows are shown to other players on the public leaderboards. Both are kept indefinitely today: they have no expiry, and an account deletion does not remove them.

Your public label

Your username is a public handle. Where you have not set one, some features fall back to the part of your email address before the "@" and show that instead: it is snapshotted onto share links you mint and shown to people you invite to collaborate on a trip. Setting a username replaces it going forward.

We do not knowingly collect special-category data (such as health or religion). Google acts as its own independent controller for the data it processes when you sign in with Google.

Why we use it, and our legal basis

For EU and UK users, the list maps each use to a lawful basis under the GDPR / UK GDPR. For California users, these are also our business and commercial purposes under the CCPA / CPRA.

Run the service (contract). Account management, saving trips, computing routes, geocoding searches, and processing payments through Stripe.
Keep it secure and working (legitimate interests). Security and abuse prevention, rate limiting, blocking abusive IP addresses, debugging through logs, and first-party product analytics. This is the basis we rely on for storing your IP address, including on the analytics events where it is visible to an operator. We have weighed these interests against your rights, and you can object to processing on this basis (see "Your rights").
Analytics cookies (consent). Google Analytics and any other non-essential cookies rely on your consent where ePrivacy requires it (the EU and UK); you can withdraw it at any time. Any future marketing email will also rely on consent.
Tax and financial records (legal obligation). Keeping billing records tied to your Stripe payments for as long as tax and accounting law requires.

We do not use your data for automated decision-making that produces legal or similarly significant effects (resolving your plan tier and enforcing usage caps is not such a decision).

Cookies, local storage, and similar technologies

One More Road does not use advertising cookies. The app mostly relies on your browser's storage (IndexedDB, localStorage, sessionStorage) rather than cookies, and sign-in tokens are held in memory by the auth library, not a persistent cookie. The exception is Google Analytics 4, which sets its own cookies on the production site.

Strictly necessary (used to deliver what you asked for)

Sign-in / session tokens (in memory); the anonymous visitor ID (rt.anonId); local trips, groups, and follow caches (rt.trips, rt.groups, rt.serverCache, rt.followsCache, rt.hiddenFollows); and short-lived items that carry data through sign-in and checkout redirects (rt:post-auth-next, rt.pendingPurchase, rt.sharedImport, rt.claimBatchId). First-party, cleared on sign-out or after a single use.

Non-essential (analytics)

Google Analytics 4 cookies, set on the production site. In the EU and UK these require your consent.

If you are in the EU, UK, or Switzerland, Google Analytics stays off unless you turn it on; until then it sets no cookies and collects nothing. Everywhere else it is on by default. You can opt in, or change your choice at any time, from "Cookie preferences" in the Tools menu, and we honor Global Privacy Control (GPC) browser signals as a request to keep analytics off.

Who we share data with

We share data only with the providers we need to run One More Road. We do not sell your personal data, and we do not share it with data brokers.

Amazon Web Services (AWS), us-east-2. Cognito (auth), DynamoDB (main store), S3 (large route geometry), API Gateway and Lambda (backend), CloudWatch (logs). All account and trip data lives here.
Stripe. Payments, subscriptions, and charges. Receives your email, a userId reference, subscription details, and charges/refunds.
Google. Google Analytics 4 (production only) and Google Sign-In, if you choose "Continue with Google" (Google is a separate controller for the data it processes). Google also receives a Google Maps short link if you paste one in to import a trip: we follow the link to find out where it points.
Mapbox and MapTiler. Place search and map tiles; receive your search queries and the map area you are viewing.
OpenFreeMap. The default basemap style and its tiles, so it receives the map area you are viewing.
OpenRouteService (ORS). Fallback routing and geocoding; receives stop coordinates and search text when used.
OpenStreetMap and Overpass. Open map data, plus ferry-route tracing (Overpass receives a ferry leg's start and end coordinates).
Apple Maps and Waze (only when you tap through). "Open in maps" hands the leg's start and end coordinates to whichever app you pick, in the link you open. Nothing is sent unless you tap it.
Operator alerting (Discord). Billing events that may need our attention - a new subscription, renewal, plan change, cancellation, or refund - are posted to a private channel we read, over a Discord webhook. Those alerts carry an internal user ID, the display name you chose if you set one, and the plan and amount. No email address, no card details, no trip data.
Self-hosted (Valhalla and Photon). Our primary routing and place-search engines run on our own infrastructure, so those coordinates and queries reach a third party only when we fall back to one of the services above.

Where a provider processes personal data on our behalf, we put data-processing terms in place with them.

California "sharing". We do not sell your personal information, and we do not use it for cross-context behavioral advertising. We honor Global Privacy Control (GPC) browser signals as an opt-out request.

International data transfers

If you are in the EU or UK, your personal data is transferred to and stored in the United States. Our infrastructure runs in AWS us-east-2, and most of the recipients listed above (Stripe, Google, Mapbox, MapTiler, Discord) are US-based. The transfer mechanism differs by provider and we are working through it recipient by recipient.

For these transfers we rely on appropriate safeguards, such as the EU-US Data Privacy Framework and the Standard Contractual Clauses (with the UK International Data Transfer Addendum for UK-origin data). To request more detail, email us at support@onemoreroad.com.

How long we keep it

Account and trip data: kept until you delete your account; deleting individual trips removes them sooner.
Operational logs: info-level for 7 days, warnings for 30 days, errors and fatal entries for 90 days, then automatically deleted.
Route cache: 30 days per leg. The cached row holds the driving line between two points, so it is a record of a route someone asked for, not just a counter. It is keyed by the coordinate pair, not by you.
Search caches: 1 day for results from providers whose terms forbid keeping them, 30 days for MapTiler results, and 90 days for results from our own self-hosted search. Reverse geocoding is cached for 1 day.
Analytics: Google Analytics 4 uses its configured retention (Google's default is 14 months). On our side, the first-party visitor ID stays in your browser until you clear your storage; the daily counters and activity markers expire after about 400 days; and the per-event journal, which is the row carrying your IP address, expires after 180 days.
IP records: 30 days for an anonymous entry in the per-IP index, 90 days for an account entry, and about 400 days for a block record.
Rendered trip videos: 30 days in storage, then deleted automatically. The job record that tracks a render expires after about a day.
Share links: no expiry by default. A link you mint keeps working until you revoke it or delete your account.
Daily-game results and leaderboards: no expiry. We keep them indefinitely, and if you delete your account the leaderboard rows stay but are anonymized.
Billing records: retained as long as tax and accounting law requires, even after you delete your account.

We do not run a separate backup archive. Our production databases have point-in-time recovery turned on, which keeps a rolling restore window of roughly 35 days maintained by AWS. Deleted data can therefore still be present in that window, and drops out of it as the window rolls forward. We do not keep older copies or previous versions of stored files.

Your rights, and how to exercise them

Depending on where you live, you have the following rights. To use any of them, email support@onemoreroad.com. You can also edit your email, name, and username yourself on your account page. Before we act on an access, deletion, or portability request, we verify that you control the account.

If you are in the EU or UK:

Access: ask for a copy of the personal data we hold about you.
Rectification: correct inaccurate data (most fields are self-editable on your account page).
Erasure: ask us to delete your account and data (see the note below).
Restriction: ask us to pause processing while a dispute is resolved.
Portability: ask for your account and trip data in a structured, machine-readable format (you can also export individual trips as GPX, KML, or GeoJSON in the app today).
Object: object to processing based on our legitimate interests, such as first-party analytics.
Withdraw consent: where we rely on consent, withdraw it at any time; doing so is as easy as giving it.
Automated decisions: we do not make automated decisions with legal or similarly significant effects about you.

We respond within one month (extendable by up to two further months for complex requests). You may also complain to a supervisory authority: your local Data Protection Authority in the EU, or the Information Commissioner's Office (ICO) in the UK.

If you are in California:

Know / access: request the categories and specific pieces of personal information we collect, their sources, our purposes, and the recipients.
Delete: request deletion, subject to legal exceptions (such as completing a transaction or keeping tax records).
Correct: correct inaccurate personal information.
Opt out of sale / sharing: we do not sell your data; see the California sharing note above for the analytics opt-out and our handling of Global Privacy Control signals.
Limit sensitive personal information: we minimize sensitive data and do not use it beyond permitted purposes.
Non-discrimination: exercising any right will not change the service or price you get.

We respond to California requests within 45 days (extendable by another 45). You may also contact your state Attorney General.

How deletion works today. We handle account deletion and data exports manually: email us and we run an account purge, which is logged for accountability. Self-serve "delete my account" and "download my data" flows are planned. The purge is not yet complete, and we would rather tell you exactly what it does than imply more than it delivers.

What the purge removes today: your trips and the stored route geometry that goes with them, the share links you minted and their stored routes, your groups, your username reservation, your account record, and your sign-in account with AWS Cognito. It also cancels any live subscription, so a deleted account is never charged again.

What the purge anonymizes: your rows on the daily-game leaderboards. The score and the position stay, so the historical boards are not rewritten and nobody else's placement moves, but your name is replaced with a neutral placeholder and your chosen game display name is deleted. Your own game results are kept behind that anonymized row.

What it does not reach today: who you follow and who follows you; trip-collaborator membership and the collaborative edit history of a shared trip; analytics events, activity markers, and per-IP records; log entries that carry your user ID; and your Stripe customer record with its invoices and charges. Most of those age out on the timetables above, between 90 and 400 days. Follows, collaborator membership and game results have no expiry, so they persist until removed by hand.

If you want any of that removed as part of a deletion request, say so in your email and we will do it by hand. Your Stripe customer record, invoices and charges are deliberately kept: they are financial records we are required to retain for tax, and cancelling the subscription does not delete them.

Children

One More Road is a general-audience trip planner and is not directed at children under 16. We do not knowingly collect personal data from children under that age. If we learn that we have, we will delete the account and its data.

Security

We take reasonable steps to protect your data: HTTPS in transit, AWS-managed encryption at rest, sign-in managed by AWS Cognito, internal access scoped through IAM, and privileged operator actions restricted to an allowlist and recorded in an audit log. Card data is handled by Stripe, so we never see or store card numbers.

No system can be guaranteed perfectly secure. If a personal-data breach occurs, we will notify the relevant authorities and affected users where the law requires, within the timelines the GDPR sets.

Changes to this policy

We may update this policy as the product and the law change. When we do, we update the "Last updated" date at the top. For material changes we will give notice in the app or by email.

Contact us

For any privacy question or request, email support@onemoreroad.com. We are a small team and read every message.

This page is provided for transparency and is not legal advice. Governed by the laws of the State of Texas, United States.