Privacy Policy — Detour

Last updated: 26 September 2026

Detour is an Android app that picks a random road destination within a radius you choose, routes you to it, and records the ride. This policy explains what the app does with your data.

The short version: Detour has no account requirement, no analytics, no advertising, no crash reporting and no third-party trackers. Your trips, traces and explored area are stored in the app's private storage on your device. Nothing is uploaded anywhere unless you deliberately configure a sync server, and that server is one you run or choose — with one exception: if Android's own backup is on for your phone, it copies your trips and traces to your Google account (see Android backup).

Who is responsible

Detour is developed by an individual developer. For any question about this policy or your data, write to jellemax24@gmail.com.

What the app stores on your device

• Location and trip data — GPS traces of recorded rides, with distance, duration, speed, and (on moto and car) lean angle and cornering g.
• Explored area ("fog of war") — the ground your traces have uncovered on the map.
• Saved places and routes — locations and multi-stop routes you save yourself, including any a friend shared with you.
• Settings — theme, radius, vehicle mappings, server addresses and credentials you enter.
• Paired Bluetooth device names — used to work out which vehicle a trip belongs to. This uses existing Bluetooth bonds; the app does not scan for nearby devices.

All of this lives in app-private storage. Uninstalling the app deletes it from the phone, but not from an Android backup (below).

Android backup (Google Drive)

Detour opts in to Android's automatic backup, so a reinstall or a new phone gets your history back without a sync server. If backup is switched on for your phone (Settings → Google → Backup, or your phone maker's equivalent), Android copies the following to your Google account's backup storage:

• Your trips and their full GPS traces — which show where your rides start and end, and so usually where you live and work.
• Your explored area, badges, saved places and routes.

Your server sign-in token and server credentials are deliberately left out of the cloud backup, as are your recent searches. The backup is held by Google under Google's privacy policy, not by the developer of Detour, who cannot read it. Detour has no setting of its own to exclude trips from it; to keep them out of Google Drive, turn off backup for your phone (or for Detour, where your phone offers per-app control) in Android's settings.

What leaves your device, and when

Even with no account, some features need the network. In each case only what is listed below is sent:

• Map tiles — the area of the map you are looking at is requested from OpenFreeMap.
• Spin destinations, speed cameras and coverage — the centre point and radius of a spin, and the area you are driving in, are sent to your configured Detour server's own OpenStreetMap-derived endpoints to find roads, points of interest, speed cameras and municipality boundaries in that area. No routing server is configured by default, so these requests only happen once you set one up.
• Address and place search, and place names — your search text and an approximate location (used to rank nearby results first) are sent to a Photon geocoder: your own instance if you configure one in Settings, otherwise the public photon.komoot.io. To name a place that has only coordinates, the exact coordinates of each spin destination and of each route stop with no name, tapped or imported from GPX, are sent to the same geocoder. The public fallback can be switched off in Settings → Server.
• Routing — if you configure a GraphHopper routing server, your start and destination coordinates are sent to it. No routing server is configured by default.
• Handing off navigation — if you choose to open a destination in Google Maps, Waze or another app, the destination coordinates are passed to that app, which is then governed by its own privacy policy.

These requests carry no account identifier and no device identifier beyond what any HTTPS request necessarily exposes to the server handling it (such as your IP address). Their operators are independent of Detour and handle those requests under their own policies.

Optional sync account

Detour works fully offline-first with no account. If you choose to sign in to a sync server — one you self-host, or one you have been invited to — signing in happens on that server's own sign-in page, in a browser, and the app receives only the access token that page issues. Detour never sees your password. Your username, password and email address are held by that server's identity provider, under whatever policy its operator sets, and are governed by that operator rather than by this app.

Once signed in, the following is sent to that server:

• Your username, as the handle other members see, and your email address if the server's sign-in page asked for one.
• Your trips, GPS traces, explored area, saved places, badges and friend list, so that a reinstall restores them.
• A planned route, only if you explicitly share one with a friend. Routes you keep to yourself are never uploaded.
• Your explored area is shared with an accepted friend only if you turn on Share fog with friends, which is off by default and strictly reciprocal. Friends otherwise see only totals and badges — never your trips or your map.

A sync server may also let you create a dashboard key — a read-only key for a home-automation dashboard such as Home Assistant. A key reads only your own data, but that includes your rides and full GPS traces. The server accepts the key in the address of a request (?key=) as well as in a header, because an embedded dashboard frame cannot send a header. A key put in an address ends up in that server's and any proxy's access logs, in browser history, and in the dashboard's own configuration, so anyone who can read those can read your traces until you revoke the key. Prefer the header form wherever your dashboard supports it.

The developer of Detour does not operate a sync server for you and has no access to any server you run. Data on a self-hosted server is under your control.

Convoys, circles and the microphone

A convoy is an optional feature that shares your live position with the other members of a convoy you have joined, through your sync server, for as long as you stay joined. Nothing about a convoy's live position is stored on the server.

A circle is the long-lived version, for people you choose. Your latest position is sent to the server every couple of minutes while a circle's sharing switch is on, and the server keeps one position per member per circle, overwritten each time — no history and no trail. Pausing sharing stops it at the server, not just on your phone, and leaving a circle deletes it. Arrivals and departures at a shared place are worked out on your own device; only the resulting event is sent.

The microphone is used only while you are holding the push-to-talk button in an active convoy. Audio is streamed to the other convoy members in real time; it is not recorded, not written to storage, and not retained by the app. Push-to-talk is currently switched off, so no audio is captured at all.

Permissions and why they are needed

• Precise location — the core function: showing where you are, spinning a destination around you, and recording rides.
• Background location — optional, so a ride keeps recording with the screen off. Without it, tracking stops when the app is backgrounded.
• Physical activity — to detect automatically that a drive has started. Processed on the device.
• Microphone — convoy push-to-talk only, as described above.
• Bluetooth — reading which paired device is connected, to pick the right vehicle for a trip, and for the external display feature.
• Notifications — the ride-tracking notification and the speed-camera chime.

What Detour does not do

• No advertising and no ad identifiers.
• No analytics or telemetry SDK of any kind.
• No crash-reporting service.
• No selling or sharing of personal data with third parties.
• No user profiling for advertising purposes.

Deleting your data

• On the device — delete individual trips from the history list, wipe your explored area with Settings → Fog of war → Reset explored area, or uninstall the app to remove everything from the phone.
• In an Android backup — uninstalling does not touch the copy in your Google account. Delete it under Google One / Google Drive → Backups (the backup for this phone), or turn backup off in Android settings so no new copy is made (see Android backup).
• On a sync server — ask the administrator of that server to remove your account, which deletes every row belonging to it: trips, traces, saved places, shared routes, badges, friendships and group memberships. Your sign-in details live with that server's identity provider and are removed there separately.

Children

Detour is not directed at children and is not designed for use by children under 13.

Changes to this policy

If this policy changes, the updated version will be published at this URL with a new date at the top.

Contact

jellemax24@gmail.com