Privacy Policy for OutdoorX

Last updated: 24 September 2026

OutdoorX is an app for planning outdoor activities around the weather. It has no user accounts, and your spots, routes and settings are kept on your device. Its only server is a data relay, described below, which stores nothing. This policy explains what leaves your device, who receives it and why.

Who is responsible

Marcos Candela Boti, the developer of OutdoorX, is the controller of the data described here.
Contact: hello@outdoorx.app (or Settings → Support in the app)

What stays on your device

• The spots you save, the routes (GPX files) you import and the plans you make for them.
• Your settings, chosen activity and notification preferences.
• The forecasts, warnings and bulletins downloaded for your spots and routes, kept so the app works offline.
• Your device location, if you allow it: it is used only to keep a "current location" spot up to date, and is stored on your device.

Notifications (the weekly digest, route reminders and spot alerts) are worked out on your device. There is no push server, and we never store your routes, your location or the coordinates of your spots. The only thing about your spots that we keep is their names, through the analytics described below.

The data relay

Forecast requests, place searches and the request for the list of nearby webcams do not go to MET Norway, Photon or Windy straight from your device. They pass through a relay we run on Cloudflare Workers (Cloudflare, Inc.), which forwards them, so those services see Cloudflare's address instead of yours. The relay receives your IP address and the coordinates or search text in the request, as any server must to answer it. We have request logging turned off. The relay keeps a copy of each forecast in Cloudflare's cache for up to about half an hour, so that others asking about the same point are answered without asking MET Norway again; that copy contains the point and its forecast, but nothing about who asked. Cloudflare processes these requests on our behalf, in its data centre nearest to you, under its data processing terms; it may process data outside the EU under the EU standard contractual clauses.

Services the app contacts

To show forecasts, maps and conditions, the app asks the services below from your device. Like any internet request, each one receives your device's IP address, along with what the request contains. Where a request contains the coordinates of a spot, a route point or your current location, that is noted below. Each service handles this under its own privacy policy.

• MET Norway (api.met.no), the Norwegian Meteorological Institute: weather forecasts, through the relay above. Receives the coordinates of each spot and route point (rounded to within about 10–100 m) and, for route points, their height, but not your IP address. MET Norway stores the coordinates in its access logs, in its data centre in Oslo, Norway. If the relay ever fails, the app may be switched back to asking MET Norway directly, and MET Norway then receives your IP address as well.
• Photon by komoot (photon.komoot.io): place search and naming new spots, through the relay above. Receives what you type in the search box and the coordinates of spots being named (rounded to within about 10 m), but not your IP address. The relay keeps each answer for up to an hour, with nothing about who asked.
• Windy.com (api.windy.com): webcams near a spot. The list of webcams is fetched through the relay above, so Windy receives the spot's coordinates (rounded to within about 10 m) but not your IP address; the relay keeps each list for up to 15 minutes. The webcam images and the player then load directly from Windy, which sees your IP address when they do. The player is Windy's own page, may show Windy's advertising, and is covered by Windy's privacy policy.
• Map tiles from OpenFreeMap (tiles.openfreemap.org) and AWS Terrain Tiles (s3.amazonaws.com): the map and the height of the ground. The tiles requested show which area you are looking at.
• Weather warnings from MeteoAlarm (feeds.meteoalarm.org), and avalanche bulletins from the European avalanche warning services: avalanche.report / EAWS, SLF (Switzerland), lawinen-warnung.eu, lauegi.report, AINEVA (Italy) and ICGC (Catalonia). These are downloaded as whole country or region files and receive no coordinates.

Analytics, crash reports and purchases

• Google Firebase (Analytics, Crashlytics, Performance Monitoring, Remote Config): which screens and features are used, crash reports, and app performance, and a few settings we can change without an app update (such as where forecasts are fetched from). It collects an app-instance identifier, device model, operating system and app version, and a rough location (country or region) derived from the IP address. When you add, open, rename or delete a spot, the event includes the spot's name: the name you gave it, or the place name the app looked up for it, which for the "current location" spot is the name of the place you are in. It does not receive your routes, the coordinates of your spots or your precise location. See firebase.google.com/support/privacy.
• RevenueCat, with Google Play or the Apple App Store: OutdoorX Pro subscriptions and purchases. RevenueCat receives an anonymous app user ID and your purchase history, and uses them to confirm whether Pro is active. Payment is handled entirely by Google or Apple; we never see your payment details. See revenuecat.com/privacy.

Why, and on what legal basis

• Sending coordinates to weather, map and search services is needed to provide what you ask the app for (Art. 6(1)(b) GDPR).
• Handling purchases is needed to provide OutdoorX Pro (Art. 6(1)(b) GDPR).
• Crash reports, performance data and usage analytics help us find bugs and improve the app (Art. 6(1)(f) GDPR, legitimate interest).

We do not sell your data, show advertising of our own, or build profiles about you.

How long data is kept

Data on your device stays until you delete it in the app or uninstall the app. Firebase keeps analytics data for at most 14 months and crash reports for 90 days. RevenueCat keeps purchase records for as long as the store transaction exists. The services listed above keep their access logs according to their own policies.

Your rights

Under the GDPR you may ask for access to, correction or deletion of your personal data, restrict or object to its processing, and ask for a copy of it. Because we hold no account or server-side record of you, most requests can be met by deleting spots and routes in the app or uninstalling it. For data held by Firebase or RevenueCat, write to the contact address above and include the user ID shown under Settings. You also have the right to complain to a data protection authority, for example the Bavarian Data Protection Authority (BayLDA) or the authority where you live.

Children

OutdoorX is not directed at children under 16, and we do not knowingly collect data from them.

Changes

If this policy changes, the new version will be included in an app update and the date at the top will change.