Rumbo Maps privacy policy

Rumbo Maps is a phone map of Austin, Texas: search, directions, turn-by-turn guidance and traffic. It has no account and no ads. This page says exactly what it sends, what it never sends, what our server can still see, and how long anything is kept. It also says what the app does not protect you from, because you should know that too.

The short version

• No account, no sign-in, no location sharing, no ads. Where you are, what you search for, where you go and what you save stay on your phone.
• The map runs on the phone. The map, search, directions, turn-by-turn and voice are part of the app. No map, search or routing service is asked anything.
• Two things can leave the phone by themselves, each behind its own switch in Settings, both explained on the first screen before anything is sent: Help improve traffic (how fast traffic moved on road segments, never a position) and Share usage statistics (counts of what was used in the app, never what you typed, never a place, never a location). Both start on.
• Two more go only when you tap them: a road report (what, and where you are to about 11 m) and a “Still there?” answer (which report, yes or no).
• You can see everything it sent: Settings → What this phone has sent.
• Music (Spotify) is Spotify's. Rumbo Maps sends Spotify nothing. When you open Music, your phone talks to Spotify directly and Spotify's own privacy policy applies; your Spotify login stays on the phone until you sign out.
• What our server can still tell: every connection shows it your phone's internet address, and our hosting service logs that address for 7 days. While few phones use Rumbo Maps, whoever runs the server could use that log to tell which uploads came from the same phone, and could put a trip's traffic uploads back together into most of the route. Nobody does this, and nothing joins them, but it is possible.
• Nothing is sold. There are no advertisers and no data brokers.

What stays on your phone

The app keeps these in its own storage on the phone. They are never sent.

Uninstalling the app, or clearing its storage in Android's settings, removes all of it. The app does not allow Android to back it up.

Your location

Rumbo Maps asks for your location only while you are using it, never in the background. It uses it on the phone to show where you are, to guide you and, only if Help improve traffic is on, to measure traffic speeds as described below. During turn-by-turn the drive keeps going with the screen off; Android shows a notification the whole time, and End stops it.

Your position itself is never written to storage (a place you choose to save keeps its own position, on the phone), and a trip is held only in the phone's memory until it ends.

With precise location allowed, the app listens to the phone's GPS alone. It never asks the phone's network or “fused” location, because on most Android phones those are answered by Google's location service, which sends the Wi-Fi networks and cell towers around the phone to Google. If you allow only approximate location, Android can give one only through its network location service, so the app uses that, and that service may consult Google. Nothing of this passes through Rumbo Maps or reaches our server.

Help improve traffic

On by default, explained on the first screen, switch in Settings → Privacy.

What is sent

After a drive, a few small uploads like this one, each at its own random moment 2 to 20 minutes after the trip ended:

{ "v": 1,
  "graph": "austin@2026-09-28T19:33:16.550Z",
  "batch": "3f6b1c2e-8d4a-4e7b-9a51-0c2d7e9f4a18",
  "segs": [ [29052, "2026-09-28T15:10:00Z", 47],
            [50426, "2026-09-28T15:05:00Z", 12] ] }

• graph names the road map inside the app, so the numbers mean the same on the server.
• batch is a new random id for this one upload, never used again and not tied to you, your phone or any other upload.
• each entry in segs is [road segment, 5-minute slot, speed in km/h]: a numbered piece of street (and its direction) on the app's own road map, the 5-minute slot of the day, and a whole-number speed. An upload holds at most 12 segments, picked at random from the whole trip.

What is never sent

Not a coordinate. Not a time finer than the 5-minute slot. Not a device id, an install id or anything that identifies the phone. Not the accuracy of your GPS. Not the start or the end of your trip.

How it is made, on the phone, before anything leaves

• Only real, precise GPS positions count, and only while driving (faster than about 7 mph for at least 10 seconds). Walking and a simulated drive never count.
• The phone matches its own GPS to streets and times each road segment it drives.
• At least the first and last 500 m of every trip are cut off: 500 m, plus 60 m, plus a random 0 to 500 m chosen afresh for each end of each trip, measured along the way you drove.
• If less than 1 km is left after the cuts, nothing of the trip is sent.
• What is left is shuffled into uploads of at most 12 segments, each with its own random id and its own random delay of 2 to 20 minutes. While they wait they are only in the app's memory; if the app is closed first, they are dropped unsent.

What the server does with it

A street's speed can only be read as the middle value of two or more separate uploads in the last 15 minutes. One upload's speeds are never shown to anyone. The individual rows are deleted after 24 hours.

Road reports and “Still there?”

Only when you tap them. There is no switch, because nothing is ever sent by itself.

A road report

Tap Report, then one of six: Jam, Crash, Object on road, Closure, Construction, Work zone. There is no police or camera report. Exactly this is sent, and nothing else:

{ "v": 1, "kind": "crash", "lng": -97.7417, "lat": 30.3025, "bearing": 190 }

That is the kind, where the phone is, rounded to about 11 m, and the direction you were driving to the nearest 10 degrees (or none when you were not moving). No id, no account, no accuracy; the server notes the minute it arrives. If there is no connection it waits at most 30 minutes, then is dropped.

Who sees it: every Rumbo driver, once a second person confirms it. Reports of the same kind close together are merged, and only when two or more different people stand behind one does it appear to others: its kind, its place, its direction, when it was first reported, how many confirm it, and when it expires. Nobody sees who made it, and the server does not store who.

A report lives 45 minutes (jam), 60 minutes (object on road), 90 minutes (crash), 6 hours (closure), 12 hours (work zone) or 24 hours (construction), half as long again for each different person who confirms it, and never more than twice that.

“Still there?”

When you drive past a confirmed report, the app may ask Still there?. If you do not answer, nothing is sent. An answer is exactly which report and yes or no. The server keeps one answer per person per report as a scrambled code made from your internet address, a secret key and that report, which cannot be linked to your answers on other reports. A report is removed when enough people say it is gone.

What a report tells the server

A report is, by its nature, a note of where you were when you made it. It is anonymous in our database, but like every upload it reaches the server from your phone's internet address, which the hosting service's log keeps for 7 days, so whoever runs the server could match a report to the address it came from.

Work zones

The map also shows work zones from traffic-control companies that use NEXUS Fleet, a fleet-management app, and chose to publish them: only the stretch of road and until when, never the company, customer, job, crew or truck. Nothing about you is sent to them.

Usage statistics

On by default, explained on the first screen, switch in Settings → Privacy.

Only these eleven things are counted, each with a few coarse details at most: the app was opened; a search was made (how many results, in steps: 0, 1, 5, 10 or 20); a category such as Coffee or Gas was browsed (which one, and the result count in steps); a place's card was opened; directions were found (drive or walk, distance in steps); turn-by-turn started or ended (drive or walk, distance and time in steps, and whether you arrived); a new route was found on the way; a place was saved; a place was shared; something went wrong (a short error code such as map_failed).

{ "v": 1,
  "install": "0b8e0d5e-3c52-4c7e-9f0e-2b7f6a1d9c44",
  "app": "0.2.123",
  "events": [ { "e": "app_open", "h": "2026-09-28T15:00:00Z", "p": {} },
              { "e": "search",   "h": "2026-09-28T15:00:00Z", "p": { "results": 5 } } ] }

• install is a random id so that counts from one phone can be told apart from counts from many. It says nothing about you or the phone, is replaced every 30 days, and is forgotten when you turn usage statistics off.
• app is the app's version; h is the hour, never the minute.
• Never what you typed, never a place's name, never a street, never a position.

They are sent when the app starts, every 30 minutes while it is open, and when it goes to the background. They are deleted after 90 days.

What the app asks our server

To show traffic, road reports and work zones, and to plan routes around them, the Android app asks our server for the current traffic, at most about every 2 minutes, only while the app is on screen. That question carries only the road map's name, nothing about you. It is asked even with both switches off, but never before you have finished the first screen: the first time you open the app, nothing at all is sent until you have read it and chosen. The answer holds street speeds (each the middle value of two or more trips), the City of Austin's public traffic incident reports of the last 30 minutes, the city's traffic signals, the confirmed road reports and the published work zones.

What NEXUS Fleet reads from Rumbo Maps

NEXUS Fleet, a fleet-management service run by the same people, uses Rumbo Maps' map and traffic to route its trucks. It reads only what every Rumbo driver can already see: the map files built from OpenStreetMap, and the traffic answer (street speeds combined from two or more separate uploads, confirmed road reports, and published work zones), at most every 5 minutes while one of its maps is open.

It never reads your uploads, your unconfirmed reports, your answers or the usage statistics, and it cannot learn who you are or where you drove: nothing Rumbo keeps would tell it.

Your internet address

Like any connection on the internet, every upload and every traffic question shows our server your phone's internet address. Two things keep it:

• Our own tables use it only to limit how often one address may call (120 traffic uploads, 60 statistics uploads, 20 reports, 120 answers and 600 traffic questions an hour). They keep it only scrambled with a secret key, and delete it after 2 hours. The key stays inside the database; the database's administrators can read it.
• Our hosting service's request log (Supabase, whose service runs behind Cloudflare) records every call in the clear: the internet address, the approximate place and network it belongs to, the app's name and version, the exact time, and which function was called. It is kept for 7 days, and whoever runs the project can read it. The app cannot switch this off.

That log is what would let a determined person on our side tie your uploads to each other and to your address. We do not do this, and nothing in the app or the database joins them; but it is possible, and you should know it.

How long things are kept

Deletion runs every hour on its own, so each time above can run up to an hour longer; nobody has to ask for it.

Who else handles it

Our server is a Supabase project (database hosting), whose service runs behind Cloudflare. They store and carry the data above for us and for nothing else. We share nothing with anyone else: no advertisers, no analytics companies, no data brokers, and nothing is sold. We would disclose data only if the law required it, and there is very little to disclose: nothing we keep names you.

Spotify, only if you open Music: your phone talks to Spotify directly, and we are not in between (see Music).

The app also switches off two things the phone's built-in web component would otherwise do: its own usage reports to its maker, and its “Safe Browsing” address lookups (the app only ever shows its own bundled pages).

Your choices

• The two switches (Settings → Privacy). Turning Help improve traffic off drops the trip being held and every traffic upload still waiting, at once, and nothing more is measured. Turning Share usage statistics off drops the waiting counts, forgets the random id, and nothing more is counted.
• What this phone has sent (Settings) lists every upload, newest first: when, what kind, whether it went, and the exact contents (for traffic, reports and answers, for 24 hours).
• Road reports are never sent unless you tap one.
• Location: you can refuse it, or allow only approximate location, in Android's settings. Search and directions from a place you choose still work.
• Deleting what we hold. Everything is deleted automatically on the schedule above. Because nothing we keep names you, we usually cannot find your records. Your usage statistics are the exception: the random id is shown in What this phone has sent; send it to alfredo@atxnexus.com and we will delete the statistics that carry it.

Things you start yourself

Share opens Android's share sheet with the place's name, address, coordinates and a link to that spot on openstreetmap.org; you choose where it goes. Call opens the phone's dialer; nothing is dialled for you. Website opens the place's website in your browser. “Open in maps” links from other apps open the place in Rumbo Maps; nothing about them is sent. Nothing is sent on your behalf.

Music (Spotify)

Rumbo Maps can play music from Spotify, with your own Spotify account.

• Rumbo Maps sends Spotify nothing. Not where you are, not your route, not your searches or saved places, not an id. The map cannot reach Spotify at all: it can only ask the app to open or close the Music panel, to show Spotify's sign-in, or to sign out, and it is told back only whether the panel is open and whether this phone is signed in.
• When you open Music, your phone talks to Spotify directly. Spotify's own pages load in a panel of their own, from Spotify's own servers, and can reach nothing else. Spotify sees what any website sees, such as your phone's internet address and what you do on its pages. Spotify's own privacy policy applies there, not this one; we receive nothing from it.
• Your Spotify login stays on your phone, as Spotify's own cookies, until you sign out (Settings → Music · Spotify → Sign out). We never see your password or those cookies. Signing out removes them and Spotify's other stored data from the phone; your map settings and saved places stay.
• Sign in with your Spotify email or username and password: buttons that sign in through another company do not work inside the app. Nothing plays until you tap play.

Children

Rumbo Maps is a driving app for adults. It is not directed to children, and we do not knowingly collect personal information from children under 13. Nothing it sends names a person, so we could not tell a child's upload from anyone else's; if you believe a child has used it and want something deleted, write to alfredo@atxnexus.com.

Where it works

Rumbo Maps covers the Austin, Texas area only. Our server and its hosting service may store data in the United States or elsewhere.

Changes to this policy

If what the app sends or keeps changes, this page changes with it, and the date at the top changes too. If a change would let something new leave your phone, the app will say so on screen before it is sent.