Privacy

Who we are

roadbod is run by Heslop Digital Ltd, trading as Rannoch Digital. We are the data controller for the information below.

• Contact for privacy questions: [contact email address to be added]
• ICO registration number: [ICO registration number to be added]

What we keep about you

• Your email address. To sign you in and to send you the emails you ask for: confirming your address and resetting your password.
• Your password, scrambled. We store only a one-way hash, so we can check a password but never read it.
• The cars you save. A name you choose, the fuel type, the miles per gallon and the tank size, so you can pick a car instead of typing it again.
• When you signed up and confirmed your email address.
• Your theme preference (light, dark or match your device), if you choose one. When you are signed in it is saved to your account so it follows you to any device. Nothing is stored until you choose.
• Session records. While you are signed in we keep a record that includes your IP address and your browser type, so you stay signed in and so we can spot misuse. A record is kept for 2 hours after you last used the site, and expired records are then deleted automatically, checked every hour.
• A password reset link, if you ask for one, until you use it or it expires (after 1 hour). Expired ones are cleared daily.

The legal reasons: we need your email address, password and cars to give you your account (our contract with you), and we keep session records for security (our legitimate interest in keeping accounts safe).

What we do not keep

We do not keep a history of your journeys, and we do not save addresses or locations against you. Specifically, we don't store:

• where you start, where you are going, or any place you go via;
• your device's location, if you choose "Use my location";
• how much fuel you have, or how much you want left on arrival;
• the plans and results we show you.

Those details are used to plan your journey while you wait, then forgotten by us. The places you type are remembered only in your own browser tab, so a refresh doesn't lose them. They are cleared when you close the tab or log out.

To avoid asking our map partners the same question twice, we keep the answers to route and place look-ups for a while (routes for 1 day, places for 30 days). These are not linked to you or your account: they are filed under the places themselves, not under who asked.

Cookies

We only use cookies the site cannot work without, so there is no cookie banner to click:

• a session cookie, which keeps you signed in as you move between pages;
• a security cookie (XSRF-TOKEN), which protects forms from being submitted by other sites;
• a "remember me" cookie, only if you tick "Remember me" when you log in. It keeps you signed in for up to 400 days on that browser.

There are no advertising or tracking cookies, and no analytics.

Besides cookies, your browser's own storage is used for two things you control, neither of which is sent anywhere for tracking: the theme you choose is kept in this browser's local storage (so the right theme shows before the page appears, even when you are signed out) until you clear your browser data, and the places you type for a journey are kept in session storage for that tab only. We store nothing in either until you make a choice or type something.

Other organisations involved

To plan a journey we use some other services. What each one sees:

• OpenRouteService (run by HeiGIT) finds the route and, when you type a place name, looks it up. It receives the coordinates of your start, end and any via places, and the place names you type. It is not told who you are.
• postcodes.io turns a UK postcode into a location. It receives the postcodes you type. It is not told who you are.
• OpenStreetMap supplies the map pictures. Your browser fetches them directly, so OpenStreetMap's servers can see your IP address and the area of map you are looking at.
• Google Maps, only if you tap "Open in Google Maps" on a result. That link carries your route (the start, unless it is your own location, plus any via places, the fuel stops of the plan on screen and the destination) to Google, which then handles it under its own privacy policy. Nothing is sent to Google until you tap it.
• An email service will deliver our emails to you (Google, through Google Workspace). It receives your email address and the content of each message.
• The UK Government's Fuel Finder service supplies fuel prices. We receive data from it; nothing about you is sent to it.

We do not sell your information or use it for advertising.

Your rights, and deleting your account

You can delete your account yourself at any time (log in first): go to Your account and choose "Delete your account". That removes your email address, password, saved cars and any sessions straight away. There is nothing else to delete, because we don't keep journeys or places.

Under UK data protection law you can also ask us for a copy of what we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to complain. Contact us at the address above. If you are not happy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.