Privacy Policy
Last updated 6 September 2026
The short version. Twisty needs an account so your rides are yours, and it needs your location to plan a ride from where you are, and, if you use turn-by-turn navigation, to follow the route while you ride it. That’s essentially it. There is no advertising, no analytics or tracking SDK in the app, and nothing is sold or shared for marketing. You can delete your account and everything in it from inside the app at any time.
This policy explains what Twisty collects, why, who else it passes through, and what you can do about it. It covers the Twisty iPhone app and this website.
Twisty is operated by Vuk Mijatovic, an individual developer based in Maryland, United States (“Twisty”, “we”). He is the data controller for the information described below. Questions go to support@twistyrides.com and reach him directly.
What we collect
| What | Why | Kept |
|---|---|---|
| Your email address and a password | To create your account, sign you in, confirm your address and let you reset a password | Until you delete your account |
| Your location, while the app is open | To plan a ride from where you actually are, and to centre the map. Sent to our routing server to work out the route. If you use turn-by-turn navigation it is also read continuously while you ride, so the app knows which corner is next and whether you have left the route. Leaving the route sends your position to our routing server again to work out the way back | Not stored on its own, and navigation does not record your ride. It only persists if it becomes part of a ride you save |
| Rides you save: the route, its name, the folder you filed it in, its distance and duration | So your library is there on your next ride and on a new phone | Until you delete the ride or your account |
| Recent searches: what you typed and the place it matched | So the search box can offer them again | Until you delete your account |
| Preferences: miles or kilometres, display name, riding defaults | So the app behaves the way you set it | Until you delete your account |
| What you type into AI planning, and roughly where you are asking from | To work out what ride you are describing | Not stored by us after the reply is built. See OpenAI below |
| Your IP address and basic request details, in our server logs | To keep the service up, stop abuse, and enforce rate limits | Rolling server logs, kept no longer than 30 days |
| Subscription status: whether you are on the free or premium plan | To unlock what you have paid for, and restore it on a new device | Until you delete your account |
What we do not collect
- No payment details. Subscriptions are charged by Apple, and your card never touches us or anyone working for us. All we are told is whether a subscription is currently active.
- No advertising and no ad identifiers. Twisty carries no ads and no ad SDKs.
- No third-party analytics or tracking SDK is built into the app.
- No background location. Twisty reads your position only while the app is open and on screen, including during turn-by-turn navigation, which stops when you leave the app or lock the phone. It does not follow you while Twisty is closed, and it does not ask for permission to.
- No ride recording. Navigation reads your position to work out the next turn and throws it away. It does not keep a trace of where you went, and no speed or performance data leaves your phone. Twisty plans roads; it does not record how you ride them.
- No contacts, photos, microphone or health data.
Who else sees it
Running Twisty means a handful of other companies process some of this on our behalf. Each is used for one job and nothing more. None of them is paid to profile you, and none of them receives your data for their own marketing.
- Supabase: hosts the database and handles sign-in. Holds your email, saved rides, searches and preferences. Servers in the United States.
- OpenAI: receives the text of your AI planning request and the area it concerns, in order to answer it. It does not receive your email or account identifier. OpenAI states that data sent through its API is not used to train its models.
- Mapbox: receives search terms and a nearby point so results are relevant to where you are. It does not receive your account identifier.
- OpenStreetMap and Overpass mirrors: queried for map features such as peaks, parks and lakes when planning. These receive an area, not an identity.
- Resend: sends the confirmation and password-reset emails. Receives your email address.
- Apple: distributes the app and processes all subscriptions and refunds under Apple’s own privacy policy.
- RevenueCat: keeps track of whether your subscription is active, so that what you paid for unlocks on every device you sign in on. It receives the receipt Apple issues for the purchase and an anonymous identifier for your account. It does not receive your card details, because nobody but Apple ever has those, and it does not receive your rides or your location.
- Vultr: hosts our routing server in the United States.
The routing engine itself runs on our own server. Working out your route does not involve Google or Apple at all. Those only come in when you choose to send a finished ride to them, at which point that ride is handled under their privacy policies, not ours.
Where your data lives
On servers in the United States. If you are using Twisty from outside the US, that means your information is transferred to and stored in the US.
How long we keep it
Account data stays until you delete it. Delete your account and it goes: your profile, your saved rides, your folders and your searches are removed together, immediately and permanently. Server logs roll over within 30 days. Backups may hold copies for a short period after deletion before being overwritten.
Your choices and rights
- Delete everything. In the app: profile icon → Delete account, then type DELETE to confirm. It cannot be undone and it takes your rides with it.
- Turn off location. iOS Settings → Twisty → Location. The app still works: you just tell it where to start instead of it knowing, and you can still plan, save and export rides. Turn-by-turn navigation is the one thing that cannot work without it, because following a route means knowing where you are on it.
- Get a copy, or a correction. Email us and we will send you what we hold or fix what is wrong.
- Stop the emails. The only emails we send are the ones you ask for: confirming an address, resetting a password. There is no marketing list.
Depending on where you live you may have additional rights under the GDPR, the UK GDPR or the CCPA, including access, correction, deletion, portability, and objecting to processing. We honour those requests for everyone, wherever you are. We do not sell personal information and we do not share it for cross-context behavioural advertising.
Our legal basis (for riders in the UK and EU)
- Performance of a contract: your account, your saved rides, your subscription. Without these the app cannot do what you installed it for.
- Consent: location. You grant it in iOS and can withdraw it at any time.
- Legitimate interests: keeping the service running, secure and free from abuse.
Children
Twisty is not directed at children and we do not knowingly collect information from anyone under 13 (or under 16 where local law sets that bar). If you believe a child has created an account, email us and we will remove it.
Security
Everything travels over HTTPS. Passwords are hashed by Supabase. We never see them and cannot recover them. The database enforces per-account isolation at the database level itself, so one account cannot read another’s rides even if the app has a bug. Our server keeps only the ports it needs open, and API keys live on the server, never in the app. No system is perfect, and we will tell you promptly if something happens that affects you.
This website
twistyrides.com sets no cookies and runs no analytics or tracking scripts. Our host keeps standard access logs containing IP addresses for security and troubleshooting.
Changes
If this policy changes in a way that matters, we will update the date at the top and, for anything significant, tell you in the app before it takes effect.
Contact
support@twistyrides.com. It reaches the person who built the app. There is only one.