Privacy Policy
Last updated 14 October 2026
The short version. Twisty works without an account: it keeps your rides under an anonymous identifier, and you can add an email later so they follow you to a new phone. It needs your location to plan a ride from where you are, and, during a ride, to follow the route, including with the screen locked. That’s essentially it. There is no advertising and no tracking, and nothing is sold or shared for marketing. The only analytics are the anonymous map data Mapbox collects to keep the map working, and you can switch that off. You can delete your account and everything in it from inside the app at any time.
This policy explains what Twisty collects, why, who else it passes through, and what you can do about it. It covers the Twisty app for iPhone and Android, and this website.
Twisty is operated by Vuk Mijatovic, an individual developer based in Maryland, United States (“Twisty”, “we”). He is the data controller for the information described below. Questions go to support@twistyrides.com and reach him directly.
What we collect
| What | Why | Kept |
|---|---|---|
| Your email address and a password, only if you create an account | To create your account, sign you in and let you reset a password | Until you delete your account |
| Your location, while the app is open, and during a ride with the screen locked | To plan a ride from where you actually are, and to centre the map. Sent to our routing server to work out the route. During a ride (turn-by-turn navigation or Just ride) it is also read continuously, so the app knows which corner is next and whether you have left the route. That carries on if you lock the phone or switch to another app, so the directions keep coming; your iPhone shows the blue location indicator while it does, and an Android phone shows a “Twisty is navigating” notification, and it stops when the ride ends. Leaving the route sends your position to our routing server again to work out the way back and other routes through your remaining stops | Not stored on its own, and navigation does not record your ride. It only persists if it becomes part of a ride you save |
| Rides you save: the route, its name, the folder you filed it in, its distance and duration | So your library is there on your next ride and on a new phone | Until you delete the ride or your account |
| Recent searches: what you typed and the place it matched | So the search box can offer them again | Until you delete your account |
| Preferences: miles or kilometres, display name, riding defaults | So the app behaves the way you set it | Until you delete your account |
| What you type into AI planning, and roughly where you are asking from | To work out what ride you are describing | Not stored by us after the reply is built. See OpenAI below |
| Your IP address and basic request details, in our server logs | To keep the service up, stop abuse, and enforce rate limits | Rolling server logs, kept no longer than 30 days |
| Subscription status: whether you are on the free or premium plan | To unlock what you have paid for, and restore it on a new device | Until you delete your account |
| The devices signed in to your account, only if you have one: each device’s name as the phone reports it (“iPhone” or “iPad”; on Android the brand and model), whether it is iPhone, Android or web, when it signed in and when it was last used | To keep an account to two devices at a time, and to list them under Your devices so you can sign one out | Until that device is signed out and our daily cleanup runs, or you delete your account |
What we do not collect
- No payment details. Subscriptions are charged by Apple or Google, and your card never touches us or anyone working for us. All we are told is whether a subscription is currently active.
- No advertising and no ad identifiers. Twisty carries no ads and no ad SDKs.
- No tracking SDK, and no analytics beyond the map’s. The only analytics in the app are Mapbox’s anonymous map data, described below, which you can switch off.
- No location between rides. Twisty reads your position while the app is open. During a ride it keeps reading it with the screen locked or another app in front, so the directions keep coming, and your iPhone shows the blue location indicator the whole time; an Android phone shows a “Twisty is navigating” notification instead. It stops the moment the ride ends. Twisty only ever asks for your location while using the app, never “Always”, and it does not follow you when you are not riding with it.
- No ride recording. Navigation reads your position to work out the next turn and throws it away. It does not keep a trace of where you went, and no speed or performance data leaves your phone. Twisty plans roads; it does not record how you ride them.
- No contacts, photos, microphone or health data.
Who else sees it
Running Twisty means a handful of other companies process some of this on our behalf. Each is used for one job and nothing more. None of them is paid to profile you, and none of them receives your data for their own marketing.
- Supabase: hosts the database and handles sign-in. Holds your email, saved rides, searches and preferences. Servers in the United States.
- OpenAI: receives the text of your AI planning request and the area it concerns, in order to answer it. It does not receive your email or account identifier. OpenAI also receives the spoken turn instructions for a navigated ride (road names, no account details) to create the natural voice. OpenAI states that data sent through its API is not used to train its models.
- Mapbox: draws the map in the app and runs place search. To draw the map it receives which map areas you look at; for search, your search terms and a nearby point. With map data sharing on, Mapbox also receives anonymous location and usage data tied to a random identifier Mapbox creates, never to your Twisty account, and it breaks the link between those locations and your session within 24 hours. Turn it off any time with Share map data with Mapbox in Profile, under Beta, or in the map’s (i) menu. Allowing location for Twisty in your phone’s settings is the consent this relies on; turning map data sharing off is the opt-out.
- OpenStreetMap and Overpass mirrors: queried for map features such as peaks, parks and lakes when planning. These receive an area, not an identity.
- Resend: sends password-reset emails. Receives your email address.
- Apple: distributes the iPhone app and processes its subscriptions and refunds under Apple’s own privacy policy. If you switch the map to Apple Maps in Profile, under Beta, Apple draws the map instead of Mapbox.
- Google: distributes the Android app through Google Play and processes its subscriptions and refunds under Google’s own privacy policy. If you switch the map to Google Maps in Profile, under Beta, Google draws the map instead of Mapbox.
- RevenueCat: keeps track of whether your subscription is active, so that what you paid for unlocks on every device you sign in on. It receives the receipt Apple or Google issues for the purchase and an anonymous identifier for your account. It does not receive your card details, because nobody but Apple or Google ever has those, and it does not receive your rides or your location.
- Vultr: hosts our routing server in the United States.
The routing engine itself runs on our own server. Working out your route does not involve Google or Apple at all. Those only come in when you choose to send a finished ride to them, at which point that ride is handled under their privacy policies, not ours.
Where your data lives
On servers in the United States. If you are using Twisty from outside the US, that means your information is transferred to and stored in the US.
How long we keep it
Account data stays until you delete it. Delete your account and it goes: your profile, your saved rides, your folders and your searches are removed together, immediately and permanently. Server logs roll over within 30 days. Backups may hold copies for a short period after deletion before being overwritten.
Your choices and rights
- Delete everything. In the app: profile icon → Delete account, then type DELETE to confirm. It cannot be undone and it takes your rides with it.
- Turn off location. On iPhone: iOS Settings → Twisty → Location. On Android: Settings → Apps → Twisty → Permissions → Location. The app still works: you just tell it where to start instead of it knowing, and you can still plan, save and export rides. Turn-by-turn navigation is the one thing that cannot work without it, because following a route means knowing where you are on it.
- Get a copy, or a correction. Email us and we will send you what we hold or fix what is wrong.
- Stop the emails. The only email we send is the one you ask for: resetting a password. There is no marketing list.
Depending on where you live you may have additional rights under the GDPR, the UK GDPR or the CCPA, including access, correction, deletion, portability, and objecting to processing. We honour those requests for everyone, wherever you are. We do not sell personal information and we do not share it for cross-context behavioural advertising.
Our legal basis (for riders in the UK and EU)
- Performance of a contract: your account, your saved rides, your subscription. Without these the app cannot do what you installed it for.
- Consent: location. You grant it in iOS or Android settings and can withdraw it at any time.
- Legitimate interests: keeping the service running, secure and free from abuse.
Children
Twisty is not directed at children and we do not knowingly collect information from anyone under 13 (or under 16 where local law sets that bar). If you believe a child has created an account, email us and we will remove it.
Security
Everything travels over HTTPS. Passwords are hashed by Supabase. We never see them and cannot recover them. The database enforces per-account isolation at the database level itself, so one account cannot read another’s rides even if the app has a bug. Our server keeps only the ports it needs open, and API keys live on the server, never in the app. No system is perfect, and we will tell you promptly if something happens that affects you.
This website
twistyrides.com sets no cookies and runs no analytics or tracking scripts. Our host keeps standard access logs containing IP addresses for security and troubleshooting.
Changes
If this policy changes in a way that matters, we will update the date at the top and, for anything significant, tell you in the app before it takes effect.
Contact
support@twistyrides.com. It reaches the person who built the app. There is only one.