Legal

Privacy Policy — SassaGold Studios

Last updated: 13.10.2026

One policy per app. This policy covers the Vegvísir app and the sassagold.com website. Our other apps have their own policies: 1001 Excuses Privacy Policy · Kvitro Privacy Policy.

Your privacy is important to us. This Privacy Policy explains what data Vegvísir ("the app") collects, how it is used, and the rights available to you. We are committed to processing only the minimum data necessary to provide a working product.

1. Data Controller

The data controller responsible for the app is the Vegvísir team. You can contact us at any time at [email protected].

2. Data We Collect

Vegvísir is built on a principle of minimal data collection. We do not collect personal data through the app, do not track your identity, and do not share information with third parties.

The app stores and processes the following data locally on your device only:

  • Precise location — your device's GPS coordinates are used to:
    • Show your current position and address
    • Find nearby food, accommodation, fuel stations & services
    • Display local weather and road conditions
    • Record ride distance and route in the Trip Logger — even when the app is closed or not in use

    To deliver these features, your anonymous coordinates are sent to the following services. No personal data accompanies these requests; only the coordinates needed to answer the query are transmitted.

    • Our own place-search server (overpass.sassagold.com) — nearby points-of-interest search. It answers from our own copy of OpenStreetMap data, or passes the query on to the public Overpass API
    • Overpass API — used directly only when our place-search server cannot be reached
    • OpenStreetMap Nominatim — reverse geocoding (address lookup)
    • Open-Meteo — local weather and road-condition data
    • Wikipedia API — place descriptions and information
    • OpenStreetMap tile servers — map imagery; requests indicate the map area you are viewing

    Our place-search server logs no IP addresses and no positions. It keeps search results for each map area for up to 7 days, so the next search nearby is faster; that cache holds places, not people, and nothing in it ties a search to you or your device. Your location is never used for advertising or profiling, and never sold or shared for any commercial purpose.

  • Language preference — your chosen language is saved on-device so the app remembers it between sessions.
  • Cached content — points of interest and other app data cached on your device for offline access.

Update checks. The app checks our own update server (updates.sassagold.com) for new versions. Each check carries the app version, the platform and a random installation number that the update library generates; the server uses them only to pick the right update and logs none of them.

We do not collect names, email addresses, device identifiers, IP addresses, usage analytics, crash reports, or any other personally identifiable information through the app.

Waitlist. If you join our pre-launch waitlist on this website, we collect the email address you provide solely to notify you when the app is released. This email is stored securely and is never used for marketing, sold, or shared with third parties. You may request removal at any time by emailing [email protected].

3. Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation (EU) 2016/679 ("GDPR") applies, we rely on the following legal bases:

  • Legitimate interests (Art. 6(1)(f)) — for on-device storage of language preferences and cached content, which is necessary to provide basic app functionality.
  • Consent (Art. 6(1)(a)) — for on-device location processing, where you have granted the location permission after reviewing the in-app disclosure. You may revoke this consent at any time through your device settings.
  • Consent (Art. 6(1)(a)) — for waitlist email collection, where you have actively submitted your address.

4. How We Use Data

The minimal data described above is used solely to provide core app functionality. Location coordinates are sent anonymously to our own place-search server, OpenStreetMap Nominatim, Overpass API, Open-Meteo, Wikipedia and the OpenStreetMap tile servers solely to resolve each feature request; we keep no record of who asked or from where (the per-area search cache is described in section 2). The Trip Logger stores route data locally on your device — it is never uploaded. Version note: versions 1.1.7 to 1.4.0 also sent recorded routes to router.project-osrm.org to snap them to roads for display; this was removed in 1.4.1. App settings and cached content enable offline access. Waitlist email addresses are used only to send a single notification when the app launches. No data is ever used for advertising or profiling, and no data is sold or shared with any third party for commercial purposes.

5. Data Retention

  • On-device data — retained until you clear the app's storage or uninstall the app.
  • Place-search cache — search results for each map area, kept on our server for up to 7 days and then deleted automatically. It holds places, not people.
  • Waitlist emails — retained until the app launches or until you request deletion, whichever comes first. After the launch notification is sent, email addresses are deleted.

6. Data Storage and International Transfers

Your rides, settings and other app data are stored locally on your device and never uploaded to us. Place searches and update checks pass through our own servers, which run on Cloudflare's global network and keep no logs of them. Waitlist emails may be stored on infrastructure located in the European Economic Area (EEA) or in countries that the European Commission has determined provide an adequate level of data protection. Where transfers outside the EEA occur, we apply appropriate safeguards in accordance with GDPR Chapter V.

7. Cookies and Tracking

The Vegvísir app does not use cookies or any equivalent tracking technologies. This website (sassagold.com) does not use analytics cookies, advertising cookies, or fingerprinting scripts. No third-party tracking code is loaded on any page.

8. Third-Party Services

The app integrates the following external APIs to deliver core features. No user account, device identifier, or persistent tracking identifier is sent to any of these services — only the anonymous coordinates or search terms required to answer each request.

  • OpenStreetMap Nominatim — reverse geocoding to display your current address. Governed by the OpenStreetMap Foundation Privacy Policy.
  • Overpass API — the public OpenStreetMap search service for nearby points of interest (food, fuel, accommodation, services). Our place-search server passes on the queries it cannot answer from its own copy, so Overpass sees our server, not your device; the app asks Overpass directly only when our server cannot be reached. Governed by the Overpass API terms.
  • Cloudflare — runs our place-search and update servers. Like any network host it handles your IP address to deliver each response; we have not enabled any request logging. Governed by the Cloudflare Privacy Policy.
  • Open-Meteo — fetching local weather and road-condition data. Governed by the Open-Meteo Terms. Open-Meteo does not require an API key and does not identify individual users.
  • OpenStreetMap tile servers — fetching the map imagery shown in the app. Tile requests reveal the map area being viewed. Governed by the OSM Tile Usage Policy.
  • Wikipedia API — retrieving place descriptions and articles. Wikipedia is a public service operated by the Wikimedia Foundation; see their Privacy Policy.

The app does not integrate third-party analytics, advertising SDKs, or tracking services. All fonts are self-hosted — no requests are made to Google Fonts or any other external font service. The Google Play Store may collect data when you download or update the app, as governed by Google's Privacy Policy.

9. Children's Privacy

Vegvísir is not directed at children under the age of 13 (or 16 where required by local law). We do not knowingly collect any information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access — request a copy of any personal data we hold about you.
  • Rectification — ask us to correct inaccurate data.
  • Erasure ("right to be forgotten") — ask us to delete your data.
  • Restriction — ask us to restrict how we use your data.
  • Portability — receive your data in a structured, machine-readable format.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Because we do not collect personal data through the app itself, the main area where these rights apply is the waitlist. To exercise any right, contact us at [email protected]. We will respond within 30 days.

California residents (CCPA/CPRA): We do not sell or share personal information as defined under the California Consumer Privacy Act. You have the right to know, delete, and opt out of the sale/sharing of your personal information. To exercise these rights, contact us at the address above.

11. Supervisory Authority

If you are located in the EEA and believe we have not handled your data in accordance with the GDPR, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu.

12. Security

We apply reasonable technical and organisational measures to protect any personal data we process. Since app data is stored only on your device, the security of that data depends primarily on your device's own security. For waitlist emails, we use industry-standard access controls and encryption at rest and in transit.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the app after an update constitutes acceptance of the revised policy.

14. Contact

For any questions or concerns about this Privacy Policy or your personal data:
[email protected]