Privacy policy
What the service records, why, for how long, and how to have it erased. Nothing is sold, nothing is passed on, and nothing serves to follow you elsewhere.
Version 1.1, in force since .
This English version is provided for convenience. Ombra is published in France and governed by French law: in the event of any discrepancy, the French version prevails.
Data controller
The data controller is Jérôme Buisine, sole trader, whose details appear in the legal notice. For any question, or to exercise your rights, write to contact@subalpine.it.
The principle: planning a trip asks for nothing
You can compute a complete route with no account, no email address and no cookie. The service never asks for your location: it starts from two towns you type in. There is no advertising cookie, no commercial tracker, and nothing sold to anyone. Two things are measured, described just below: traffic, which cannot follow you and therefore asks for nothing; and session recording, which could — and which, for that reason, only starts after your explicit consent.
What follows describes the little that is recorded, and why each line exists.
Traffic measurement, and why it asks for nothing
Ombra measures its traffic with <fort>Umami, open-source software installed on our own server</fort>. The measurement script and the address receiving the statistics are served by this domain: no request goes to another host, and no third party sees your visit.
No cookie is set and no identifier is stored on your device. To tell two visits apart, a fingerprint is computed from your IP address and your browser, mixed with a secret value that changes every day. The IP address is used for that computation and then forgotten: Umami writes it nowhere — verified against the database schema, no column holds it. As any server does, ours does keep a trace of it in its technical logs, for security and fault diagnosis; they are kept for 14 days, then erased automatically.
The daily change has a consequence worth stating: coming back tomorrow counts you as a new visit, and nothing can connect the two. We lose the measure of returning visitors; we gain the technical impossibility of following you over time.
The fingerprint is specific to each site: moving from Ombra to another SubAlpine product produces two unrelated identifiers. That is a property of the computation, not a policy we impose on ourselves.
Recorded: pages viewed, timestamp, the site you came from where applicable, browser, operating system, device type, screen size, language and an approximate location (country, region, city). Neither your IP address nor any account identifier. Retention: 25 months at most, then automatic erasure.
Session recording, which does ask for your consent
The traveller app can record what you do on screen — pointer movements, scrolling, typing — to understand where it gets stuck. Displayed text is masked as it is captured (strict masking), but the technique remains of a different nature from traffic measurement: no exemption applies to it.
Nothing starts without your explicit consent. This is not a declaration of intent: the recording script is a separate 190 KB file, and until you accept, it is not even downloaded. Declining therefore does not mean “collect then discard” — there is nothing to discard.
If your browser sends Global Privacy Control or Do Not Track, you are never asked: you have already answered.
Withdrawing is exactly as simple as consenting, and is done from this page, without an account. It takes effect immediately — the page reloads to stop any capture in progress. Retention: 30 days, then automatic erasure.
The home page you are reading records nothing: the mechanism lives only in the app.
What is recorded, and for how long
Data Why Legal basis Retention The computed plan — towns, times, chosen stops Making the plan’s address openable, shareable and readable offline Legitimate interest: without it, a plan would vanish when the tab closes 90 days, then automatic erasure Your email address, if you create an account Recognising you from one visit to the next, and sending you the sign-in code Performance of the service you asked for Until you delete your account, and at most 24 months after your last sign-in — an email warns you 30 days ahead, and signing in again cancels the notice The six-digit sign-in code Authenticating you once Performance of the service 1 day. It is not kept in the clear either: the database holds a fingerprint, useless for signing in Your open sessions Sparing you a new code at every visit Performance of the service 7 days after the session expires Your travel preferences Not asking for them again on every trip Performance of the service Until you delete your account — they leave with it, including when the deletion comes from inactivity Your type of vehicle, if you fill it in Estimating what the trip costs in fuel and tolls, and what the motorway would have cost Your consent, withdrawable by clearing the field In your preferences, until you delete your account. Copied into a computed plan, it follows that plan’s 90 days Your address, if you ask to be told about a region Sending you one message, once, when it opens Your consent, withdrawable at any time Until you ask to be removed The vehicle, and why it stays optional
Six categories, no more — petrol city car, diesel saloon, petrol SUV, electric car, campervan, motorbike. What they describe is not a car, it is a way of burning fuel: no make, no model, no registration, no exact engine. Enough to estimate a tankful, not enough to pick you out in a car park.
The field can stay empty, and nothing suffers for it. The estimate is then made with an average vehicle, and says so beside the figure rather than letting it pass for measured. Filling in your category does not change the route you are offered: it sharpens an estimate, and that is all. Hence the legal basis chosen — consent, not performance of the service, because the service is rendered perfectly well without it.
What you fill in serves the cost calculation, and nothing else. The vehicle plays no part in choosing stops, sorts nobody into a group, and appears in no statistic — not even an aggregated one: on a service this size, crossing a type of vehicle with a trip soon gives a person back. The log described in the next article does not carry it either, and it reaches no third party.
Clearing the field is enough to withdraw your consent: later trips will be estimated with the average vehicle. Plans already computed keep theirs — a saved plan is fixed, which is what lets it show the same figures six weeks later — and are erased at their ninety-day term, or with your account if you delete it sooner.
The decision log, and why it is not in that table
For every stop it suggests, Ombra keeps the criteria that led to the choice: the detour, the shade, the time, the amenities, the quiet. That is what makes it possible to explain a choice, and to tune the weights of the calculation over time.
These lines carry no personal data: no account identifier, no address, no link to a trip. They describe a place and a score, nothing else — they attach to nobody, and so there is nothing in them to erase. That is also why they are never purged: their value for calibrating the calculation grows with age.
What stays in your browser
The token that keeps you signed in and the plans you have opened live in your browser’s storage, so that your plan stays readable in a valley with no signal. They are not sent anywhere, and they clear entirely on sign-out as on account deletion: a plan cannot outlive on the device an erasure just carried out on the server.
What leaves the server
The stack is self-hosted: the map, the routing and the search for stops all happen on our own server, in France. Three outside services are nonetheless called on, and every line matches a request that is genuinely sent.
Service Role What reaches it Country OVH SAS Server hosting and email delivery All of the service’s data France Base Adresse Nationale (DINUM) Looking up the towns and addresses you type The text typed into the start and end fields France Open-Meteo Temperature forecast, which weights the search for shade The approximate coordinates of the trip and its date Germany All are in the European Union: no transfer outside the EU takes place. The base map is served by SubAlpine.it, on the same server — so your browser asks no tile of an outside provider, who would then see the area you are looking at.
No data is sold, rented or passed on, and no marketing message is sent. The only emails the service sends are a sign-in code and, if you asked for it, the opening of your region.
Your rights
You have rights of access, rectification, erasure, restriction, objection and portability over the data concerning you.
Two of them need no message to us: your trips and your preferences are visible in the app, and deleting your account — which takes everything with it — happens there in two gestures, with no delay and no confirmation step. For the others, or if you would rather go through us, write to contact@subalpine.it; we answer within a month.
Erasure also happens without you in the end. After 24 months without a sign-in we no longer have a reason to keep your address: an email warns you, and if we hear nothing back the account is deleted 30 days later, along with your trips and your preferences — exactly as if you had done it yourself. Signing in again cancels the notice, and there is nothing else to do, either way.
If the answer does not satisfy you, you can refer the matter to the French data protection authority, the CNIL.
Security
Exchanges with the service are encrypted (HTTPS). Sign-in codes are not kept in the clear, and the secret that makes their fingerprints uncomputable does not live in the database: a copy of it would therefore not be enough to open a session.
The service runs on a single machine, with no redundancy. We do not promise invulnerability: we describe what is in place, and a breach concerning you would be notified to you under the terms laid down by the GDPR.
Changes to this policy
This page may change along with the service. The version in force is the one published here, with its date. A change that widened what is collected, or lengthened a retention period, would be announced before taking effect.