Privacy
Last updated: 20 July 2026
In short: LoopMaker has no accounts, no cookies and no ads. Your location is only sent to the routing and weather services needed to build your route, your saved routes stay in your own browser, and visit statistics are anonymous.
What LoopMaker is
LoopMaker (loopmaker.app) has no user accounts and keeps no database of its visitors. A small server component forwards routing requests and, when you share a route, stores that route under a random id and renders its preview image (see below). It builds no profile of you and does not log your routes against you.
Location data
To generate a route, the coordinates of your chosen start point (your device location if you tap "My location", or a point you search or tap on the map) are sent to:
- HeiGIT / OpenRouteService — computes the route and resolves address searches. Your browser sends these coordinates to LoopMaker's own server, which forwards the request to HeiGIT (this keeps our API key private); the coordinates are used only to build your route and are not stored;
- Open-Meteo — provides the weather shown for your start point (called directly from your browser).
Your device location is only read after you grant browser permission, and it is never stored by LoopMaker.
Sharing a route
When you share a route, its geometry is stored on our server under a short, unguessable id so the link stays short, and a preview image is generated so it shows a card in chat apps. A stored route contains only the route line, its distance and the name you see — no personal data and no link to you. Anyone with the link can open it; we don't track who does. Sharing a heatmap link works the same way: the geometry of every route you selected is stored together under one id. Heatmap images are rendered entirely on your device and never touch our server.
Public routes on Explore (optional)
Publishing a route to the Explore page is strictly opt-in, per route, via the 🌍 button in your library. A published route is visible to everyone and contains the route line (including its exact starting point), its name, distance, climb, a town or city label, and the date it was published — no account, no identity, nothing that links it to you. Don't publish routes that start at your home. You can unpublish at any time from your library: your browser keeps a secret token for each route you publish (synced along, encrypted, if you use route sync), and only that token can remove the route. Anyone can report a route; reported routes are hidden immediately and reviewed manually.
Syncing routes (optional)
If you turn on route sync, it works without an account and without us being able to read your routes. Your device generates a secret sync code; from it, your browser derives an encryption key and an anonymous id. Your saved routes are end-to-end encrypted on your device and only the ciphertext is uploaded, stored under that id. We never receive the code or the key, so we cannot decrypt your routes or tie them to you — we just hold an unreadable blob. No email, no password, no cookies. The code is the only key: if you lose it, the synced copy can't be recovered.
Third-party services
Like any website loading external resources, these services see your IP address when your browser contacts them:
- OpenStreetMap and CARTO — map tiles (CARTO by default, OpenStreetMap as an automatic fallback or if you pick it in settings; OpenStreetMap tiles are also loaded by our server to draw share-preview cards);
- bhosted — the web host that serves the site and its routing proxies. The proxies forward route requests server-side to OpenRouteService (HeiGIT) and, as a fallback, Valhalla (FOSSGIS / OpenStreetMap Deutschland); your browser never contacts those directly;
- unpkg (CDN) — serves the Leaflet map library.
If you tap the ☕ button, you go to PayPal — that interaction is governed by PayPal's privacy policy.
Stored in your browser only
Your settings (theme, units, pace), routes you save with ⭐, and your sync code (if you create one) live in your browser's local storage — not cookies. They never leave your device (routes are only uploaded, encrypted, if you turn on sync), and you can remove them by clearing the site's browsing data.
Visit statistics
We count visits with GoatCounter, a privacy-friendly analytics service. It uses no cookies and builds no personal profiles; it records anonymous, aggregated data such as page views, referrer, browser type and country. Your IP address is not stored and no data is shared or sold.
No cookies, no ads, no sale of data
LoopMaker sets no cookies — not for logins, preferences or tracking (preferences use local storage instead, and our GoatCounter analytics is cookieless). It shows no ads and never sells or shares personal data. The only cookies that could ever appear would be set by the third-party services listed above under their own policies, never by us.
Contact
Questions or ideas? hello@weroel.nl