Privacy Policy

VADO, the iOS app, and the VADO Places board.

Last updated: 26 October 2026

Who is responsible

TILT S.R.L., Via Nazario Sauro 26, 24123 Bergamo, Italy, VAT 04648930164 ("we") publishes the VADO app and runs the VADO Places board server. We are the data controller for the small amount of data described here.

Contact: vado@tilt.computer

The short version

VADO records your bike rides on your phone and keeps them there. There is no account and no login. Nothing you record is sent anywhere unless you switch on one of the two sharing features yourself, and each one shows you what it sends, with an example, before you turn it on. We run no analytics, no crash reporting and no advertising, and VADO does not track you across other apps or websites.

What stays on your phone

Everything VADO records lives in the app's own storage on your device:

• your rides, including the full GPS route, distance, duration, speed and elevation gain
• the Home, Work and other places you set, and the optional names you pick for them from Apple Maps
• your settings
• a diagnostic event log, used to investigate tracking problems

We cannot see any of it. There is no cloud sync, no backup held by us, and no way for us to read your device. Deleting the app deletes all of it.

What can leave your phone, and only because you asked

1. The ranking, on the Places board (off by default)

If you turn on "Join the ranking" ("Share with your workplace" in earlier versions), you can give any of your places except Home a name in the ranking: a business you pick from Apple Maps, such as your employer, your gym or your children's school. VADO then sends one line for each ride that starts, stops or ends at one or more of those named places to a server we run at api.vado.tilt.computer, and while it records any ride it tells that server a ride is under way (see "While you ride" below).

Each line contains:

• an identifier for that ride, generated at random on your phone
• the identifier and name of each named place the ride started at, stopped at or ended at, as Apple Maps supplies them, in the order the ride reached them
• the coordinate of each of those places, as Apple Maps supplies it
• the calendar date of the ride, with no time of day
• the distance in metres
• how long the ride took, stops included, or for a ride joined across a stop the riding time of its parts, in seconds

Alongside it your phone sends yes or no answers: for each place it names, whether this is the first ride you have sent to that place this week, this month, this year, and ever; and the same four answers for the first ride you have sent to any place. That is how the board can report how many people cycle to a place, and how many in a province and in total, without knowing who they are. It also sends the calendar date of the send itself, so a count lands in the right week.

The request carries a key that is identical in every copy of the app. It is not personal to you and it does not identify your device.

What is never sent: your route, any coordinate of where you actually rode or stopped, your Home location or its name, your elevation, your name, your email address, and any device or advertising identifier. A ride that does not start, stop or end at a named place sends no line, only the notice below. The line carries no time of day; the server learns when a ride starts and ends only from that notice, and keeps it for two hours at most.

Your speed is not sent either, but the distance and the duration together give a ride's average speed, so the server can work that one figure out.

The only coordinates that leave are the named places' own, the point Apple Maps holds for each business. Two people who pick the same business send the same value, so it says nothing about where either of them went. Each is stored against its place and never against a ride, and no page or request ever hands one back out.

While you ride. While VADO records any ride, wherever it goes, your phone tells the server that a ride has started, and again when it ends. With it go a random code, new for every ride and different from the ride's identifier above, and the province of one of your named places (your workplace's when it is on the board, otherwise the one with the most riders), once your phone has learned it from the board. Nothing else: no position, no time (the server uses its own clock), no place. The server keeps this in memory only, never in a database or a log, and forgets it when the ride ends, or two hours after it started if your phone cannot tell it. That is how the board shows the people sharing with it how many rides are under way right now, in their province and in total. The public board page shows anyone the same count, in every province on the board and in total. It is part of the Places board and is on whenever the board is.

What the server stores: the ride lines above, which named places each ride went through (not the order it reached them in), the place names and coordinates, the province and city we resolve from each coordinate, and running totals per place. The rides under way are held in memory only, for two hours at most. There is no column anywhere that identifies a rider, a device or an installation, and there is no account for anything to attach to.

The province comes from OpenStreetMap. When you share a ride, we send the coordinate of each named place to Nominatim, the geocoding service run by the OpenStreetMap Foundation, so we can tell which province the place is in. We send nothing else, and we send it once per place. Province and city names come from OpenStreetMap.

© OpenStreetMap contributors

Your IP address is not stored. The server sees it, as every web server does, and uses it only to limit how many requests one connection can make. It is turned into a one-way digest under a secret that is regenerated every time the server restarts, held in memory, and never written to a database, a log file or an error report. Access logging on the web proxy in front of the server is switched off.

Honesty about anonymity. The board holds nothing that names you. That is not the same as promising a record could never be traced back. A line says something like "someone rode from this office to this gym on this date, this far", or "stopped at this school, then rode to this office". At a place where only one or two people use VADO, someone who already knows your trips could recognise it by its places, distance or duration. A school is the sharpest case: at a large employer, the lines naming it and one school are in effect one family's dated drop-off days. Lines naming the same places can be linked in this way even though nothing in them names a person. And on the public board, two places that share their only rider show the same rides, distance and time, which tells any reader that whoever rides to that office also goes to that gym or school. We therefore treat these records as pseudonymous rather than anonymous, and that is exactly why the payload is as small as it is.

The count of rides under way has three weaknesses of the same kind. Where a province has only one place on the board, its count, which anyone can read on the public board page, says that place's riders are riding at this moment. Anyone reading that page, which shows the count beside the board, can match the end of a ride to the record of a place it counts for, and so learn when that ride started and ended and how far it went: a commute, a gym visit or a school drop-off, to the minute. And since the page is public, anyone can save the count over time: the two hours bind our server, not the copies others keep.

The board is public. It lists places, never people, and anyone can read it at vado.tilt.computer/board.

2. Strava export (off by default)

If you connect a Strava account and turn sharing on, VADO uploads finished rides to your own Strava account. By default it sends only commutes.

This is a transfer you direct to a third party you hold an account with. What is sent is the ride itself: either a GPX file of the recorded track, or the numbers alone if you switch the route off. Your Strava tokens are stored in your device's Keychain and are never sent to us.

VADO asks Strava for permission to write activities and to read the activity it has just uploaded. It does not read your Strava history, your profile, your followers or your private activities. Strava's own privacy policy governs what happens to a ride once it arrives there.

Two consequences worth knowing. Strava offers no way to delete an activity through its API, so a ride published there cannot be removed by VADO, and deleting the ride on your phone leaves it on Strava. And "muting" a ride hides it from your followers' feeds without making it private. Only your own Strava visibility setting does that.

Apple services

Maps inside VADO are drawn by Apple's MapKit, so showing a map fetches tiles from Apple. When you search for an address or pick a place's name, the text you type and the map area you are looking at are sent to Apple to answer that search. This happens only while that screen is open, it never involves a recorded ride, and we receive none of it. Apple's privacy policy governs it.

The diagnostic log

VADO keeps an event log on your device so tracking faults can be investigated, and the Diagnostics screen can export it. Nothing is exported on its own and nothing reaches us automatically.

If you choose to send us a log to help diagnose a problem, please know it is not free of location data. It records the position of the temporary geofence the app parks as you ride, which amounts to a coarse trace of your route and of the areas around your places. Send one only if you are comfortable with that, and only to someone you intend to.

What we never do

• no analytics, no usage statistics, no telemetry of any kind
• no crash reporting
• no advertising, no advertising identifier, no profiling
• no tracking of you across other companies' apps or websites
• no third-party SDKs inside the app
• no sharing with data brokers
• no selling, renting or trading of any data at all

How long things are kept

We keep no database backups that outlive the 12-month record promise.

What you can take back, and what you cannot

Deleting a ride in VADO removes its record from the board, the next time the app can reach the server.

It does not undo the count. The totals are numbers with no memory of who added to them, so "someone rode here that week" remains. Nothing can undo that, including us.

Turning sharing off stops future rides being sent. It is not retroactive in either direction: rides already sent stay, and rides finished while sharing was off are never sent afterwards, unless you ride on, or reach one of your places, within an hour and a half.

Deleting the app retracts nothing, because there is no account to retract through. If you want your records off the board, delete the rides inside the app first and let it run once with a connection.

Your rights

If you are in the EU or the UK you have the right to access, correct, erase, restrict and object to the processing of your personal data, the right to data portability, and the right to complain to a supervisory authority. In Italy that is the Garante per la protezione dei dati personali.

Please note what our design means in practice. Everything VADO records is already in your hands, on your device. The board holds nothing that identifies you, so we cannot find "your" records by being told who you are. The only thing that can identify them is the app on your phone, which holds the identifier of every ride it sent. Erasing a board record therefore happens through the app, as described above. If that route does not work for you, write to us and we will help.

Legal basis

We rely on your consent for the Places board, given by the switch and the confirmation screen that shows you what is sent, with an example. Twice, people who were already sharing were told through this policy and the app's change notes rather than asked again: when the notice sent while you ride was introduced, and when the ranking opened to every place, which also started sending rides their screen had not shown, rides that leave work and come back to it and rides from work to somewhere other than home. A name you give a place is covered by the consent you gave on that screen, whenever you give it, and shows no new one. You can withdraw it at any time by turning sharing off. The Strava export is a transfer you initiate yourself, to your own account with a third party.

Where the data is

The board server and its database run on Hetzner infrastructure in Germany, and the rides and totals stay there. The one thing that leaves is each named place's coordinate described above, sent once per place to Nominatim, which is run by the OpenStreetMap Foundation, a non-profit registered in the United Kingdom. Nothing about a ride and nothing about you goes with it.

Children

VADO is not directed at children and we do not knowingly collect anything from them.

Changes to this policy

If this policy changes we will update this page and the date at the top. A change that would widen what leaves your device changes the screen that asks for your consent in the same release that starts sending it. People already sharing are not asked again: the app's change notes and this page tell them.

Contact

vado@tilt.computer