Legal

Privacy Policy — SassaGold Studios

Last updated: 21.10.2026

One policy per app. This policy covers the Vegvísir app and the sassagold.com website. Our other apps have their own policies: 1001 Excuses Privacy Policy · Kvitro Privacy Policy · Smiðja Privacy Policy · Akstur Privacy Policy.

Your privacy is important to us. This Privacy Policy explains what data Vegvísir ("the app") collects, how it is used, and the rights available to you. We are committed to processing only the minimum data necessary to provide a working product.

1. Data Controller

The data controller responsible for the app is SassaGold Studios Hilmarsson (org. no. 838 322 522, Norway). You can contact us at any time at support@sassagold.com.

2. Data We Collect

Vegvísir is built on a principle of minimal data collection. We do not collect personal data through the app, do not track your identity, and do not share information with third parties.

The app stores and processes the following data locally on your device only:

  • Precise location — your device's GPS coordinates are used to:
    • Show your current position and address
    • Find nearby food, accommodation, fuel stations & services
    • Display local weather and road conditions
    • Record ride distance and route in the Trip Logger — even when the app is closed or not in use

    To deliver these features, your anonymous coordinates are sent to the following services. No personal data accompanies these requests; only the coordinates needed to answer the query are transmitted.

    • Our own place-search server (overpass.sassagold.com) — nearby points-of-interest search. It answers from our own copy of OpenStreetMap data, or passes the query on to the public Overpass API
    • Overpass API — used directly only when our place-search server cannot be reached
    • OpenStreetMap Nominatim — reverse geocoding (address lookup)
    • Open-Meteo — local weather and road-condition data
    • Wikipedia API — place descriptions and information
    • OpenStreetMap tile servers — map imagery; requests indicate the map area you are viewing

    Our place-search server logs no IP addresses and no positions. It keeps search results for each map area for up to 7 days, so the next search nearby is faster; that cache holds places, not people, and nothing in it ties a search to you or your device. Your location is never used for advertising or profiling, and never sold or shared for any commercial purpose.

  • Language preference — your chosen language is saved on-device so the app remembers it between sessions.
  • Cached content — points of interest and other app data cached on your device for offline access.

Update checks. The app checks our own update server (updates.sassagold.com) for new versions. Each check carries the app version, the platform and a random installation number that the update library generates; the server uses them only to pick the right update and logs none of them.

We do not collect names, email addresses, device identifiers, IP addresses, usage analytics, crash reports, or any other personally identifiable information through the app.

Support key. If you buy the optional one-time support key (version 1.4.23 and later), the purchase is made through Google Play or the Apple App Store under their terms. We never see your name, card or address; the app only asks the store whether the key is owned on your account and keeps that answer on your device.

3. Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation (EU) 2016/679 ("GDPR") applies, we rely on the following legal bases:

  • Legitimate interests (Art. 6(1)(f)) — for on-device storage of language preferences and cached content, which is necessary to provide basic app functionality.
  • Consent (Art. 6(1)(a)) — for on-device location processing, where you have granted the location permission after reviewing the in-app disclosure. You may revoke this consent at any time through your device settings.
  • Contract (Art. 6(1)(b)) — for asking the store whether the support key you bought is active.

4. How We Use Data

The minimal data described above is used solely to provide core app functionality. Location coordinates are sent anonymously to our own place-search server, OpenStreetMap Nominatim, Overpass API, Open-Meteo, Wikipedia and the OpenStreetMap tile servers solely to resolve each feature request; we keep no record of who asked or from where (the per-area search cache is described in section 2). The Trip Logger stores route data locally on your device — it is sent nowhere unless you share a ride card or export a backup yourself (version 1.4.22 and later), in which case the file goes where you send it. Version note: versions 1.1.7 to 1.4.0 also sent recorded routes to router.project-osrm.org to snap them to roads for display; this was removed in 1.4.1. App settings and cached content enable offline access. No data is ever used for advertising or profiling, and no data is sold or shared with any third party for commercial purposes.

5. Data Retention

  • On-device data — retained until you clear the app's storage or uninstall the app.
  • Place-search cache — search results for each map area, kept on our server for up to 7 days and then deleted automatically. It holds places, not people.
  • Cached places and weather — refreshed after 24 hours on your device; emergency information after 30 minutes.
  • Purchase record — kept by Google Play or Apple for as long as your support key is active, so it can be restored on a new device.

6. Data Storage and International Transfers

Your rides, settings and other app data are stored locally on your device and never uploaded to us. Place searches and update checks pass through our own servers, which run on Cloudflare's global network and keep no logs of them. Those servers run in the European Economic Area (EEA) or in countries that the European Commission has determined provide an adequate level of data protection. Where transfers outside the EEA occur, we apply appropriate safeguards in accordance with GDPR Chapter V.

7. Cookies and Tracking

The Vegvísir app does not use cookies or any equivalent tracking technologies. This website (sassagold.com) does not use analytics cookies, advertising cookies, or fingerprinting scripts. No third-party tracking code is loaded on any page.

8. Third-Party Services

The app integrates the following external APIs to deliver core features. No user account, device identifier, or persistent tracking identifier is sent to any of these services — only the anonymous coordinates or search terms required to answer each request.

  • OpenStreetMap Nominatim — reverse geocoding to display your current address. Governed by the OpenStreetMap Foundation Privacy Policy.
  • Overpass API — the public OpenStreetMap search service for nearby points of interest (food, fuel, accommodation, services). Our place-search server passes on the queries it cannot answer from its own copy, so Overpass sees our server, not your device; the app asks Overpass directly only when our server cannot be reached. Governed by the Overpass API terms.
  • Cloudflare — runs our place-search and update servers. Like any network host it handles your IP address to deliver each response; we have not enabled any request logging. Governed by the Cloudflare Privacy Policy.
  • Open-Meteo — fetching local weather and road-condition data. Governed by the Open-Meteo Terms. Open-Meteo does not require an API key and does not identify individual users.
  • OpenStreetMap tile servers — fetching the map imagery shown in the app. Tile requests reveal the map area being viewed. Governed by the OSM Tile Usage Policy.
  • Wikipedia API — retrieving place descriptions and articles. Wikipedia is a public service operated by the Wikimedia Foundation; see their Privacy Policy.

The app does not integrate third-party analytics, advertising SDKs, or tracking services. All fonts are self-hosted — no requests are made to Google Fonts or any other external font service. Google Play and the Apple App Store may collect data when you download or update the app, and process payment if you buy the support key, under Google's Privacy Policy and Apple's Privacy Policy.

9. Children's Privacy

Vegvísir is not directed at children under the age of 13 (or 16 where required by local law). We do not knowingly collect any information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access — request a copy of any personal data we hold about you.
  • Rectification — ask us to correct inaccurate data.
  • Erasure ("right to be forgotten") — ask us to delete your data.
  • Restriction — ask us to restrict how we use your data.
  • Portability — receive your data in a structured, machine-readable format.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Because we do not collect personal data through the app itself, there is usually nothing for us to hand over or delete — your data is on your phone. To exercise any right, contact us at support@sassagold.com. We will respond within 30 days.

California residents (CCPA/CPRA): We do not sell or share personal information as defined under the California Consumer Privacy Act. You have the right to know, delete, and opt out of the sale/sharing of your personal information. To exercise these rights, contact us at the address above.

11. Supervisory Authority

If you are located in the EEA and believe we have not handled your data in accordance with the GDPR, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu.

12. Security

We apply reasonable technical and organisational measures to protect any personal data we process. Since app data is stored only on your device, the security of that data depends primarily on your device's own security. Our own servers use industry-standard access controls and encryption in transit.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the app after an update constitutes acceptance of the revised policy.

14. Contact

For any questions or concerns about this Privacy Policy or your personal data:
support@sassagold.com