Privacy

What we hold, and why.

Last updated 2026-10-16

plotholes.app is run by Tristan Watson, trading as plotholes.app, in the United Kingdom. We are the data controller for everything on this page. Reach us at tristan@triwats.com.

The short version

Browse the map without an account — we never need to know who you are. Sign in and connect a ride and you are part of the network: the spots you tapped join the shared map. We keep the spots, never your route. Nothing has been sold to anyone.

Browsing without an account

No account, no sign-in, no profile. Our host, Cloudflare, handles your request and sees your IP address to serve the page and stop abuse. We don't build a profile from it. The map itself is drawn from OpenFreeMap tiles, so your browser asks them for the squares of map you are looking at — they say they keep no user database and set no cookies.

If you sign in

Your email — to sign you in with a magic link. No passwords.
A display name and km/miles, if you give them.
A Strava connection, if you make one: your Strava athlete ID and access tokens, encrypted at rest.
A list of rides you've analysed — name, how many holes, when, and a fingerprint of the ride so we don't count the same one twice.
The spots you tapped — for each tap: its latitude and longitude, the time on your ride when you tapped, which connector it came from, which ride and which rider it belongs to, a confidence score, and the local authority district it falls in. We also keep your heading and speed at that instant — they tell us which way you were going, so we can put the tap on the right road and the right carriageway. Once we have matched it we keep the tap moved onto the centre line of that road, the road's name, and a reference to the hundred-metre stretch it sits on. Where your device reports one we keep how accurate it thought the fix was, and if several taps in a row were plainly the same hole we keep a note of how many we folded together. That is the whole record of a tap. We never keep your route or track, the ride file itself, or your heart rate — only the moments you flagged, never the journey between them.

To work out which road a tap sits on, our server asks OpenFreeMap for the same square of map your browser would have asked for anyway — about 1.5 km across, with nothing attached to say who tapped, when, or where in the square. It's the only thing that leaves us, and we keep a copy so we rarely have to ask twice.

What being signed in means

Anyone can browse. The moment you connect a ride or upload a file, the spots you tapped go into the shared map — that is what an account here is for, and there is no separate switch. If you would rather not contribute, browse without connecting anything. To stop after you have started, delete your account (below).

What's on the public map

Every reported pothole is shown on the map, at street level. Its mark gains rings as more rides and riders report the same stretch. The network is young, and we would rather show you your own road than an empty map. We will revisit that as soon as people who don't know each other are tapping near each other's homes. Quiet months take rings back. If nothing new is tapped there for 365 days — or 10 rides go over it without a tap — the mark fades to history and is marked as possibly repaired. It is never deleted, and no ride is stored to count those passes: only the number.

What is public carries: the position, the road name where we matched one, how many riders and how many taps, when it was first and last seen, confidence and severity scores, the local authority district, and a tally of which connector types produced it. Your heading and your speed are never published, and never go into any extract. Nothing on the map carries your name, your email, your ride, or any part of your route.

A single ride of yours can put a visible mark on the map. Tap where you're content to be seen tapping — the same care you'd take with a public Strava activity.

Strava

Strava is a connector, nothing more. With your permission we read the activity you ask us to analyse (and new rides automatically, if you enable that), take the lap taps out of it, and write nothing back unless you separately switch on ride-description write-back. We cache an analysed ride for up to six days to save API calls, then it's deleted. Disconnect any time in your settings.

Why we're allowed to hold it (lawful basis)

Your account, signing you in, showing you your own rides — performing our agreement with you (UK GDPR Article 6(1)(b)).
Putting the spots you tapped into the shared map — the same agreement. Contributing is the service, not an add-on. We deliberately don't call this “consent”: consent has to be a free choice you could decline and carry on regardless, and here it isn't one.
Area statistics, and any future aggregated extract for highways authorities — our legitimate interests in getting roads repaired and running a service that lasts (Article 6(1)(f)). You can object: email us, or delete your account.
Marketing emails — consent. You get none unless you switch them on in settings, and you can withdraw whenever you like.

We keep a dated record of when you were shown the statement above and which version of this policy it was.

Selling data

We have never sold any data. The intention is aggregated extracts for councils and highways authorities. Before any of that ships, these are the rules we hold ourselves to: only spots reported by a set number of distinct riders, aggregated to an area, coordinates rounded, small counts suppressed, and never a row that belongs to one rider. None of it is built yet. When it is, this page changes first.

Cookies and analytics

One essential cookie keeps you signed in. Preferences (sound, map layers) live in your browser, not on our servers. We use Ahrefs Web Analytics for page views — cookieless, no personal data — and Cloudflare Analytics Engine for counts of events like visit, connect, analyse and upload, with a country code and no user identifiers. No advertising or cross-site trackers.

Your rights

You can ask for a copy of what we hold, correct it, object to the legitimate-interests processing above, or have it erased. Email us; we answer within one month.

Deleting your account (“Delete my account & data” on your impact page) removes your email and account, your Strava connection and tokens, your ride history, cached rides, and your consent record. On every spot you tapped we do exactly three more things: we remove the rider link, so no row says it was you; we erase the heading and the speed; and we blur the time of the tap down to the date, so what is left cannot be lined up second-by-second against a public ride of yours.

What we don't delete, and why: the tap's coordinates, the road and stretch we matched it to, the local authority district, the connector it came from, our confidence score, the date we received it, and an opaque reference to the ride it arrived in — with nothing left pointing at you. Those are the road's facts rather than yours, and they are what the shared map is made of; removing them would delete other people's evidence about the same bit of road. If you would rather your spots came off the map altogether, email us before you delete your account and we'll remove them by hand.

How long we keep things

Account data until you delete it · cached rides six days · observations indefinitely as road-condition evidence, with the link to you removed on deletion · analytics roughly 90 days · consent records until you delete your account.

We're a UK service and follow UK GDPR. If we get it wrong, complain to the ICO (ico.org.uk).