Plain English, then the detail. We collect the least we can get away with, and we tell you what leaves your phone.
Last updated: 11 July 2026 · Effective from first public release
RouteWise needs three things about you: who you are (an email address, so your progress follows you to a new phone), where you are (only while a journey is running, so we can draw your route and confirm you arrived), and what you've done (XP, checkpoints, lessons). We do not sell any of it, we do not run advertising, and we do not track you across other apps or websites.
Location is the sensitive one, so to be exact: RouteWise reads your position only while you have an active journey open, and stores the points that make up that journey's route. It is not collecting your movements in the background when you aren't travelling with it.
RouteWise is operated by its founder, based in Kigali, Rwanda. For any privacy question, or to exercise any of the rights below, write to privacy@routewise.rw. We answer within 30 days, and usually much sooner.
This policy is written to Rwanda's Law No. 058/2021 relating to the protection of personal data and privacy. If you're in the EU or UK, we handle your data to the same standard.
| Data | Why | Legal basis |
|---|---|---|
| Email address and, if you use it, your name from Apple or Google sign-in | To create your account and let you sign in on another device. | Performance of a contract |
| Display name and profile details you type in | So the app can greet you. | Consent |
| Precise location, while a journey is active | To show where you are, draw the route you travelled, and verify arrivals at checkpoints (XP can only be awarded for an arrival the server can confirm). | Consent — you can refuse, and the app still works; you just plan rather than track |
| Journeys and waypoints you save | Your travel history, and the basis of the gamified map. | Performance of a contract |
| Progress: XP, level, checkpoints, unlocked stories, lessons, streaks | The product. | Performance of a contract |
| Push notification token and your notification settings | To send streak reminders and unlock alerts. Only if you allow notifications. | Consent — withdrawable at any time, in the app or in your device settings |
| Booking and payment records: what you booked, amount, status | To issue your ticket and support you if something goes wrong. | Performance of a contract; legal obligation (accounting) |
We use a small number of processors. Each gets only what it needs to do its job.
| Processor | What it handles | Where |
|---|---|---|
| Supabase | Your account, journeys, progress and bookings (the database and authentication). | EU (eu-west-1) |
| Mapbox | Map tiles and route directions. Receives coordinates in order to return a route. | USA |
| Expo | Delivers push notifications to your device. Receives a device token, a title and a body — no account data. | USA |
| Sanity | Stores the cultural stories and Kinyarwanda lessons. Holds no personal data — the app reads from it, it never writes to it. | EU/USA |
| Paypack | Mobile-money payments (MTN MoMo, Airtel Money). Receives the phone number and amount for a transaction. | Rwanda |
| Stripe | Card, Apple Pay and Google Pay payments. Receives your payment details directly. | USA/EU |
| Apple / Google | Sign-in, if you choose it. They tell us your email; we tell them nothing about you. | USA |
Some of these are outside Rwanda. Where that's the case, the transfer is made under the provider's standard contractual protections. We do not sell your personal data, and we never will.
You can delete your account from inside the app, at any time, without asking us: Profile → Delete my account. You don't need to email anyone, and we don't ask you why.
That erases, immediately and permanently:
What we have to keep, and what we do to it. A booking you actually paid for is an accounting record, and the law requires us to retain it. We keep the amount, the date, the booking code and the payment reference — and we strip your name, phone number, email and any notes, and detach the record from your account, so it is no longer linked to you. We do not keep your mobile-money number.
If a payment is still going through, the app will ask you to wait a few minutes and try again — deleting mid-payment would leave that payment stuck, with no way to refund it.
Under Law No. 058/2021 (and the GDPR, if it applies to you) you can ask us to:
Write to privacy@routewise.rw. You also have the right to complain to Rwanda's National Cyber Security Authority (NCSA), which supervises data protection.
Your data is protected by row-level security: the database enforces, per query, that you can only read your own rows — it isn't left to the app to remember. Traffic is encrypted in transit (TLS) and at rest. Sensitive operations (awarding XP, confirming an arrival, taking a payment) are performed server-side and re-verified there, never trusted from the phone.
No system is perfectly secure. If a breach ever affects your data, we will tell you and the supervisory authority, promptly.
RouteWise is not directed at children under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, write to us and we'll delete it.
If we change this policy in a way that matters, we'll say so in the app before the change takes effect — not quietly, in a footer. The date at the top always reflects the current version.