Privacy Policy
Strada for Android · Stanislav Fil (splin.dev), Estonia
Privacy, support and account requests: support@stradaapp.eu
The app policy below is effective from 6 November 2026. This web edition was published on 6 November 2026.
1. Core features and data
You can use Strada without signing in. Maps, timetables, vehicle positions and downloads use internet connections. The servers providing these resources receive the technical information necessary for the connection, including your IP address; map tile requests reveal the area being viewed. Providers include Google/Firebase, the selected map services (including VersaTiles and OpenFreeMap) and transport data sources such as Tallinn transport and Elron. Attribution and provider links are in Licences and authors.
With Android location permission, Strada uses your location to position the map and help plan journeys. You can refuse or revoke that permission in Android settings. Location-based features then become limited. Journey calculation and address search run locally; we do not add your precise location, route endpoints, search queries or saved addresses to our analytics events. Requests for map tiles and online transport data are still external network requests.
Your saved places, home/work shortcuts, recent places, route history, preferences and downloaded databases are stored on your device. When you sign in to a verified Strada account, favourite places and home/work shortcuts also sync automatically to Firestore under your Firebase UID. This includes the names, addresses and selected map coordinates of those places, together with the home/work labels. Existing local favourites are transferred to the first account used on this installation. Changes made offline are queued locally and sent when connectivity returns. Each account has its own local cache; signing out switches to a separate guest library. Recent places, search queries and route history remain on the device and are not included in this sync. Deleting the app normally removes local app data; system behaviour and any backups outside our control may differ. Strada excludes its personal places/preferences stores and analytics choice from its Android app backup rules.
2. Optional Google account
If you sign in, Firebase Authentication processes your Google identity, UID, email, display name and profile photo to authenticate you. Strada displays these details. Firestore stores your account email, favorite routes, favourite places (including home/work labels, names, addresses and coordinates) and access entitlement such as Strada+. We do not receive your Google password. This processing is needed to provide the account and requested synchronisation (performance of the contract). Network security and abuse prevention are based on our legitimate interest in operating a safe service. Mandatory permissions and optional analytics are separate from signing in.
3. Optional usage analytics
Analytics is off until you explicitly allow it. Firebase Analytics, integrated with Google Analytics, then measures predefined actions such as opening search, selecting a route and changing settings, and technical usage/session information. Google also derives approximate geography, including country and potentially city, from network information and processes device model, manufacturer, operating system, app version, language and a pseudonymous app-instance identifier. This is pseudonymous data, not a promise of anonymity. We do not set your Strada UID or email as an analytics user ID. We disable advertising ID collection, advertising storage and advertising personalisation consent in the app; Strada does not use analytics for personalised advertising.
The basis for this optional processing is your consent. Declining does not prevent you from using Strada. Change your choice in Profile → Privacy and analytics. Withdrawal stops future collection and resets this installation's analytics identifier; it does not itself erase events already received by Google. Google Analytics applies the property's retention settings to event/user-level data; standard retention options are 2 or 14 months. Aggregated reports may be retained longer. Contact us for the current property setting or an analytics data request; we will explain whether a pseudonymous record can be identified without collecting extra identity data.
4. Recipients and international processing
Google/Firebase provides authentication, cloud storage and analytics infrastructure. External map and transport services process their own network requests under their respective privacy terms. Service providers may process data outside Estonia or the EEA, including in the USA. Where required, lawful transfer safeguards such as applicable adequacy decisions or standard contractual clauses apply. See firebase.google.com/support/privacy and policies.google.com/privacy for Google's processing, safeguards and service-specific retention details. We do not sell your personal data.
5. Retention and deletion
The active cloud profile and authentication account are kept while the account exists. Delete your Strada account in Profile → Delete account, or contact us by email. The app asks you to confirm the same Google account, pauses sync, removes the cloud profile, favorite routes and favourite places and deletes the Firebase Authentication user. It also clears favorite routes, saved places, home/work shortcuts and history for this account on this device and turns analytics off here. It does not delete your Google account, erase data on your other offline devices, or automatically identify and remove previously uploaded pseudonymous analytics. Failed deletion is reported and can be retried; it is not shown as completed.
A minimal technical deletion marker (former UID and request time, without email, name, favorite routes or saved places) is retained to prevent old sessions from recreating the profile. It can be removed during administrative cleanup after the authentication tokens have expired and deletion has been confirmed. Security records, legally required records and provider backups may remain for their applicable limited periods; Firebase states that Authentication backup removal can take up to 180 days. Contact us about erasure of remaining records. We do not promise that every provider backup is erased immediately.
6. Your rights and complaints
Where applicable you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw analytics consent at any time without affecting earlier lawful processing. Email support@stradaapp.eu; we may need proportionate verification of your identity before disclosing or deleting account data. You can complain to Estonia's Andmekaitse Inspektsioon (aki.ee), or your competent supervisory authority. Strada does not use these analytics events to make automated decisions with legal or similarly significant effects about you.
7. Children and changes
Strada is not directed at children below the applicable age for independently consenting to optional data processing. If parental authorisation is required, a parent or guardian must provide it; do not enable optional analytics without the required authorisation. Contact us if you believe a child's data has been processed improperly. Material changes will be shown in the app with an updated date. A new purpose requiring consent will need a new consent request.
8. Email/password accounts
You may also create an account with an email address and password instead of Google sign-in. Firebase Authentication processes the email, password and sign-in credentials; Strada does not store your password in Firestore, preferences, saved UI state, analytics or logs. Account sessions are managed by Firebase. A password-reset request sends the email address to Firebase, which sends a reset link if applicable. This is used to provide and secure the account you request. Cloud favourites and Strada+ are associated with the same Firebase UID and follow the account, retention and deletion rules above. For password accounts, in-app deletion requires re-entering the current account password rather than selecting a Google account. You can also request deletion on the account-deletion page or by emailing support@stradaapp.eu.
Email verification
Email verification: email/password accounts must verify ownership through a Firebase verification link before cloud favourites or Strada+ can be accessed. Firebase sends verification emails in response to account creation or your resend request and processes the email address and verification state for account security. Until verification, you can use guest features, sign out or delete the pending account. Opening the link updates your verification state; Strada refreshes the session when you return.
9. This website
This website is served by a hosting provider, which receives the network information needed to serve pages, including IP addresses. The Strada pages do not use analytics scripts, advertising trackers, tracking cookies, sign-in forms or third-party font services. Following an external link takes you to that service, whose own privacy practices apply. Email links open a draft; they do not send messages automatically. The website uses browser local storage, rather than cookies, to remember your storage choice. Only if you choose "Remember my language" does it also save your language for future visits. Choosing "Only necessary" removes the saved language; language links still work for the current visit. These choices are not sent to an analytics service. You can change your choice through "Cookie settings" in the footer, or remove both choices by clearing this site's browser data.
For account or data-deletion requests outside the app, follow the account-deletion instructions.
Provider information: Firebase privacy and security, Google Privacy Policy. Privacy contact: support@stradaapp.eu.