Privacy

Privacy

Roadstr has no accounts, no central servers and no telemetry or analytics SDKs. Nothing is collected by, or sent to, Roadstr itself: the app talks directly to public services. This page lists every one of them, what it learns, and what you can do about it.

What leaves the phone

What	Goes to	Contains	When
Computing a route	The routing provider you chose (OSRM by default)	Origin, destination, waypoints, your IP address	When you plan or recalculate a route
Live map data (speed limits, speed cameras, traffic lights, crossings, speed bumps, restricted zones, POI search)	Overpass servers	Your position during navigation, your IP address; no account or persistent identifier	Periodically while navigating, and on a category search
Weather	Open-Meteo	Position	When the weather row is shown
Map tiles	The tile server (OpenStreetMap by default)	The tiles you look at, your IP address	While you browse the map
Place search	Nominatim and Overpass	Your words and the position the search is biased towards	When you search
Public transport — journeys, stop searches, departure boards, live checks	Transitous (or Entur inside Norway)	The query, coordinates, travel time, your IP address	When you use them
Transit stops in a normal place search	Transitous	The words you searched and the position the search is biased towards	On every ordinary place search
Web results (off by default)	The SearXNG instance you choose	Search words, the name of your town for "near me" searches, your language, the safe-search level — never coordinates	Only when you agree
Voice and speech models	The model host (e.g. Hugging Face)	Your IP address and a file request — never anything you said	Once, when you tap Download
Voice search street names	Overpass	The centre of a cell about 5 km across — never your position or your words	Once a month per area
Offline maps and routing packages	The package host	Your IP address and the file requests	Only after you open Offline areas
Road reports	Public Nostr relays	Exact position, time, content and your public key — public and linkable	When you publish
Confirmations, corrections	Public Nostr relays	The same kind of data, about someone's report	When you vote or edit
Zaps	The recipient's LNURL server, and your wallet over NWC	An invoice request; the zap request names your public key	When you zap
Favourites sync, Journey sync (both off by default)	Your Nostr relays	Encrypted snapshots; relays see your public key, event time and the approximate size	When enabled
MeshCore radio (off by default)	Anyone in radio range	Position, time and the signing public key — not private, not anonymous	When you turn on sending

Your IP address is visible to every server you contact, as it is for any network request. If that matters to you, use a VPN — the onboarding suggests one.

What stays on the phone

• Your saved places and parking spot, unless you export or sync them.
• Search history, route history and saved routes (saved routes are encrypted with a Keystore key).
• Journey statistics, unless you turn on Journey sync.
• Voice: audio for voice search is processed in memory and never written to disk, sent or logged. Spoken instructions are generated on the phone.
• Your Nostr private key — Roadstr never holds it. See Nostr and sign-in.
• The pairing key of a bunker, which is encrypted with the Android Keystore.

Things worth understanding

• Road reports are public and linkable. Publishing a report sends its exact coordinates, timestamp, content and your Nostr public key to public relays. That is pseudonymous, not anonymous, and no relay can be made to delete it.
• Pseudonymous mode (Settings → Profile visibility) hides your name and picture from other Roadstr users; it does not hide the key, the location or the time.
• Signatures are checked. Every event received from a relay is verified before it is trusted, so a relay cannot forge a report under someone else's identity.
• Encrypted sync still reveals metadata. NIP-44 protects the content, not that an event exists under your key, when it was made, or roughly how big it is.
• Permissions. Location (Precise) for navigation; notifications for the navigation notification and your activity inbox; Nearby devices (Bluetooth) only if you pair a MeshCore radio; microphone only if you use voice search. Roadstr does not need permanent background-location access.

Reducing what is shared

If you want to…	Do this
Hide your IP address	Use a VPN
Keep route requests off public servers	Run your own GraphHopper or install an offline routing package
Avoid third-party web search	Leave Web results off (the default), or run your own SearXNG
Avoid Transitous	Do not use public transport; note that a place search also asks it for stops
Keep your name off reports	Stay in pseudonymous mode, or use a one-time key for the compatible copy
Avoid Journey data leaving the phone	Leave Journey sync off (the default)

Where the code says so

The statements above are checked against the code and pinned by tests. The detailed notes live in the repository: README.md, docs/journey-nostr.md, docs/offline-voice-search.md and docs/interoperability/MESHCORE_NOSTR.md.