Last updated: 2026-08-18

Overview

RouteU ("we," "our," or "us") operates the website getrouteu.com. This Privacy Policy explains how we collect, use, and protect information when you use our campus navigation service.

Information We Collect

Information You Provide

• Account registration: an email address and password for creating a RouteU account. Passwords are hashed with PBKDF2-SHA512 before storage — we never store your password in plaintext, and not even RouteU staff can read it.
• Premium subscription: a billing email and subscription status. Premium checkout is routed through Stripe-hosted payment links. The only payment-related fields stored in our database are the Stripe session ID, subscription status, and expiry date. RouteU never sees or stores your card number, CVV, or expiration date — those are collected and held entirely by Stripe.
• Feedback & support: anything you voluntarily submit through the in-app feedback form, the beta-trial questionnaire, or the "report missing building" flow, used to improve the data and the product.

Information Collected Automatically

• Page views: which campus page you opened, device type, referrer, and user agent, recorded in the page_views table.
• IP address: hashed with SHA-256 before storage, so the original IP cannot be reconstructed from our logs.
• Usage events: search queries (search), direction requests (direction_request), map interactions (map_interaction), and per-building views (building_view) recorded in the beta_events table while you use the app.
• Session metadata: anonymous session ID, event count, and duration in beta_sessions for understanding how the navigation product is used.

How We Use Your Information

• Run the navigation service: authenticate your account, look up buildings, rooms, and campuses on your behalf, compute walking directions, and remember your favorites.
• Aggregate usage analytics sold to university admin dashboard customers: we sell aggregate, anonymized usage signals (for example, "hourly building searches per campus", "peak direction-request times", "top buildings viewed") to university operations customers through our campus-admin programs. Personal data is never sold, and universities only ever see aggregate trends — never the activity of an individual student. These aggregates are derived from page_views and beta_events rolled up without user identifiers.
• Manage Premium subscriptions: handle payment via Stripe-Hosted payment links and record your subscription status and expires_at.
• Service emails only: password reset, subscription confirmation, and the 14-day beta-trial questionnaire drip. We do not send marketing email and we do not market to you without your consent. Transactional only.
• Detect abuse and comply with law: investigate spam, scraping, and credential-stuffing, and respond to lawful requests.

Cookies and Similar Technologies

We use cookies and similar storage for the following purposes:

• Authentication: a JWT session cookie issued by RouteU keeps you signed in for up to 30 days.
• Analytics: Google Analytics 4 (measurement ID G-SQVC79HNWL) collects aggregate site-traffic data on every public page.
• Advertising: Google AdSense serves contextual ads on our consumer pages and may set cookies for that purpose. This is a real revenue stream supporting the free navigation product.
• Marketing measurement: Meta (Facebook) Pixel, loaded on every public page, lets us measure reach and attribution.

You can disable cookies in your browser settings. Doing so will sign you out and may reduce some functionality.

Third-Party Services

Google AdSense

We display advertising via Google AdSense. Google uses cookies to serve ads based on your prior visits to this and other websites. You can opt out of Google's use of cookies by visiting Google Ads Settings. For more information on how Google uses data, visit Google Privacy & Terms.

Stripe

Payment processing for Premium subscriptions is handled by Stripe, Inc. through hosted payment links. RouteU never sees or stores your card number, CVV, or expiration date — only the Stripe session ID and subscription status reach our servers. Stripe's full privacy policy applies to all payment data.

Google Analytics 4 (GA4)

We use GA4 to understand aggregate site traffic. GA4 data is anonymized and aggregated. You can opt out of GA4 tracking by installing the Google Analytics Opt-out Browser Add-on.

Meta (Facebook) Pixel

Meta Pixel is loaded on every public page for reach measurement and attribution. Meta processes event data under its own privacy policy; Meta's Data Policy applies.

OpenStreetMap & OSRM

Map tiles are served from OpenStreetMap, and walking directions are computed by the OSRM routing engine. Direction requests do hit our /api/directions endpoint (logged at the routing server), and those services may log IP addresses per their own privacy policies.

Data Sharing and Sale

• We do not sell your personal information to third parties.
• University customers receive aggregate, anonymized analytics only — never personally identifiable information about individual students.
• Stripe, Google AdSense, Google Analytics 4, and Meta Pixel process data under their own privacy policies, as listed in the third-party section above.
• We disclose information only when required by valid legal process (subpoena, warrant, or court order), or to protect RouteU and its users from fraud or abuse.

Data Retention

• Page-view IP hashes are retained for up to 12 months for analytics purposes, then purged.
• Account data is retained until you delete your account. Beta-test rows in beta_testers may be retained after opt-out for audit purposes; this is what the "Last seen" metric on the beta dashboard is derived from.
• Subscription records are retained for tax and accounting purposes; Stripe remains the authoritative system of record for the subscription lifecycle.

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Object to certain processing
• Withdraw consent at any time (where applicable)

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

Children's Privacy

Our service is not directed to individuals under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us immediately and we will delete it.

Security

We use industry-standard TLS encryption for all data in transit and hash passwords with PBKDF2-SHA512 before storage. No security measure is 100% guaranteed, but we continuously monitor and update our infrastructure to protect your data.

Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be posted on this page with an updated effective date. We encourage you to review this page periodically. Continued use of the service after changes constitutes acceptance of the updated policy.