This page describes what the Lake Biwa Ride Companion stores and shares. It is a small private tool for three riders — there are no accounts, no analytics and no advertising.
The trip (itinerary, places, checklist ticks and notes) is personal: your browser mints a random device identity (dev:…) and the itinerary is stored under it in a dedicated Redis database with no expiry — the retired shared document is no longer read. Anyone holding that identity can access the trip; a six-character pairing code (valid 10 minutes) is how you share it to another of your devices. On the device itself, browser storage keeps your identity, your check-in mirror, a recoverable copy of any unsent draft and the last-synced snapshot so the plan reopens offline; a service worker caches only the app's own files (pages, styles, artwork) — never trip data, photos or map content. Clearing site data removes all of it.
If you tap “use my location”, your browser takes a position that stays on your device for the rest of the session and centres every Nearby shortcut search you open — the coordinates travel to Google Maps inside those links only. The fix is never sent to our server, never stored beyond the session and never shared with the other riders.
Map previews, road-route geometry, terrain data and place details come from Google Maps Platform. When you view a map or request a route, the stop coordinates are sent to Google to compute the preview. Route, elevation and place details are shown transiently and are not stored with the trip — provider data kept server-side is limited to a resolved Google place ID (kept indefinitely) and place coordinates, place details, photo references and photo image bytes (each kept at most 30 days). Canonical-place photo responses may be held by your browser for a day; custom-place photos are marked not to be stored. Route geometry and terrain elevation are never persisted. Google's own privacy policy applies to that traffic.
There are no accounts. Your device identity travels as a request
header; a strictly-same-site HttpOnly biwa-owner cookie
mirrors it only because photo images cannot send that header — the
cookie is used by the read-side place/photo endpoints alone and
writes still require the header. Provider keys live
server-side — except the Maps JavaScript key, which is deliberately
public but locked by HTTP-referrer restrictions to this site. None are
written to logs or sent anywhere but Google's own endpoints. This site's referrer
policy is strict-origin-when-cross-origin: third-party sites
you open from links (including Google Maps, whose script needs an origin
referrer for its restricted key) may see that you came from this site.