In short: no account, no statistics or ad cookies without your consent, your location never leaves your device, and everything the site needs – maps, fonts, data – comes from our own server in Germany.
1. Privacy at a glance
General information
This section gives a simple overview of what happens to your personal data when you visit reststopmap.com. Personal data is any data that can identify you personally. The full details follow in the sections below.
Who is responsible for data collection on this website?
The website operator. You'll find the contact details in section 2 and in our legal notice.
How do we collect your data?
- Automatically: our server records technical data when you open a page (browser, operating system, time of the request, IP address).
- When you give it to us: for example the text, name or email address you enter in the contact or report form.
- Only with your consent: usage statistics via Google Analytics and advertising via Google AdSense, if you click “Allow” in the cookie banner.
What do we use your data for?
To deliver the website without errors and protect it against attacks, to answer your messages and fix reported data, and – only with your consent – to understand which pages are useful and to show ads that fund the site.
What rights do you have?
You can at any time and free of charge ask what personal data about you we store, where it came from, who receives it and why. You can ask us to correct, delete or restrict it, withdraw consent with effect for the future, object to processing and complain to a supervisory authority. Details in section 13.
What we don't do
- No user accounts, no logins, no comments, no newsletter.
- No selling or renting of personal data.
- No third-party fonts, maps or CDNs: fonts, map tiles, the map library and our data files are served from our own domain.
- No social-media plugins and no tracking pixels. Google’s analytics and ad scripts load only after you click “Allow”.
- Your location is never sent to our server.
2. Controller and contact
The controller under the EU General Data Protection Regulation (GDPR) is:
Sinan Cekic
Schneidhainerstraße 2
61350 Bad Homburg
Germany
Email: contact@bike-pump.com
Contact form: reststopmap.com/contact
The controller is the natural person who alone decides on the purposes and means of processing personal data. We have not appointed a data protection officer, as we are not legally required to (Art. 37 GDPR, § 38 BDSG).
3. Overview of processing
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Server log data (IP address, time, page, referrer, browser) | Delivering the site, security | Art. 6(1)(f) – legitimate interest | Up to 14 days |
| Your location (near me, map) | Sorting stops by distance | Processed only in your browser (Art. 6(1)(a) – browser permission) | Not stored by us |
| Consent choice and vehicle setting (browser storage) | Remembering your choices | § 25(2) no. 2 TDDDG, Art. 6(1)(f) | Until you change or delete it |
| Google Analytics 4 | Usage statistics | Art. 6(1)(a) GDPR, § 25(1) TDDDG – consent | 2 months |
| Google AdSense | Showing ads that fund the site | Art. 6(1)(a) GDPR, § 25(1) TDDDG – consent | Cookies up to 13 months (section 14) |
| Contact and report forms | Answering your message, correcting data | Art. 6(1)(b) or (f) | Until settled, max. 6 months |
| Emails to us | Answering your message | Art. 6(1)(b) or (f) | Until settled, max. 6 months |
4. General notes and mandatory information
Data protection
We take the protection of your personal data seriously and treat it confidentially and in line with the statutory data protection rules and this privacy policy. Please note that data transmission over the internet (for example by email) can have security gaps; complete protection against access by third parties is not possible.
Legal bases
- Consent – Art. 6(1)(a) GDPR; where information is stored on or read from your device, additionally § 25(1) TDDDG. You can withdraw it at any time.
- Contract or pre-contractual request – Art. 6(1)(b) GDPR, for example a business inquiry.
- Legal obligation – Art. 6(1)(c) GDPR, for example retention duties.
- Legitimate interest – Art. 6(1)(f) GDPR, for example operating and securing the website and answering inquiries. Storage on your device that is strictly necessary for a service you requested is based on § 25(2) no. 2 TDDDG.
Storage duration
Unless a more specific period is stated in this policy, we keep personal data only as long as needed for the purpose it was collected for. When you ask us to delete it or withdraw consent, we delete it unless we have another legal reason to keep it (for example tax or commercial retention periods); in that case we delete it once that reason no longer applies.
Recipients
We only pass personal data to others where this is necessary to run the site, required by law or covered by our legitimate interest or your consent. Recipients are named in this policy: our hosting provider STRATO (processor under a data processing agreement, Art. 28 GDPR), Discord (for messages you send through our forms), our email provider (for emails you send us) and, only with your consent, Google (Analytics and AdSense).
Transfers to third countries
Our website itself is hosted in Germany. Data can reach the United States in two cases: messages you send through our forms (Discord Inc.) and, only with consent, Google Analytics and Google AdSense (Google LLC). Both companies are certified under the EU-U.S. Data Privacy Framework (DPF), for which the European Commission has adopted an adequacy decision (Art. 45 GDPR); standard contractual clauses apply as a fallback (Art. 46 GDPR).
SSL/TLS encryption
The whole site, including the forms, uses TLS encryption. You can recognise an encrypted connection by “https://” and the lock symbol in your browser's address bar. Data you send us cannot be read by third parties while in transit.
No obligation and no automated decisions
You are not legally or contractually required to provide personal data; you can use the site without entering any. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
5. Hosting and server log files
The website runs on a server rented from STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, in a data center in Germany. We manage the server ourselves (deployment with the open-source tool Coolify running on that same server – no further service provider is involved). We have concluded a data processing agreement with STRATO under Art. 28 GDPR, which obliges STRATO to process data only on our instructions and in line with the GDPR.
Each time you open a page, the server automatically records information your browser transmits in log files:
- IP address
- date and time of the request
- requested page or file (including search terms in the address, e.g. /map?q=…)
- HTTP status code and amount of data transferred
- referrer URL (the page you came from)
- browser type and version, operating system
We do not merge this data with other data sources. We use it to deliver the site, to keep it stable and to detect and investigate attacks. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure, working website. Log files are deleted after 14 days at most, unless a specific incident has to be investigated; then they are kept until it is resolved.
6. Content we load from our own domain
Many websites load fonts, maps or scripts from third-party servers, which reveals your IP address to those companies. We don't:
- Fonts (Overpass, Public Sans) are downloaded once when we build the site and then served from reststopmap.com – no request to Google Fonts.
- Map tiles (Protomaps schema, based on OpenStreetMap) are delivered from reststopmap.com. Our server obtains them from an external tile service and caches them; it requests tiles on its own and passes on no visitor data (no IP address, referrer or cookies). Your browser makes no request to OpenStreetMap, Google Maps or any other map service.
- Map library (MapLibre GL) and all scripts are part of our own build.
- Data files (stops, search suggestions) come from our domain. Search and suggestions run in your browser on these files.
These requests appear in our server logs like any other page view (section 5).
7. Your location
If you use “Find rest stops near me” or the locate button on the map, your browser asks for permission to share your position (Geolocation API). The position is used only in your browser to sort stops by distance and to center the map. It is not sent to our server, not stored by us and not shared with anyone. While you're moving, the map also works out in your browser which interstate and direction you're on, to show the stops ahead. For this it loads the interstate data of the state you're in from our server. Like the map tiles, such a request only shows which area is being displayed, not your position. Legal basis: your permission in the browser (Art. 6(1)(a) GDPR), which you can withdraw at any time in your browser's site settings.
8. Cookies and browser storage
Cookies and local storage are small entries a website keeps in your browser. Without your consent we set no cookies. We store only two entries in your browser's local storage that are strictly necessary for functions you use (§ 25(2) no. 2 TDDDG):
- rsm-consent – your choice in the cookie banner, so we don't ask on every page;
- vehicle – the vehicle quick filter you last picked on the map (car, truck, RV), so the map opens with the right stop types.
Google Analytics and Google AdSense cookies are only set after you click “Allow” (sections 9 and 14). All entries are listed in our cookie policy. You can delete cookies and site data in your browser at any time and block cookies in general; the site works without them.
9. Google Analytics 4 (only with consent)
If you click “Allow” in the cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Before you consent, the Google script is not loaded at all and no data is sent to Google.
Google Analytics uses cookies (_ga, _ga_<ID>) to recognise your browser across page views. It records, for example, which pages you view and for how long, how you arrived (referrer), your approximate region, device type, browser and screen size. Search terms can be part of a page address. Google Analytics 4 does not log or store IP addresses; they are used only briefly to derive the region. We have disabled Google signals and ad personalisation signals, so the data is not linked to Google accounts or used for advertising. Data is kept for 2 months and then deleted automatically.
Google processes the data on our behalf under a data processing agreement (Google Ads Data Processing Terms). Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework.
Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future via “Cookie settings” in the footer. More: Google's privacy policy.
10. Contact and report forms
When you send a message through our contact form or the report form (also reachable from every stop and from the map), we process what you enter: your message, the topic and – optionally – your name and email address. For reports we also receive the place you're reporting and, if your browser sends it, the page you came from.
The form is transmitted encrypted. Our server does not store it; it forwards it immediately to a private Discord channel via a webhook so we can read and answer it. Discord receives only the content of the form – not your IP address. Discord is provided by Discord Netherlands B.V. (for users in Europe) and Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA; Discord Inc. is certified under the EU-U.S. Data Privacy Framework. If you prefer, write to us by email instead.
Spam protection works without a third-party captcha: a hidden field that only bots fill in, a minimum time before sending, and a count of submissions per IP address that is kept only in the server's memory for one hour and never written to disk.
Legal basis: Art. 6(1)(b) GDPR where your message relates to a contract or pre-contractual request; otherwise our legitimate interest in answering inquiries and keeping our data correct (Art. 6(1)(f)). We delete messages once the matter is settled, at the latest after 6 months, unless statutory retention duties apply.
11. Contact by email
If you email us at contact@bike-pump.com, we process your email address, the content and any data you include to answer you. The email is processed by our email provider as our processor. Legal basis and deletion as for the forms (section 10).
12. Links to other websites
Our pages link to other websites, for example OpenStreetMap, state transportation departments, toll-road operators and – under “Navigate” – Google Maps. Nothing is loaded from these sites until you click a link. The “Navigate” link passes the coordinates of the stop to the navigation service. From then on, the privacy policy of that site applies (for Google Maps: Google's privacy policy).
The “Share” button uses your device's own share function (Web Share API) or copies the link; nothing is sent to us or to a social network by the button itself.
13. Your rights under the GDPR
- Access (Art. 15) – what data we store about you, where it came from, who receives it and why.
- Rectification (Art. 16) – correction of inaccurate data.
- Erasure (Art. 17) – deletion, unless we must keep the data by law.
- Restriction (Art. 18) – for example while the accuracy of data is disputed, if processing is unlawful but you don't want deletion, if you need the data for legal claims, or while an objection is being examined.
- Data portability (Art. 20) – receiving data you provided, processed by consent or contract, in a common machine-readable format, or having it sent to someone else where technically feasible.
- Withdrawal of consent (Art. 7(3)) – at any time, with effect for the future; processing before the withdrawal remains lawful.
- Complaint (Art. 77) – to a data protection supervisory authority, in particular in the member state of your residence, workplace or the alleged infringement.
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interest (Art. 6(1)(f)), you have the right to object at any time for reasons arising from your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves legal claims. We do not use your data for direct marketing.
To exercise your rights, write to contact@bike-pump.com or use the contact form. The supervisory authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany – datenschutz.hessen.de.
14. Advertising
This site is funded by advertising. If you click “Allow” in the cookie banner, we use Google AdSense, an advertising service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Before you consent, the AdSense script is not loaded and no data is sent to Google for advertising. If you decline, you see no ads.
With your consent, Google and its advertising partners may use cookies and similar technologies (for example __gads, __gpi, __eoi, IDE) to show ads, limit how often you see the same ad, measure ad performance, prevent fraud and – based on your previous visits to this and other websites – show personalised ads. Google receives in particular your IP address, the page you view, browser and device information. Ads are labelled “Advertisement” and never influence our content or the order of listings.
For parts of this processing Google and we are joint controllers; for others Google acts as an independent controller. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. You can manage ad personalisation in your Google ad settings and learn more at How Google uses information from sites that use its services.
Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future via “Cookie settings” in the footer; we then delete the AdSense cookies on our domain and stop loading the script.
15. Notice for US visitors (California and other states)
This section supplements the policy for residents of California (CCPA/CPRA) and other US states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, Utah, Texas).
- Categories collected (last 12 months): identifiers and internet activity (IP address and log data, section 5); with consent, analytics data (section 9) and advertising data (section 14); information you send us (sections 10–11). Location is processed only on your device.
- Sources: your browser and device, and you directly.
- Purposes: operating and securing the site, answering messages, improving content and, with consent, showing ads.
- Disclosure: to our service providers named above (hosting, Discord, email, and with consent Google Analytics and Google AdSense).
- Sale and sharing: we do not sell personal information for money. If you click “Allow”, Google AdSense may use your browsing data for personalised (cross-context behavioral) advertising, which can count as “sharing” under the CCPA. Without that opt-in nothing is shared, and withdrawing it via “Cookie settings” works as your opt-out of sale/sharing and targeted advertising. We do not process sensitive personal information.
- Your rights: to know, access, correct and delete your personal information, to opt out of sale/sharing and targeted advertising (“Cookie settings” in the footer), and not to be discriminated against for using these rights. You can use an authorized agent.
To make a request, contact us as described in section 2; we will verify it before responding, usually within 45 days. The site does not react to Do Not Track or Global Privacy Control signals specifically – without your consent, no analytics or advertising cookies are set in any case.
16. Children
This site is not directed at children under 16 (under 13 in the US, COPPA), and we do not knowingly collect their personal information. If you believe a child has sent us personal data, contact us and we will delete it.
17. Changes to this policy
We update this policy when our services, the tools we use or the law change. The date at the top shows the current version. Significant changes are noted here. 28 October 2026: Google AdSense added (section 14), only with consent.