Ruto
Privacy Policy
Last updated 8 September 2026
Ruto is a navigation app. It needs to know where you are in order to tell you where to turn. It does not need to know who you are, and it does not ask.
The short version
No account
No email address, no password, no name, no phone number. There is nothing to sign up for and nothing to close.
Location, to navigate you
Your position is sent to our servers only to do something you asked for — a route, traffic ahead, hazards nearby. We keep no history of where you have been.
No ads, no tracking SDKs
No advertising, no advertising identifiers, no analytics or attribution SDKs. Sentry, for crashes, is the only third-party SDK that sends anything.
Nothing sold, ever
We do not sell your data and we do not share it for advertising. There is no profile of you, because there is nothing to attach one to.
Your trips stay on the phone
Trip history, saved places, downloaded roads and your settings are written to your device and never reach us. Deleting the app deletes them.
No screenshots of your map
Screenshot capture, view-hierarchy capture and session replay are permanently disabled in our crash reporting. A picture of this app is a picture of where you are.
What Ruto collects
Your location
While you are navigating, the app reads your device's location continuously, including in the background so guidance keeps working with the screen off. Your position is sent to our servers only as part of doing something you asked for: calculating a route, refreshing traffic on the road ahead, or checking for hazards near you. We do not keep a history of where you have been.
You can revoke location access at any time in your device settings. Ruto cannot navigate without it.
An anonymous install identifier
The first time you open Ruto, the app generates a random 32-character identifier and stores it on the device. It is not derived from your device, your account or you, and it identifies nothing beyond this one installation. Deleting and reinstalling the app creates a new one.
It exists so that a hazard you report is not counted twice, so that a trip you share can only be updated by the phone that started it, and so that a purchase can be matched to the installation that made it.
What you type into search
A destination you type is sent to our servers, which pass it to our map data provider to turn it into a place. We deliberately do not write typed destinations or precise coordinates into our server logs.
Diagnostics
When the app crashes, freezes or hits an error, a diagnostic report is sent to Sentry, our error-reporting provider, so the fault can be fixed. These reports contain the technical state of the app: the error, the device model, the operating system version and the app version.
We have deliberately turned off the features of that tool that would capture more: screenshots, view-hierarchy capture and session replay are all disabled, permanently, because a screenshot of this app is a picture of a map centred on where you are. IP address collection is also disabled.
Purchases
If you buy a subscription, the purchase is handled by Apple. We never see your payment details. We receive confirmation from RevenueCat, our subscription provider, that the installation identified by the identifier above has an active subscription, and when it expires.
What Ruto does not do
- No advertising, and no advertising identifiers.
- No analytics or attribution SDKs. Sentry, for crashes and errors, is the only third-party SDK in the app that sends anything about how it is running.
- No selling or renting of data to anyone, for any purpose.
- No profile of you, because there is nothing to attach one to.
- No screenshots or screen recordings of the app.
Who else sees data, and why
To route you, Ruto has to ask other services for information. In each case only what is needed for that request is sent, never a name or an account.
| Provider | What it receives | Why |
|---|---|---|
| Our own servers | Start and end points, route shape, your position during a trip | Calculating routes, traffic, hazards and offline map data |
| Mapbox | Your search text and approximate position | Turning what you type into a place, and finding nearby points of interest |
| TomTom | The shape of the road ahead of you | Live traffic conditions and incidents |
| what3words | A three-word address, only when you type one | Converting it to a location |
| Sentry | Crash and error diagnostics | Finding and fixing faults |
| RevenueCat | Your install identifier and subscription status | Knowing whether a purchase is active |
What stays on your phone
Some things never reach us at all:
- Your trip history — the miles, the minutes without signal and the summary after each drive are written to your device and stay there. Deleting the app deletes them.
- Saved places, including Home and Work, and your recent destinations.
- Downloaded map data for the roads around your route.
- Your settings, including route preferences and your vehicle profile.
Sharing a trip
Trip sharing is off unless you start it. When you do, Ruto creates a private link, and anyone holding that link can see your position, your estimated arrival time and your destination until the share ends. The share ends when you arrive, when you stop it, when the trip ends, or at the time limit you chose.
The link's secret is never stored on our servers in a form that can be turned back into a working link. Share it only with people you intend to see where you are.
Reporting hazards
If you report a hazard, we store what you reported and where, so we can warn other drivers approaching the same spot. A report carries the anonymous install identifier so the same report is not counted twice, and nothing else about you. Reports expire automatically, within 30 minutes to 24 hours depending on the kind.
Safety research
Ruto records when a vehicle appears to be travelling against the legal direction of a one-way road, so the feature can be proven correct before it ever warns anyone. These records contain the road, the direction and the moment, tied only to the install identifier. They are deleted after 90 days.
How long we keep things
- Hazard reports: until they expire, then deleted.
- Shared trips: deleted a week after the share ends.
- Safety research records: 90 days.
- Diagnostic reports: as long as Sentry retains them under our plan, currently 90 days.
- Server logs: they do not contain typed destinations or precise coordinates.
Children
Ruto is not directed at children and we do not knowingly collect information from anyone under 13.
Your choices
You can revoke location access in your device settings, which stops navigation working. You can delete the app, which removes everything stored on the device, including your trip history and saved places.
Because there is no account, we generally cannot look up "your" data — there is no name or email to look it up by. If you want the records tied to your install identifier deleted, write to us and we will explain how to find it and remove them.
Changes
If this policy changes in a way that matters, we will update the date at the top and note the change in the app's release notes.
Contact
Questions about privacy: privacy@rutomaps.com
Ruto is made by Naresh Sama, New York, United States.