Last updated: October 29, 2026

Privacy policy

Muhento is an Android app, together with the LoRa board that works with it, made so that people cycling or hiking together as a team can see where everyone is, even without mobile data. This policy explains what data the app uses, where that data goes, and what is never sent anywhere.

1. What data we use

Location

The location (GPS) of your phone and your board is used to show where you are on the map, to broadcast it to your team and to record your ride. While the team connection or a ride recording is on, the app uses your location even with the screen off. During that time you'll see a persistent notification in the notification bar. If you don't have a board and you're in an activity, your location is also taken about every 15 seconds with the screen off so your team can see you; this stops when the activity ends.

Your location reaches your team in these ways, and all three are encrypted:

• LoRa (868 MHz): board to board, with the team's channel key.
• Bluetooth: between nearby team phones, with the team's code.
• Internet: if the “İnternetten de paylaş” (“Also share over the internet”) setting is on; it is on by default in a live activity and can be turned off in Ben → Telefon ağı (Me → Phone network). Your location is encrypted on your phone with the team's key; the team room server only passes on the encrypted packet. A phone with a board and internet in the team acts as the room's gateway and also forwards, encrypted, the positions, names, team messages and SOS of the members it hears over LoRa.

Name and team details

The name and short name you enter in the app appear on the map and in the list of everyone in your team. Team membership and roles (e.g. team leader, sweep, first aid) are shared within the team.

Remote joining (optional)

If the leader or someone who can approve joins turns on remote joining, their board announces the activity's name, the leader's name, the sport, the number of members and the time left, once a minute for 30 minutes, on a lobby channel anyone can read. Every Muhento user in range can see this; no location is sent. If you send a request to join remotely, your name goes out on this channel too.

Messages

The quick messages and free-text messages you send to your team travel encrypted within the team and are stored on the phones. If “İnternetten de paylaş” is on (the default in a live activity) and another phone is in the room, team messages also pass through our team room server; the room's gateway also forwards team messages it hears over LoRa. Messages are encrypted with the team's key; the server can't decrypt or store them. Direct messages to one person are not sent over the internet. If you want, the app reads incoming messages aloud; this is done by your phone's own text-to-speech engine.

Ride and diagnostic logs

Your ride tracks, measurements such as distance, time, speed, altitude and air pressure, and the logs kept for debugging (field log, board log) are stored only on your phone. When you share a file or upload a ride to Strava, the place you send it to stores the data under its own policy.

Watch app (Wear OS, optional)

If you install Muhento's watch app, while a recording is running the watch writes its location, air pressure, your heart rate and step count (if you allow them), its movement (accelerometer), satellite status and battery status to its own storage. When the recording ends, these files are sent over Google Play services' link between the watch and the phone (Bluetooth or Wi-Fi; if the two aren't nearby, Google's cloud connection) only to the Muhento app on your phone; they don't go to our servers. When you share a ride from the phone or upload it to Strava, your heart rate is added to the file if a watch recording overlaps the ride's time. You can share watch recordings or delete them from the phone under Kayıtlarım → Saat kayıtları (My recordings → Watch recordings). The app never deletes the files on the watch by itself; they are deleted when you uninstall the watch app. To find out whether a newer version exists, the watch app reads a small version file from muhento.com at most once a day; no location, heart rate or recording is sent with this request, and Cloudflare processes your IP address to deliver it. If you turn on the Team, SOS or Alerts feature in the watch app, your phone sends your team members' names, their distance and direction from you, team alerts and the SOS status to your watch over the same watch-phone link, and an SOS you give from the watch reaches your phone the same way. None of this goes to our servers or is stored on the watch.

Board details

The app reads the name, ID, battery and signal status, and firmware version of the board it connects to. These are stored on the phone; your team sees the board's name.

2. Servers and third parties

Team room (internet)

If “İnternetten de paylaş” is on (it is on by default in a live activity), your phone connects to our server with a room ID derived from the activity's key. One of the team's phones with a board and internet acts as the room's gateway: it also forwards the positions, names, team messages and SOS of the team members it hears over LoRa, regardless of those members' own setting. The server passes packets encrypted with the team's key between the phones in the room. It can't decrypt them, and it doesn't store or log any packet. To pass the packets on, it does see when phones join and leave the room, how many packets there are and how large they are, how many phones are in the room, and whether each phone is connected to a board. These aren't stored either. The activity's name and key are never sent to the server. The server runs on Cloudflare; Cloudflare processes your IP address to carry the connection.

Family follow (optional)

If you turn on “Ailemle paylaş” (Share with my family) while recording, the app creates a link. Whoever you send the link to sees your live location in their browser, without installing the app. Every 10 seconds the app sends: your name; your location and how long ago it was taken; your speed, heading, location accuracy and the distance of your recording; the send time; and whether you are recording and whether the team is hidden. When someone opens the link, and every 5 minutes while someone is watching, the path you have taken since the recording started is sent too (including the starting point and the time the recording started); it is not sent when no one is watching. The locations of your teammates in the activity you started the share in, from the last 5 minutes and with how long ago each was taken, are sent without names: their names and board numbers are not sent, but each dot carries a random number that belongs to this share, so the same dot can be followed for as long as the share lasts. The team leader can turn off showing the team; this setting does not reach phones without a board, and people sharing from those phones still show the team.

The data is encrypted on your phone with a key that belongs to this share only. The key is in the part of the link after the # sign: it is never sent to our servers, but it passes through whatever app you use to send the link (for example a messaging app). Anyone who has the link can see your location, so send it only to people you trust. The share ends when the recording stops, when the activity ends or you leave it, after 12 hours, or when you stop it. Your team in the activity can see that you are sharing.

Our server (on Cloudflare) only passes the encrypted packets to the people who open the link; it can't decrypt them. So that someone who opens the link late sees something at once, it keeps the latest encrypted packet and the latest encrypted copy of your path in memory while the share is running; it doesn't write them to disk or log them. Cloudflare processes your IP address and the IP addresses of the people who open the link to carry the connections. The map on the viewing page comes from OpenFreeMap: the browser of the person who opens the link connects to OpenFreeMap, which can see their IP address and the area they look at. Since October 26, 2026 the page also loads terrain relief and contour lines (including the 3D view) from Mapterhorn (tiles.mapterhorn.com); if the viewer picks “Uydu” (satellite), the imagery comes from EOX (tiles.maps.eox.at). These servers can also see the viewer's IP address and the area they look at (usually around where you are); your location, your name and the link's key are not sent to them. The map type the viewer picks is stored only in their own browser.

Strava (optional)

If you connect your Strava account, the app, with your permission, fetches your routes and starred segments from Strava and uploads the rides you choose to Strava (with heart rate, if a watch recording overlaps). The access tokens Strava issues are stored on your phone. Getting and refreshing a token goes through our token server; the server passes the request on to Strava and doesn't store or log anything. From Strava's answer, only the tokens and your Strava ID, first name and last name come back to your phone; the rest of your Strava profile (such as city, sex and photo) isn't passed on to your phone, and the server doesn't store it either. Data from Strava is shown only on your phone, isn't shared with your team and is kept for at most 7 days. You can disconnect from the app at any time; this also revokes the permission on Strava. Strava's own privacy policy also applies.

Maps

If the area you're in isn't on your phone and there's an internet connection, map images are downloaded from OpenFreeMap's servers. These servers can see your IP address and the area of the map you're looking at.

The offline map is downloaded region by region. On Wi-Fi automatically (on mobile data, according to your setting), the app downloads the regions (each about 120 km across) around where you are, along your route, where your team is during an activity and where you're looking on the map, from our server on Cloudflare (harita.muhento.com); it also reads the list of regions from there now and then. These requests show Cloudflare your IP address and which regions you download, which reveals your approximate location. The requests don't contain your name, team, board or recordings. Under Ayarlar → Çevrimdışı harita (Settings → Offline map) you can choose which regions download on mobile data and delete downloaded regions.

The map's relief shading and contour lines are drawn from elevation data downloaded to your phone; drawing them doesn't use the internet. If you choose the Satellite view, satellite images are downloaded from the servers of EOX IT Services GmbH (Austria). EOX can see your IP address and the area of the map you're looking at; since that's often where you are, it can also reveal your approximate location. While Satellite is selected, the app also connects to EOX's server once a minute to check whether there's an internet connection. Your name, team and recordings are never sent to EOX. When you switch back to the Terrain view, no requests go to EOX.

QR scanner

The QR code you scan to join a team is decoded on your phone; the image isn't sent. The Google ML Kit library the scanner uses may send Google device and app information, a random per-installation ID, usage and performance metrics and error codes when there's an internet connection.

Google Play

If you installed the app from Google Play, Google may collect install and crash information under its own policy. Each time the phone app comes to the foreground, it asks Google Play whether a new version is available; your location, name and recordings aren't sent with this check.

Test version sign-up

When you email beta@muhento.com, your email address, your language and the time of the request are kept in a queue on Cloudflare until your address is added to Google Play's tester list; once added, they are deleted from the queue. A full copy of your email (including your display name and what you wrote) comes to our mailbox; this copy is deleted no later than 6 months after you leave the test or the test program ends. Your address stays in the tester list in Google Play Console; to leave the test and be removed from the list, reply to the email you received or write to hello@muhento.com.

3. Permissions

• Location: the map, broadcasting your location to the team, and ride recording.
• Nearby devices (Bluetooth): connecting to the board and to nearby team phones.
• Notifications: SOS, messages, alerts, and the persistent notification shown while the app is running.
• Camera: only while scanning a QR code.
• Body sensors and physical activity (on the watch, optional): heart rate and steps in the recording. If you don't allow them, the recording is made without them.
• Exemption from battery optimization: so that SOS and falling-behind alerts aren't delayed while the screen is off.

4. Storage, backup and deletion

• Your data is on your phone. Uninstalling the app deletes all of it.
• You can delete rides and recordings from the watch one by one under Kayıtlarım (My recordings). Recordings from the watch aren't included in the phone's backup.
• You can delete downloaded map regions under Ayarlar → Çevrimdışı harita (Settings → Offline map).
• By default, the app's data isn't included in your phone's backup. If you turn this on under Ayarlar (Settings), it goes into Android's backup service (e.g. the backup in your Google account).
• None of your data is stored on our servers, with two exceptions. Family follow: the latest encrypted location packet and the latest encrypted copy of your path stay in the server's memory while the share is running. Test version sign-up: your email address, language and request time stay in the queue until you are added to the tester list; a copy of your email stays in our mailbox for no more than 6 months after you leave the test or the test program ends.

5. Your rights

Your personal data is protected under Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK). The data controller is Meral TOY, the owner of the developer account that publishes Muhento on Google Play (contact details below). Because your data stays on your phone rather than with us, you can handle most requests to view, correct, export or delete it yourself in the app. For any other request or question, write to us.

6. Changes

If we change this policy, we'll publish the current version on this page and update the date at the top.

7. Contact

Data controller

Meral TOY

Email

support@muhento.com