komoot
German outdoor route planner and navigation app (komoot GmbH): sport-specific hiking and cycling routes on OpenStreetMap data, offline maps, turn-by-turn voice nav, and Garmin/e-bike integrations.
Shortlist komoot when you need German-operated, sport-specific outdoor route planning with offline voice navigation and strong bike-computer/e-bike sync. Skip when you need urban multi-modal maps only (prefer Google Maps), a pure training/social fitness network (Strava), or a hard no-US-subprocessor stack—komoot discloses AWS EU hosting plus multiple US analytics/support tools.
Key capabilities
Planner generates and customizes routes for hiking, road cycling, mountain biking, gravel, running, and related sports using OpenStreetMap-based maps and Graphhopper-attributed routing. Supports off-grid connectors where mapped paths do not exist. Free basic map overlays; advanced sport-specific map styles are Premium.
Mobile apps provide turn-by-turn voice navigation and regional offline map downloads for unlocked areas. You can plan worldwide for free, but navigate/record only inside unlocked regions. One free region on signup; further regions via one-time map purchases or Premium worldwide access.
Core navigation ships as one-time Single Region, Region Bundle, or World Pack map unlocks with lifelong map updates and GPX download. Premium subscription adds multi-day planner, personal Collections, Live Tracking, weather-on-route, 3D maps, sport-specific maps, and komoot map on compatible Garmin devices—without putting retail prices on this page.
Documented integrations include Garmin (Courses Sync, Live Sync, Premium komoot map on supported devices), Wahoo and other GPS bike computers, Bosch and other e-bike displays, and smartwatches (Apple Watch, Suunto, COROS, Wear OS, and more). Useful when the phone is not the primary field display.
Users share Highlights, tips, photos, and curated Collections; privacy zones on the website can hide private start/end locations on completed activities. Global Heatmaps use aggregated anonymized tracks with opt-out and start/finish trimming per support documentation.
Best fit when
- Hikers, cyclists, MTB and gravel riders who need trail-aware planning rather than car GPS
- Users who download regional offline maps and rely on turn-by-turn voice navigation off-grid
- Cyclists and e-bike riders who sync routes to Garmin, Wahoo, Bosch, or similar field devices
- European buyers who want a German legal entity and EU-claimed application hosting (with eyes open on US SaaS subprocessors)
- Multi-day tourers who will use Premium multi-day planner and worldwide map access
Poor fit when
- Teams that require published ISO 27001/SOC 2, a self-serve B2B DPA, or enterprise SSO/admin tenancy
- Buyers who need zero US-group subprocessors (Zendesk, Google Analytics/Firebase, customer.io, etc. are disclosed)
- Users who only need city transit, business search, or car navigation—Google Maps (or peers) fit better
- Orgs that need self-hosted or fully air-gapped outdoor mapping software
- Anyone expecting a pure open-source product (maps use OSM; the komoot app/service is proprietary SaaS)
Consider instead when
When: You need general multi-modal city maps, transit, and business search rather than trail routing
Consider: Google Maps
Different job-to-be-done; komoot is outdoor sport routing, not a full Google Maps replacement.
When: You prioritize social training logs, segments, and athlete network over offline multi-sport trail planning
Consider: Strava (US; not in this catalog)
Compare community model and data export; not an EU-sovereignty pick.
When: You need a hard EU-only data path with no US SaaS analytics/support tools
Consider: Self-hosted OSM/GraphHopper stacks or offline GPS devices with local-only maps
komoot’s privacy policy discloses several US-group processors despite EU hosting claims.
- Independent security / no-logs audit·Not found
- ISO 27001·Not found
- SOC 2 / SOC 3·Not found
- GDPR / EU data protection·Vendor claimed
- +3
Considerations & known limitations
- MediumMultiple US-group SaaS and analytics processors
Even with German HQ and claimed EU AWS hosting, privacy policy discloses Zendesk, Google, customer.io, Hotjar, Datadog, Meta, and Adjust. Buyers with strict no-US-tool policies need a different architecture.
- MediumPost-acquisition ownership and continuity
Bending Spoons (Italy) closed acquisition of komoot in March 2025. Roadmap, packaging, and support quality may change under the new group; re-check commercial terms after ownership transitions.
- MediumNo public ISO/SOC or independent security audit
Enterprise assurance artifacts (ISO 27001, SOC 2, independent audit PDFs) were not found on public pages. Consumer outdoor use may tolerate this; regulated org procurement may not.
- LowNavigation gated by unlocked map regions
Planning is global, but navigate/record requires unlocked regions (one free, then paid maps or Premium). Unexpected region boundaries can block field use if access is not purchased in advance.
- LowConsumer product, not documented enterprise platform
No public self-host, fleet admin, or B2B DPA path found. Fine for individual outdoor use; weak fit for org-mandated controlled deployments.
Open questions for due diligence
- Will komoot sign a customer-specific B2B DPA and publish a complete subprocessor list with countries/roles?
- Are any ISO 27001 / SOC 2 or independent penetration-test summaries available under NDA after the Bending Spoons acquisition?
- Which exact AWS regions and services host primary app data vs analytics side-paths?
- What admin/export/deletion SLAs apply if an organization standardizes on komoot for staff outdoor activities?
- How will Premium/Maps packaging and long-term offline guarantees evolve under Bending Spoons ownership?
Frequently Asked Questions
You can plan routes anywhere with a free account. To navigate or record, the region must be unlocked. New accounts get one free single region. Additional areas use one-time Single Region / Region Bundle / World Pack map products (core nav, offline, GPX, device send). Premium is a subscription that includes worldwide maps/navigation plus multi-day planner, Live Tracking, weather-on-route, sport-specific and 3D maps, and the komoot map on supported Garmin devices. Confirm current packaging on the official product and Premium pages.
The privacy policy names komoot GmbH (Germany) as controller and AWS EMEA SARL (Luxembourg) as web hoster with processing only within the EU for that hosting. It also states map-nearby location data is processed on EU servers. Separately it discloses US-group tools such as Zendesk (support), customer.io (messaging), Google Analytics/Firebase/reCAPTCHA/Maps integrations, Hotjar, Datadog, Meta SDK, and Adjust, plus Stripe/PayPal for payments. Treat CLOUD Act / transfer risk as partial, not eliminated by EU HQ alone.
Yes for unlocked regions: download regional maps and routes for offline navigation and recording in the mobile apps (and on supported watches/devices). Navigation and recording still require the region to be unlocked. Features that need the network (live community feed, Live Tracking link delivery, account sync, weather-on-route) remain online-dependent. Offline coverage is not a substitute for unlocking the right region pack or Premium worldwide access.
komoot is positioned as a consumer outdoor planner/nav app with community features—not as a published enterprise fleet or field-force product with public SOC/ISO, regional tenancy controls, or a self-serve B2B DPA. Individual employees can use it for personal outdoor navigation. For org-mandated tools, ask the vendor for a signed DPA, full subprocessor list, retention/export guarantees, and whether admin/SSO controls exist; if those are mandatory and missing, shortlist dedicated enterprise GIS/nav stacks instead.
In March 2025, Italian tech company Bending Spoons announced it had closed the acquisition of komoot. The operating legal entity remains komoot GmbH in Germany per imprint. Ownership changes can affect roadmap, staffing, and commercial packaging; evaluate product continuity and support quality under the new group rather than assuming pre-acquisition practices. Parentage is Italian, not a known US parent of the GmbH—but US-cloud subprocessors still apply (see privacy policy).