Privacy Policy

Contact

For privacy questions, access requests or deletion requests, email RideRelay@icloud.com.

What data do we use?

• Your account and connections: your name, account identifiers, permissions granted and access tokens for services you choose to connect.
• Activities and routes: titles, dates, start and end times, GPS points, distance, duration, elevation and bicycle or activity type. Private activities may also be imported if you grant the relevant permissions.
• Sensor data: available speed, cadence, heart rate, measured power, left/right balance, temperature and electronic shifting. This data may reveal information about your health.
• Your preferences: for example, gearing settings, connected apps and map preferences.
• Technical data: information needed to provide and secure the website, such as your IP address, browser and sign-in session.

Your GPS track may reveal your home address and other sensitive locations. Only grant other people access if you want to share this information with them.

Where does the data come from?

Strava is the main source for your activities and planned routes. If you connect Wahoo, we also use data from your Wahoo account and available FIT files to compare and enrich activities. If you connect Garmin using your Personal API key, we retrieve available activities and original FIT files. You can also send selected routes to Garmin Connect.

Why are we allowed to use this data?

We need your data to import your activities, show your heatmap and analyse your rides and routes. We do this to provide the service you ask us for. Performance of our service agreement is the legal basis for this use. You choose which accounts to connect. We need your explicit consent to use health data. You can withdraw that consent at any time by disconnecting the service or emailing us.

We use technical data to keep RideRelay secure and prevent abuse. The legal basis is our legitimate interest in keeping the service safe. You do not have to connect an account. Without a connection, we cannot show your personal activities and analyses.

Who receives data?

• Cloudflare provides hosting, security and storage. Access tokens and stored activity archives are encrypted at rest. Cloudflare may process data outside the European Economic Area. Such transfers are subject to the safeguards in Cloudflare’s Data Processing Addendum, including EU Standard Contractual Clauses.
• Map, weather and location services supply information for maps and route checks. Open-Meteo receives selected coordinates and dates for weather information. Map services such as OpenStreetMap, PDOK and OpenFreeMap may see which map area you request. If your browser loads a map directly from them, they also receive your IP address. To find roadworks and facilities, we sometimes request information about a search area from public sources such as NDW or RIVM. We do not send Strava or Wahoo access tokens with these requests.
• Connected apps and shared accounts only receive access if you authorise it, within the permissions granted. You can revoke this access in Settings.
• External links: when you open Google Maps, Apple Maps, Street View or Cyclomedia, the selected location is passed to that service and its own privacy terms apply.

An AI app that you explicitly authorize through the MCP connection can retrieve selected RideRelay data. That app processes received data under its own terms. Without this connection RideRelay does not send your activities to an AI service. We do not make automated decisions with legal or similarly significant effects based on your analyses.

How long do we keep data?

We keep your activities, analyses and settings so you can return to them later. We do not automatically delete them if you stop using RideRelay for a while. You can ask us to delete them at any time.

Disconnecting Strava in Settings removes the local Strava connection, stored activity archives and associated access for connected apps. If you disconnect Wahoo, we can no longer retrieve new data. Activities already stored in RideRelay remain available. Use Delete RideRelay account in Settings for full deletion, including remaining account settings and connected-app access. You can also contact us. Deleting data from RideRelay does not delete activities from Strava, Wahoo or Garmin. Data may temporarily remain in the hosting provider’s recovery copies. The provider’s retention periods apply to those copies. They are not used for RideRelay’s normal operation.

Recovery and operational checks

Cloudflare maintains database recovery history. Additional recovery copies are encrypted. Deleted data can temporarily remain in existing recovery copies; deletion requests must be reapplied after a restore. A minimal deletion marker is retained for up to 30 days to reject delayed imports. Operational logs use technical categories, a generated request identifier, status and duration, without tokens, names, GPS points or request contents. GitHub checks public health endpoints without user data.

Cookies and storage on your device

RideRelay uses an essential sign-in cookie lasting up to 30 days and temporary cookies for connecting accounts. Map preferences and synchronisation progress may be stored on your device until you clear your browser data. We do not place advertising or tracking cookies or use marketing analytics.

Your current location is only requested when you use the location button and your browser grants permission. You can revoke that permission in your browser.

Your rights and contact

You can ask what data we hold about you. You can have it corrected or deleted and ask for a copy you can use elsewhere. You can also ask us to limit its use, object to processing or withdraw your consent. Email RideRelay@icloud.com and tell us which account you use. Do not send passwords or access tokens. We may ask you to confirm that you own the account.

We normally respond within one month. If your request needs more time, we will let you know. You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

If RideRelay’s operation changes, we will update this policy. The date at the top identifies the version you are reading. You decide whether to activate any new connection.