Privacy

Plain English. A route can show where you live, so we are careful with it.

What we store

• Your spins. The GPX you upload is kept so you can check it again. It is listed under “Recently uploaded spins” for this device only. We delete a raw file after 12 months without use.
• A random device ID in a first-party cookie, so we can show you your own list. No account is needed. No ad or third-party tracking.
• Anonymous events (an upload, a report view, a share) to learn where and when people ride. For these we keep the route with the first and last 500 m removed, and a hash of your device that changes every month. We show only groups of 5 or more riders, never individuals.
• No IP addresses are stored beyond a one-hour counter used to limit uploads.

Sharing

• A report link shows the route to anyone who has the link. Don't share it if the route starts at your door.
• Community spins are opt-in per upload, with 500 m trimmed from both ends.
• The AI that writes the briefing receives only the summary numbers for the chosen start time. It never receives the GPX file or your device ID.

Your rights

Under the GDPR and UK GDPR you can see, export and delete your data. Do it yourself in Settings: export your spins, delete any one, forget everything, or opt out of insights (which also deletes your past events).

Lawful basis: contract, for the reports you ask for; legitimate interests, for trimmed and aggregated insights, with an opt-out. Data is kept in the EU.