The Rider App Privacy Statement

This is a translation for your convenience. In case of any difference, the Dutch text prevails.

In short

• The Rider App is an app for motorcyclists: planning routes, navigating, recording rides and riding together. To do this, we process your data, including your location.
• We only record your ride and share your location live with your consent. You can always withdraw that consent in Settings, Privacy.
• Around your home, we hide your exact position from others. We strip photos of hidden location data.
• We do not sell your data and do not use it for advertising.
• We keep your data for as long as your account exists. You can download your data and delete your account yourself in the app.
• Questions? Email info@theriderapp.com.

Everything is explained in detail below.

1. Introduction

The Rider App ("the App") is an application for motorcyclists that combines route planning, navigation and a social community. The App is available for iOS and Android. We also have a website (theriderapp.com) with, among other things, a waiting list. The App is offered by The Rider App B.V. ("we", "us").

In this privacy statement we explain which personal data we process about you when you use the App or the website, for what purpose and on what legal basis we do so, with whom we share data, how long we keep it and what rights you have. We process your data in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

2. Who is responsible?

The controller for the processing of your personal data is:

The Rider App B.V., registered with the Dutch Chamber of Commerce (KvK) under number 99066556, Kattenburgerstraat 244, 1018 JK Amsterdam.

For privacy questions and to exercise your rights, email info@theriderapp.com.

3. What personal data do we process?

Below is the data we process, per part of the App. Many features (such as live sharing, contact matching and product analytics) are optional and only work if you choose to use them.

3.1 Account and profile

• Email address, username, full name and login details. Logging in runs through our login service (Clerk); if you log in with Google, Apple or Facebook, we receive your name and email address from that service.
• Profile description (bio) and profile photo.
• Date of birth (to check that you are 18 or older) and, if you fill it in, your gender.
• Your region and country, the language of the App (so that notifications reach you in your language) and, if you are a founding member, your member number.
• Account status and the times of creation, changes and last login.
• When you log in, our login service processes your IP address and data about your device.

3.2 Home location and saved places

• Your home location (coordinates). We use it to create a privacy zone around your home: within that zone we hide your exact position from others (see section 5). If you do not set a home location yourself, we set a rough one (accurate to about one kilometre) when you set up the App, if you give the App access to your location.
• Places you save (such as Home, Work and favourites) and your recent destinations (at most 10, for at most 90 days).

3.3 Riding preferences and answers during setup

• Preferences for routes and profile, such as curviness, distance, roads to avoid (tolls, unpaved roads, ferries, motorways), riding style, experience, type of motorcycle and group size.
• The answers you give when setting up the App, such as what you want to use the App for and what kind of rides you make.

3.4 Privacy settings and consents

• Your visibility and privacy settings, such as who may see your rides, garage and statistics, who may send you a message and whether others see that you are online.
• The record of your consents: for which feature, which version of the text, in which language, on which screen and when you gave or withdrew consent.

3.5 Recorded rides

• The GPS track of your ride (the series of positions), start and end time, distance, riding time, average and top speed, elevation gain, number of stops, curviness and the name of the place where you rode. While recording, the App also uses the time, speed, heading and accuracy of each position; we do not store these per point.
• The title, description, destination and weather of the ride, and the riders you rode with if you invite them for this.
• Rides you import yourself (for example a GPX file).
• The visibility you choose (everyone, followers only or only you) and whether the start and end of your ride are hidden. New rides are set to followers only by default, with the start and end hidden.

3.6 Photos and videos

• Photos with rides, posts, your garage, clubs, ride-outs, group chats, routes and reviews. When you upload a photo, we automatically remove the hidden data in the photo (EXIF), such as GPS location, time and device, before we store the photo.
• Videos (at most 30 seconds) with posts, public rides, your motorcycle and clubs. We store videos with a video service (Cloudflare Stream, United States); see section 6. For a video in a ride, we keep the place where you filmed, unless it is close to your home. We do not remove the hidden data in the video file itself.

3.7 Planned and saved routes

• Routes you plan or save: name, description, the route line, start and end point, waypoints, distance, time, curviness, elevation profile, GPX data and any cover photo.
• Your own points of interest that you record, with name, location and address.

Please note: the start and end point of a publicly shared route may point to a home address. That is why we anonymise shared routes when you delete your account (see section 8).

3.8 Reviews

• Reviews of routes, hotels and campsites: rating, title, text, photos and additional fields (such as date, weather, traffic, type of motorcycle and, for accommodation, ratings for parking, biker friendliness and price).

3.9 Garage and maintenance

• Data about your motorcycle(s): make, model, year of manufacture, colour, engine capacity, nickname, mileage, technical specifications, purchase and sale date, status, photos and videos. Your garage is set to "followers only" by default (to prevent theft).
• Your maintenance per motorcycle: services carried out, maintenance schedule, mileage, costs, workshop, notes and products used.
• Documents and attachments you add yourself, such as insurance papers, your vehicle registration certificate and invoices (photo or PDF). Only you can see them. For photos we remove the hidden data (EXIF); we store a PDF as you upload it.
• The App schedules maintenance reminders on your phone itself; they do not go through our server.

3.10 Social data

• Who you follow and who follows you, and blocked users.
• Chat messages, private messages and group chats that you send and receive through the App, and chats you mute. The content of chat messages is stored with our chat service (Stream); see section 6.
• Posts, comments and likes in the feed and in clubs.
• Membership of clubs (with the club's location), your role, requests to join, invitations, and ride-outs with sign-ups, photos and invitations. Group rides with friends.
• Progress in challenges, badges and milestones achieved and your place on leaderboards. Only public rides count on leaderboards, and you do not take part if you have hidden your statistics.
• Rides you share in a chat; the participants of that chat can then see the ride.
• Reports you make about users, messages or media. If you report a chat message, we keep a copy of that message so we can assess the report.

3.11 Live location sharing

• If you share live: your current position and, when sharing with your followers, the track of your ride during the broadcast with time, speed, heading and accuracy.
• If you turn on always share with mutual friends: your last known position and speed, also outside a ride (about every minute or every 100 metres).

See sections 5 and 7 for who sees this and how long we keep it.

3.12 Contact matching

• If you look for friends through your contacts, the App sends the phone numbers from your address book over a secure connection to our server. There we immediately turn them into an irreversible code (hash), using a secret key that only we have. We never store readable numbers.
• You confirm your own phone number with a text message code (via Twilio); after that we only keep its hash. We also keep a hash of your confirmed email addresses, so that others can find you.
• We keep the hashes of your contacts to suggest people you may know and to let you know when a contact signs up. These may include numbers of people who do not (yet) use the App.

3.13 Notifications

• A push token per device, with the platform (iOS or Android), so that we can send you notifications.
• What the notification says, for example who liked your post or who sent you a message, with the beginning of that message.

3.14 Waiting list and newsletter (website)

• If you sign up on the website: your first name, last name, email address and language.
• The website remembers in your browser, only while the tab is open, through which website you came to us (or that you came directly) and on which page of our website you arrived (only the path, such as /nl/). When you sign up, we send these two along. We do not use a cookie for this. This is how we measure which channels bring in sign-ups.

3.15 Subscriptions

• For a premium subscription we keep only a minimal set: an event ID, your account ID and the type and time of the event. The payment itself runs through the App Store or Google Play; we manage the subscription with RevenueCat. We do not store payment details.

3.16 Product analytics (only with your consent)

• If you give consent for product analytics in Settings, the App sends events to PostHog (servers in the EU), such as opening the App, the steps during setup, adding a motorcycle and recording, saving or starting a ride or navigation. We link these to an internal number of your account, not to your name or email address. No location and no free text are included, and we do not let PostHog derive your location from your IP address.
• Only if you give separate consent for it, the App also records how you use the setup screens (screen recording, with masked text).

3.17 Technical data

• Error reports from the App to our own server, kept as limited as possible and without IP address.
• Crash and error reports through Sentry (servers in the EU), with the model and operating system of your phone. We filter out names, email addresses, phone numbers, coordinates and login codes before a report leaves the phone.
• Events during the setup of the App (such as which step you complete and whether you give a consent), linked to your account or, before you have an account, to a random code on your device that contains no personal data.
• The usual log files of our server (IP address and browser or app data).
• When checking for updates of the App, your phone contacts the update service of Expo; that service sees your IP address and the version of the App.

4. For what purposes and on what legal basis do we process your data?

We process your personal data only for the purposes below, and only on the legal basis stated with each.

Withdrawing consent. Anything based on consent can be withdrawn at any time. This does not affect what we lawfully did before. You withdraw your consent with the switches in Settings (record ride, live sharing, contact matching, product analytics), with the unsubscribe link in our emails (newsletter), or by emailing us. We keep the record of your consent and of its withdrawal as proof.

Legitimate interest. Where we rely on legitimate interest, that interest is: keeping the service safe, stable and reliable, preventing abuse and fraud, and knowing which channels bring in new riders. We have weighed this against your interests and those of others. For contact matching, we took into account that we only keep an irreversible hash of people who do not use the App, so that the risk to their privacy is small; we also cannot inform them separately, because we only have that hash. You may always object to processing on this basis. We will send you our balancing assessment on request.

5. Your location

Your location is a core part of the App. We use it in four ways:

1. During navigation and route planning, to show you the route and guide you. We calculate the route on our own servers. For traffic information we send the line of your route to TomTom, and for the weather your position to our weather service (see section 6). We do not store your navigation positions.
2. When recording your ride, to capture your track and statistics. Only with your consent. If you start navigation, the App also records the ride, if you gave consent for that.
3. During live sharing, to show your position during the ride to your followers, a club ride or a group ride with friends. Only with your consent. You can set live sharing to start automatically when you record a ride or navigate (this is off by default). If your profile is open (the default), anyone who follows you immediately becomes your follower; if it is private, you approve your followers yourself first.
4. With always share with mutual friends, if you turn it on: your last known position, also outside a ride. Only with your consent.

Access to your phone's location. Separately from the legal basis for each processing, the App only gets access to the location (GPS) of your phone after you have allowed this through the system permission of iOS or Android. You can withdraw that access at any time in your phone's settings.

Your privacy zone. If you have a home location, we hide your exact position around your home, without you having to turn anything on. During live sharing we leave out positions in that zone entirely. When showing your rides to others, we leave out the part in that zone, and also the start and end of the ride (unless you set this differently). For photos and videos close to your home, we do not keep the place. On the friends map, your mutual friends do not see you within 500 metres of your home.

6. With whom do we share data?

We work with service providers that process personal data only on our instructions (processors). We have a data processing agreement with each processor, or their standard terms contain one. Below, for each service, is what it receives and where it is established. Some services communicate directly with the App on your phone; they also see your IP address when doing so.

Services you log in to yourself. If you log in with Google, Apple or Facebook, you share data with that service under its own terms and privacy statement.

Weather, petrol stations and points of interest. For the weather, we request the weather forecast from our own server for a position or for points along your route, from Tomorrow.io (United States) and, as a backup, from OpenWeather (United Kingdom). For petrol stations and fuel prices, points of interest along your route and the rain radar, we request data about an area from public services such as OpenStreetMap Overpass, the ANWB and RainViewer. We only send those coordinates or that area, never your name, account or anything else that can be traced back to you.

Other users and the public. Besides these service providers, other users can see your data, and with public visibility also people without an account and search engines. This applies to what you make public yourself, such as public rides and routes (whose start and end point may point to a home address), posts, comments, your public profile and reviews. If you share a public ride through a link, anyone with that link can see the ride on our website. You decide the visibility yourself in the App. Your garage is set to "followers only" by default. Check your visibility settings before you share something.

We do not sell your personal data.

7. How long do we keep your data?

We do not keep your data longer than necessary for the purpose for which we collected it.

• Account, rides, routes, photos, posts and other content: for as long as your account exists. Your rides and routes are the core of the service, your own ride history, and we keep them for as long as you use the service. If you do not log in for 24 months, you receive a message and we delete your account and the associated data if you do not log in again after that. If you delete your account, we delete this data in any case (see section 8).
• Live sharing and the track: we permanently delete a broadcast and its track about 10 minutes after it ends. A broadcast that receives no new position for an hour is stopped automatically, and the same then applies.
• Always share: we only keep your last known position and speed; each new position overwrites the previous one. If you turn off always share, we delete your last position immediately. A position older than 90 days is deleted automatically every day.
• Your recent destinations: at most 10, and for at most 90 days.
• Error reports on our server: 30 days.
• Crash and error reports at Sentry: at most 90 days.
• Events during the setup of the App: 180 days, and in any case until you delete your account.
• Product analytics: for as long as we need it to improve the App. After your account is deleted, the events can no longer be linked to you.
• Contact matching: the hashes of your contacts for at most 90 days. If you turn off contact matching, we delete them immediately.
• Subscription events: 90 days.
• A download of your data (export): 24 hours, after which we delete the file.
• Consents: we keep the record of your consents for as long as your account exists, also if you withdraw a consent (we then record the time of withdrawal).
• Waiting list and newsletter: for as long as you are signed up. If you unsubscribe, we will not send you anything anymore and we delete your sign-up from our database 30 days later. Klaviyo keeps your email address as unsubscribed, so that you no longer receive email; if you also want us to delete that, email us.

8. Deleting your account

You delete your account yourself in the App. First we delete your login account at our login service, then all your data permanently. If something goes wrong in between, our systems complete the deletion automatically.

• We delete your account data and everything linked to it (rides, routes, photos, videos, posts, likes, followers, garage, maintenance and documents, live broadcasts, consents, chat links and more) from the database.
• We delete the files you uploaded (photos, documents, attachments) from our storage, and videos at the video service.
• We close your chat account, and we clean up hashed contact data, the subscription records and other data linked to you.

What remains, without it being traceable to you?

1. Publicly shared routes of more than 2 kilometres are not destroyed but anonymised: we detach them from your account and put them in the name of an anonymous "deleted rider". We shorten the start and end by about 1000 metres, so that your home or work cannot be seen, and we remove the name, description, GPX data, waypoints, cover photo and any texts. We delete shorter public routes and all private and followers-only routes completely.
2. An irreversible code (hash) of your login account, so that a deleted account does not come back by accident and we can verify that the deletion has been completed.

9. Your rights

You have these rights:

• Access: you may know which data we process about you.
• Rectification: you may have incorrect data corrected. You can change a lot yourself in your profile and settings.
• Erasure: you may have your data deleted. You delete your account yourself in the App (see section 8).
• Restriction of processing.
• Data portability: you may take your data with you.
• Objection to processing based on legitimate interest (see section 4).
• Withdrawing consent, without retroactive effect (see section 4).

How to exercise your rights:

• Downloading your data: with the data export in the App you download your data, as an overview or as a zip file with your own photos and documents.
• Deleting your account: in the App.
• Settings and consents (live sharing, contact matching, product analytics, newsletter) you manage yourself in the App.
• Other requests: email info@theriderapp.com.

We respond within one month of your request. If a request is complex or we receive many requests, we may extend that period by at most two months; we will let you know within one month if so.

10. Complaint to the supervisory authority

If you do not agree with how we handle your data, you can file a complaint with the Dutch data protection authority:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl

You may also go to court.

11. Security

We take appropriate technical and organisational measures to protect your data against loss and unlawful use. For example:

• when you upload photos, we strip them of hidden location and device data;
• we do not store phone numbers and email addresses for contact matching in readable form, but as an irreversible hash;
• our servers, database and storage are located in the EEA (Germany), except for the services in section 6;
• documents and private files can only be opened through our server, after checking that they belong to you;
• we keep error reports as limited as possible and without IP address;
• we apply a privacy zone around your home location.

Within our organisation, only the administrator has access to personal data.

12. Data breaches

Despite our measures, a data breach may occur. In that case we report it without undue delay, and where possible within 72 hours, to the Autoriteit Persoonsgegevens, unless the breach is unlikely to result in a risk to your rights and freedoms. If the breach is likely to result in a high risk to you, we will also inform you without undue delay.

13. Cookies and similar technologies

• Website: our website (theriderapp.com) does not place cookies and does not use trackers. For the waiting list, the website remembers in your browser, only while the tab is open, through which website and on which page you arrived (see 3.14). The fonts are hosted on our own server; your browser does not fetch anything from Google or another font service.
• Logging in: if you log in on the web, our login service (Clerk) places functional cookies that are necessary to log in and stay logged in. Without those cookies you cannot log in.
• App: the App does not use advertising or tracking technologies. Product analytics only takes place with your consent (see 3.16).

14. Children

The App is only for people aged 18 and older. When you create your account, we ask for your date of birth; without a date of birth showing you are 18 or older, you cannot use the App.

15. Changes

We may change this privacy statement, for example if the App or the law changes. The current version is always available in the App and on the website. In the case of major changes that affect your rights, we will inform you in an appropriate way. The version number and the date of the last change are shown at the top.