Privacy

We store as little as we can, and you can delete all of it yourself. This is also the privacy notice the GDPR asks for, the same for groupride.net and the Groupride app.

Controller

The controller of your data is 6027 North Oy, Business ID FI36575957, registered in Finland. Anything about your data: [email protected].

What we store

Without an account: nothing on our server — browsing asks the server for rides and routes, and nothing about you is stored there. With an account: your email address, used only to send you sign-in links and codes and the notifications you choose, and a technical user id. Whatever you add to your profile: username, name, city, country, a few words about you, the clubs you ride with, helmet and bike colours and picture, all optional except the username. What you do in the service: rides you post (with a photo if you add one; only the picture itself is kept, not where it was taken or its other details) and join, car ride offers and requests with the notes you write, and GPX routes you save. If you use notifications: the areas and clubs you follow, your notification choices and time zone, and in the mobile app a push token of your phone. If you tip: the time of your last tip — no amount, no payment details — so that we can thank you a year later; if you were signed in, also the time of the last tip we confirmed with Stripe or the store, and whether you show the supporter badge.

What is visible to others

Your username, name, city, country, the few words about you, your clubs, helmet and bike colours, picture and ride scores are public on your profile page, and your username, picture and colours show on the rides you post and join. Rides you post and join are public, a ride's photo included. The note on a car ride offer or request is public, and the message you leave when you take a seat or answer a request is shown only to the rider whose offer or request it is. The supporter badge shows on your profile only if you have chosen to show it. Saved routes are private unless you attach one to a ride, in which case anyone who can see the ride can open and download the route.

Why, and on what basis

To run the service and keep your rides and routes across devices, and to send you sign-in emails and the notifications you have chosen (performance of our agreement with you, GDPR article 6(1)(b)); and to prevent abuse and keep the service secure (our legitimate interest, article 6(1)(f)). The supporter badge is shown on your consent (article 6(1)(a)), which you withdraw by hiding it. The Navigator uses your position on the phone to follow the route; it is never uploaded. To show the rides near you, the app reads the phone's position only after you tap “Use my location” in the area choice, and from then on at each start until you pick an area yourself: the phone's own location service (Google on Android, Apple on iOS) turns it into a country and town, and only the town's name is sent to our server to find the matching area. On the website the same button asks your browser for the position, rounds it to about a kilometre and has OpenStreetMap's Nominatim service name the town, the same way. We never receive or store your position. Without it the site and the app guess your country from your IP address, which is not stored either.

Notifications

You choose them under Account → Notifications: the areas or whole countries you follow, the new rides there by email, and a message when someone takes a seat in your car, offers you a ride or accepts you in their car (on by default, sent at once). We store those choices, the language of the messages and the time zone of your browser or phone, so that the new rides come at 9:00 and 21:00 your time. Notification emails go to your account's address through SendGrid, and every one has an unsubscribe link that works without signing in. To deliver push notifications, the mobile app stores a push token of your phone: a random identifier from Google Firebase Cloud Messaging on Android (and Apple Push Notification service on iPhone, later), through which the notification travels to your phone. The token is deleted when you sign out on that phone, when the app is uninstalled, or when you delete your account.

What we don't do

• No ads.
• No selling or sharing your data.
• No analytics, tracking pixels or profiling.
• No linking to social media accounts.
• No automated decisions about you.

Cookies and storage on your device

Only what the service needs, nothing for marketing: the browser (or the app, on the phone) keeps you signed in and remembers your language, your chosen area and sports, and the tip note's two dates — when you first came, so that the note shows once a week later, and when you last tipped, so that a thank-you comes a year after.

Who processes the data

Groupride runs on Supabase in the EU (Stockholm region) and on Cloudflare. Sign-in and notification emails are sent through SendGrid, which also delivers us a note when a new user signs up. Push notifications in the mobile app are delivered by Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iPhone). Cloudflare sits in front of the site for security and speed and may process technical data such as your IP address to block attacks. The website's “Use my location” sends a rounded position to the OpenStreetMap Foundation's Nominatim service in the United Kingdom, which sees it and your IP address only to answer with the town's name. None of them use your data for their own purposes. Your account data is stored in the EU, but SendGrid (Twilio), Google, Apple and Cloudflare are US companies whose services may process some of it outside the EU or EEA: your email address and the content of the emails, the push token and the text of a notification, and technical data such as your IP address. These transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

If you leave a voluntary tip on the website, the payment happens on Stripe's own checkout page, with Stripe as the seller (merchant of record) processing your payment details under its own privacy policy; in the app a tip is paid through Google Play or the App Store under theirs. To confirm a tip for the supporter badge, our server asks Stripe whether the payment went through, or checks Google Play's signature on the purchase. We never see your card details, and of the payment we keep only its time, as told above.

How long, and deleting your data

We keep your data as long as you have an account. Delete it under Account whenever you want: your account, profile and its clubs, participations, offers, saved routes, notification settings and followed clubs, push tokens, the times of your tips and the supporter badge are removed immediately. Rides you posted stay visible without your name, with their photos, so that other participants keep their plans.

Your rights

You may ask what we hold about you, have it corrected or deleted, restrict or object to its processing, and receive it in a machine-readable form. Write to [email protected]; we answer within a month. You may also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

That's all of it. Ride on 🚵