Privacy Policy

Effective date: July 13, 2026

Your Rides is a ride-tracking and route-planning service for motorcyclists, available as a web app and a mobile app. This policy explains what data we collect, why, where it lives, and the rights you have over it. The short version: we collect what the product needs to work (your account and your rides), we do not run ads, and we never sell your data.

1. Who is responsible for your data

Your Rides is operated by Jorge Collinet as an individual (the “operator”, “we”). For any privacy question or request, contact support@kodspear.com. We are the data controller for the personal data described in this policy.

2. What we collect

Account data — email address, password (stored as a hash by our authentication provider), or your Google / Apple sign-in identity. Guest mode creates an anonymous account with no personal details.
Profile data — handle, display name, bio, and avatar image, if you choose to set them.
Location and ride data — GPS tracks recorded while you record a ride, including in the background with the screen off (the app asks for this permission explicitly and records only while a ride is active), plus derived data such as distance, duration, speed statistics, and places passed. Routes you plan and save are also stored.
Social content — follows, kudos, group memberships, group posts, event RSVPs, and event chat messages you write.
Push notification tokens — a device token used solely to deliver the notifications you enabled.
Technical data — standard server logs (IP address, request metadata) kept briefly for security and debugging. We use no advertising or cross-site tracking, and no third-party analytics profiles.

3. Why we process it

We process your data to provide the service you signed up for (contract performance, GDPR Art. 6(1)(b)): recording and displaying rides, planning routes, and powering the social features. Security logging and abuse prevention rely on our legitimate interest (Art. 6(1)(f)). Background location recording and push notifications run only with your explicit permission, which you can withdraw at any time in your device settings.

4. Where your data lives and who processes it

We use a small set of service providers (processors) to run Your Rides:

Supabase — database, authentication, and file storage (avatars, group images).
Cloudflare — web hosting, edge API, and email delivery for account emails.
Routing engines — when you plan a route, the coordinates of your start, end, and waypoints are sent to our self-hosted routing engine, and as a fallback to openrouteservice (Heidelberg Institute for Geoinformation Technology). Only the request coordinates are shared, never your identity or ride history.
Expo and Apple/Google push services — deliver push notifications to your device if you enabled them.
AI providers (Anthropic, OpenAI) — power the AI features. When you use them, your chat messages and the trip context needed to answer are sent to the provider's API for processing. This data is not used to train AI models. If you never use the AI features, nothing is sent. Separately, if you connect an external AI assistant of your choice (for example Claude or ChatGPT) to Your Rides, that assistant handles your data under its own provider's privacy policy, not this one.

Each provider processes data only on our instructions under a data-processing agreement. Where data leaves the EEA, transfers rely on the providers' standard contractual clauses or adequacy decisions.

5. What other people can see

Ride visibility is controlled by you per ride (private, followers, or anyone) and is enforced on our servers. Privacy zones let you hide ride start/end areas (for example around your home) from others. Your profile (handle, display name, bio, avatar, aggregate stats) is visible to other signed-in users. Content you post in groups and event chats is visible to the members of those groups and events.

6. How long we keep it

Your data is kept for as long as your account exists. Server logs are retained for a short rolling window. When you delete your account, all of it — rides, routes, social content, profile, push tokens, and stored images — is deleted immediately and permanently; only ephemeral database backups persist for up to 30 days before they cycle out.

7. Your rights

Under the GDPR you can access, correct, export, restrict, object to, or delete your personal data. You can delete your account yourself at any time: in the mobile app under Profile → Account → Delete account, or on the web under Profile → Delete account. For anything else (including data export), email support@kodspear.com — we answer within 30 days. You also have the right to complain to your local data protection authority.

8. Security and breaches

All traffic is encrypted in transit, data access is gated by row-level security in the database, and secrets never ship to clients. If a breach ever affects your personal data, we will notify you and the competent supervisory authority without undue delay and within the legally required timeframe.

9. Children

Your Rides is not directed at children. You must be at least 16 years old to create an account.

10. Changes to this policy

If we change this policy in a way that matters, we will update the effective date above and notify you in the app before the change applies.