RydeePL

Privacy Policy

This Policy sets out the rules for the processing of personal data in connection with the use of the Rydee mobile application and the Rydee website.

Effective date: 11 November 2026.

1. Definitions

  1. Controller means the entity identified in Section 2.
  2. App means the Rydee mobile application for Android or iOS devices.
  3. Website means the website on which this Policy is published.
  4. User means a natural person using the App or the Website.
  5. GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

2. Data controller

  1. The controller of personal data is company name: to be completed, address: to be completed, tax ID tax ID: to be completed.
  2. The Controller may be contacted on matters relating to personal data protection at: support@rydee.app.

3. Data stored on the device

  1. The App does not require an account. The Controller has no access to the data referred to in this Section.
  2. The App stores on the User’s device: rides (GPS position, time, speed, elevation, and heart rate, cadence and power read from sensors), profile data (in particular age, sex, weight, maximum heart rate and FTP), bikes, paired sensors, favorite places and settings.
  3. Data from Bluetooth sensors is read and processed solely on the device.
  4. If the User uses Google or iCloud system backup or device-to-device transfer, rides and settings may be included in those mechanisms. Strava tokens are excluded from backups. The User manages backups in the device settings.

4. Location

  1. The App uses GPS location while visible on screen in order to show speed, display the map, record rides, provide navigation and present weather information.
  2. The App does not request background location access.

5. External services

  1. To the extent necessary for the operation of individual features, the App transmits the device’s IP address and the following data:
    • on App start: a request for the required App version, to Firebase Hosting (Google);
    • on opening help: a request for current help content, to Firebase Hosting (Google);
    • maps: the map area viewed, to OpenFreeMap (Free edition) or Stadia Maps (Premium edition);
    • weather: coordinates rounded to two decimal places, to MET Norway;
    • destination search: the text entered and position, and when a point is selected on the map its coordinates, to the public Photon service operated by komoot;
    • routing: route points, through the Rydee server to OpenRouteService (HeiGIT).
  2. The Rydee server does not store coordinates or routes. Server logs contain technical data only, such as bike profile, number of points, status and time.
  3. The entities listed process data in accordance with their own privacy policies.

6. Strava

  1. Connecting the App to a Strava account is optional and uses the OAuth protocol.
  2. The Rydee server is involved solely in exchanging, refreshing and revoking tokens, because it holds the App secret. The server neither stores nor logs tokens or response content.
  3. Tokens are kept on the device in the system’s secure storage. Rides are sent directly to Strava at the User’s request. Starred segments are cached for no longer than 7 days.
  4. Disconnecting the account revokes the tokens and deletes this data from the device.
  5. Processing of data by Strava is governed by that service’s privacy policy.

7. Health Connect

  1. With the User’s explicit consent, the App writes rides to Health Connect on Android devices as cycling workouts, including time, pauses, route, distance, calories, elevation gain, heart rate, speed, cadence and power. Only the data types covered by consent are written.
  2. The App does not read any data from Health Connect.
  3. This data is not sent to Rydee servers, is not shared with third parties and is not used for advertising.
  4. The User may change or withdraw permissions in Health Connect settings. Deleting a ride in the App does not delete it from Health Connect.

8. Other permissions

  1. Bluetooth: finding sensors and reading their data.
  2. Notification access (Android, optional): displaying the title, artist and cover of the track being played in the Music widget. The App does not read the content of notifications or messages.
  3. USB camera (Android, optional): live preview from a connected camera. The image is not transmitted. The device’s built-in cameras are not used.

9. Premium subscription and purchase

  1. The subscription and one-time purchase of the Premium edition are handled by Google Play or the App Store. The Controller does not receive payment card details.
  2. The store provides the App solely with information about a completed purchase or an active subscription.
  3. Subscriptions, including cancellation, are managed in the User’s account settings in the relevant store.

10. Messages and contact

  1. The User may send a message to the Controller using the “Write to us” form in the App (Help screen) or the contact form on the Website, or directly at support@rydee.app.
  2. The form transmits: the type of message (problem, suggestion, question, opinion, other), the message subject and text, an email address for reply if the User provides one, the language and, for the App, its version and system (Android or iOS). The form does not transmit location, rides, the event log or device identifiers. The IP address is used to limit the number of messages and to prevent abuse.
  3. Providing an email address is optional. Without it, the Controller cannot reply to the message.
  4. The message is stored in the Rydee server database (Google Cloud Firestore, Warsaw region), and a copy is delivered to the Controller’s mailbox.
  5. The data is used solely to reply, handle the request and improve the App, and is not used for marketing.

12. Recipients and transfers outside the EEA

  1. The processors acting on behalf of the Controller are Google (Firebase, Warsaw region for server functions and database) and OVH (hosting of the Controller’s email, including copies of messages from the forms).
  2. Strava and certain service providers may process data outside the European Economic Area, including in the United States, on the basis of adequacy decisions or standard contractual clauses.

13. Data retention

  1. Data stored on the device is retained until deleted by the User or until the App is uninstalled.
  2. Technical server and hosting logs are retained in accordance with the provider’s settings, by default for no longer than 30 days.
  3. Messages from the forms are kept in the server database for 12 months from receipt and are then deleted automatically. Email correspondence is kept for as long as needed to handle the request, no longer than 12 months from the last message.

14. User rights

  1. The User has the right to access, rectify and erase data, to restrict processing, to data portability, to object and to withdraw consent.
  2. The User has the right to lodge a complaint with a supervisory authority; in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).
  3. As the App has no user accounts, the Controller is generally unable to link technical logs to a specific person.
  4. For matters concerning messages sent, including their deletion, the User may contact the Controller at support@rydee.app, preferably from the address given in the message.
  5. Rides may be deleted in the App, and a copy may be obtained using GPX export.

15. Website

  1. The Website does not use cookies or analytics tools and does not load resources from external services.
  2. The contact form sends data solely to the Rydee server, as described in the Section “Messages and contact”.
  3. The selected theme is stored solely in the User’s browser.
  4. The hosting provider processes the IP address in order to deliver the Website.

16. Minors

  1. The App is not directed at children under 16 years of age.

17. Changes to this Policy

  1. The Controller announces significant changes to this Policy on the Website and, where necessary, in the App.
  2. The date stated at the beginning of this document is the effective date of the current version.