Privacy Policy
1. What we collect
Account: email address, display name, and profile details you choose to add. Those optional details include your home region, riding disciplines, skill level, garage, and, if you enter them, gender, date of birth, height, weight, years riding, and an emergency contact name and phone number. Everything beyond your email is optional, and you can edit or clear any of it from your profile at any time. Sign-in via Google or Apple shares your name and email from that provider; with Apple you may hide your real address. Location and rides: routes you build and, in the mobile app, GPS traces you choose to record. Recording happens only when you start it. Live location sharing is off by default and shared only with people you pick, revocably. Payments: handled by Stripe as merchant of record. We never see or store card numbers; we keep subscription status and receipts. Technical: device/browser type and error logs to keep the product working.
2. How we use it
To run INVIA: sync your library, render your rides, share what you mark shared, process subscriptions, send account email (sign-in codes, receipts, deletion notices), and improve the product. We may send product updates; marketing email is opt-out and deletion honors a suppression list.
3. What others can see
Private is the default for your content. You control visibility per item: public routes, rides, collections, and profiles are visible to anyone with the link; friends, groups, and events see what you share into them. Community surfaces (Explore, heatmaps) show only content marked public.
4. What we don't do
We don't sell your personal data. We don't share your location history with advertisers. We share data only with the processors that run the service, under their own data-processing terms, and when the law requires it: Supabase (database and authentication), Stripe (payments), Mapbox (map rendering, geocoding, and route snapping), Resend (email), Cloudflare (hosting, plus Turnstile for bot protection at sign-in), and Google Fonts (typefaces, which receives the requesting IP address). Two more only when you use the feature that needs them: BRouter, operated in Germany, receives route coordinates when you plan an off-road route, and Garmin or SPOT receive nothing but return your position when you connect a live tracking feed you own. Mapbox also collects its own telemetry from its map SDK.
5. Retention and deletion
Your data stays while your account is active. Deleting your account (Profile → Edit Profile → Delete account) starts a 14-day grace period, then permanently removes your content, profile, and location history. Payment records required for tax and accounting, and your deletion request itself, are retained as required by law. You can export your routes and rides as GPX before deleting.
6. Your rights
You can access, correct, export, or delete your data from within the product, and may contact us for anything the product doesn't cover, including rights under the GDPR or the California Consumer Privacy Act. We honor verified requests within the legally required windows.
7. Cookies and storage
We use browser local storage for your session and preferences. No third-party advertising trackers, and no advertising or analytics cookies. Because we do not track you across other websites, we do not respond differently to Do Not Track or Global Privacy Control signals; there is no cross-site tracking here to turn off.
8. Children
You must be at least 13 years old to hold an account. INVIA is not directed at children under 13, and we do not knowingly collect their data. If you believe someone under 13 has created an account, contact us and we will remove it. A rider between 13 and the age of majority where they live should have a parent or guardian review these terms with them, because riding carries real risk and location sharing shows where they are.
9. Changes and contact
Material changes will be announced in the product or by email. Questions or requests: [email protected]