Privacy Policy
Defensive Pedal is a cycling app that plans bike routes around traffic risk. To do that the app needs to know where you are while you ride. This policy explains what we collect, why, how long we keep it, who else sees it, and the rights you have under the General Data Protection Regulation (GDPR).
1. Who is responsible for your data?
The data controller is Antifragil SRL, the company that makes Defensive Pedal, a company registered in Romania (registered office: V. V. Stanciu 5, Bucharest, Romania; trade register no. J2017020730400; tax ID (CUI) 38619226). You can reach us about privacy at privacy@defensivepedal.com. We have not appointed a Data Protection Officer because we are a small company that does not process data on a large scale; the same address reaches the person responsible for data protection.
2. What do we collect, why, and on what legal basis?
| Data | Why we use it | Legal basis | How long |
|---|---|---|---|
| Account details: email address, a hashed password, and optional profile details such as a display name | To create and secure your account, sync your settings and saved routes between devices, and send service messages such as password resets | Contract (Art. 6(1)(b)) | Until you delete your account, then removed within 30 days |
| Location while navigating: your GPS position, speed and heading while a ride is active | To show your position on the map, give turn-by-turn directions, re-route you, warn you about hazards ahead and fetch the weather for where you are | Contract (Art. 6(1)(b)). Your phone also asks for your permission before sharing location, and you can withdraw it in the phone settings at any time | Live positions are processed during the ride. We keep the route you actually rode as a trip record (see next row). The app reads your location only while a trip is running; it does not track you in the background between rides |
| Trip records: start and end point, the route taken, distance, duration, date and time | To show your ride history and post-ride statistics (CO₂ avoided and minutes of life gained, estimated with the WHO health model), to let you save routes, and to improve the safety model by learning which streets cyclists actually use | Contract (Art. 6(1)(b)) for your history and statistics; legitimate interest (Art. 6(1)(f)) for improving the safety model, where we use trips in aggregated form | Until you delete your account. Trips used to improve the safety model are kept only in aggregated form that no longer identifies you |
| Preferences: bike type, how cautious you want routes to be, units, language, Premium status | To tailor routes to you | Contract (Art. 6(1)(b)) | Until you change them or delete your account |
| Hazard reports: the location, type and description of a hazard you report, the time, and your account ID | To warn other riders, to improve the safety model, and to let us remove abusive or wrong reports | Contract (Art. 6(1)(b)) for showing your report in the app; legitimate interest (Art. 6(1)(f)) for keeping the map accurate | Reports are shown to other riders without your name or email. A report stays on the map while other riders confirm the hazard is still there and is removed once it stops being confirmed |
| Usage analytics: which screens and features you use, app version, device model and operating system, coarse crash information | To understand what works and fix what breaks | Consent (Art. 6(1)(a)). Analytics are off until you switch them on in the app, and you can switch them off again at any time in Settings | 24 months, then deleted or reduced to counts that cannot be linked to you |
| Purchases: whether you have an active Premium subscription, its plan and renewal date, and a store transaction identifier | To unlock Premium features and handle renewals and cancellations | Contract (Art. 6(1)(b)) | For the life of the subscription plus the period Romanian accounting law requires us to keep transaction records (currently 10 years) |
| Support and feedback: what you write to us by email or in-app feedback, and your contact details | To answer you and to fix the problems you report | Legitimate interest (Art. 6(1)(f)) | Up to 24 months after the conversation ends |
We do not collect payment card details. Payments for Premium are handled entirely by Google Play or the Apple App Store under their own privacy policies.
We do not process special categories of data (such as health data) on purpose. The post-ride health estimate is a calculation applied to your distance, using the World Health Organization's HEAT method; it is shown to you and is not used to profile you.
3. The website
defensivepedal.com uses Umami, a privacy-focused analytics service, to count visits. Umami does not set cookies and does not store personal identifiers; it records the page viewed, the referrer, country, browser and device type. The site is served by Cloudflare, whose servers log your IP address for security and keep those logs briefly. The site loads its typeface from Google Fonts, which means Google receives your IP address when the font is requested. The site sets no advertising or tracking cookies.
4. Who else receives your data?
We use a small number of service providers who process data on our behalf and only on our instructions, under data processing agreements. The app's backend and routing service run on servers we operate ourselves in the European Union, and we use no third-party analytics or crash-reporting kit inside the app:
| Provider | What they do for us | What they receive | Where |
|---|---|---|---|
| Mapbox, Inc. | Renders the map in the app | Your device's IP address and the map areas requested | United States (EU–US Data Privacy Framework and standard contractual clauses) |
| Supabase, Inc. | Hosts the app's database | Everything listed in section 2 | European Union |
| OpenWeather Ltd | Supplies weather for your location | Approximate coordinates of your position | United Kingdom (EU adequacy decision) |
| Kit (kit.com) | Sends our emails to you | Your email address and the message | United States (standard contractual clauses) |
| Google LLC and Apple Inc. | Distribute the app and process Premium payments | Your store account and purchase, under their own policies | United States |
| Cloudflare, Inc. | Serves the website | Your IP address and request logs | Global network, EU data processing available |
| Umami Software, Inc. | Website visit counts | Page, referrer, country, browser and device type, with no identifiers | Europe |
Cities and research partners. We share cycling insights with cities and institutional partners, for example which corridors are ridden most and where hazards cluster. This data is aggregated and anonymised before it leaves us. It never contains names, email addresses, account IDs or individual trips, and it is built so that no single rider can be picked out.
We never sell personal data, and the app contains no advertising networks.
We may disclose data when the law requires it, for example to a court or a public authority with a valid order, or to protect the safety of our users.
5. Transfers outside the European Economic Area
Some providers above are in the United States. When data leaves the EEA we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified, and otherwise on the Commission's standard contractual clauses. You can ask us for a copy of the safeguards in place.
6. How do we protect your data?
Data travels between the app and our servers over encrypted connections (TLS). Passwords are stored hashed, never in plain text. Access to production systems is limited to the people who need it to run the service, and precise location data is kept separate from account identifiers wherever a feature allows it. No system is perfectly secure; if a breach ever puts your rights at risk we will tell you and the supervisory authority as the GDPR requires.
7. Your rights
Under the GDPR you can:
- Access the personal data we hold about you and get a copy.
- Correct data that is wrong or incomplete.
- Delete your data. You can delete your account in the app under Settings, or write to us.
- Export your data in a machine-readable format.
- Restrict or object to processing based on our legitimate interests.
- Withdraw consent at any time for analytics (in Settings) and for location (in your phone's settings). Withdrawing does not affect what was done before.
Write to privacy@defensivepedal.com. We answer within one month; for complex requests the GDPR lets us take up to two more months, and we will tell you if that happens. We may ask you to confirm your identity first.
If you are unhappy with how we handle your data you can complain to the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, dataprotection.ro, or to the data protection authority in the country where you live.
8. Children
Defensive Pedal is for people aged 16 or over. We do not knowingly collect data from younger children. If you believe a child has created an account, contact us and we will delete it.
9. Automated decisions
The app scores streets, not people. Route suggestions are calculated from road and traffic data and are the same for everyone with the same settings. We make no automated decisions about you that have legal or similarly significant effects.
10. Changes to this policy
When we change this policy we update the date at the top. For material changes, such as a new category of data or a new purpose, we notify you in the app before the change takes effect.
11. Contact
Antifragil SRL, V. V. Stanciu 5, Bucharest, Romania.
Privacy: privacy@defensivepedal.com · General: hello@defensivepedal.com