Your privacy

Bikeroulette operates Bike Roulette. For privacy questions or to exercise your rights, contact giedriuson@gmail.com.

What we use and why

Accounts. Google or Apple supplies a verified provider identifier, email address (including Apple's private relay address if selected) and, when provided, a name. We use these to sign you in and keep your history and collection. Connecting Apple to an existing account is an explicit action; we never merge accounts just because emails match.
Planning. Your chosen starting point, destination, time and route preferences go to our server and routing/search providers to find rides and places. Signed-in history stores route geometry, labels and ride summaries. Guest plans are not saved to account history. Optional feedback sends the chosen route back for ownership verification; optional sharing publishes an unlisted route. Coffee Spin works for loops and destination rides and sends a coarse search region to the public OpenStreetMap Overpass service (overpass-api.de), alongside HeiGIT place search, to find cafés. Public place results are cached in server memory for up to one hour; they contain no account identifiers or saved route geometry. Coffee Spin uses mapped café locations; opening hours and real-world access are not verified. Pick my stop sends the chosen place location to routing and never substitutes a different stop. When you select a map pin, its exact coordinates go to the existing address-search provider for a nearby address lookup. The selected point is not moved to that address. Account favourites store up to 30 place names, labels, available street addresses, locations and types, with city/country when available, until you remove them or delete your account. Favourites are private; saving one does not publish it.
Location and navigation. Device location starts when you request a location or intentionally start/resume a ride. Native iPhone location tracking can continue with the screen locked during an active ride. Directions are visual; open the app to read them. Pause/end stops tracking. Navigation keeps the current route and latest fix in memory. Recovery stays on the device for up to 12 hours. A reroute request sends the current position and rejoin point to our server and openrouteservice.
Collection validation. Signed-in rides send small GPS batches to our server to validate pockets and completion. Samples are discarded after validation; the account keeps progress summaries, distance/time, earned chips, achievements and a city passport. Passport pages use the saved start city and completed ride type; café visits are not verified. Minimal city/ride-type labels remain with your collection if you delete a saved route. Guest rewards stay local. Background gaps are not automatically credited.
Route feedback. When you submit feedback, the full chosen route is sent privately to verify ownership. We keep its hash, your selected reason, city/country and, only if selected, one route location and its distance along the route. Feedback is linked to your account or guest session, available only to the app operator, and removed after 30 days by hourly housekeeping or earlier when you delete the relevant account/guest data. It is not published or used to change routing automatically.
Sharing. Publishing is optional. An unlisted ride link exposes the complete chosen route, including start and finish, to anyone with the link. Links expire after 60 days and can be disabled earlier. Copies and previews already saved by other people or messaging services can remain outside our control.
Usage and security. We count visits, navigation starts and share/copy actions without account or GPS trails. Temporary deduplication hashes expire after 48 hours; aggregate daily totals remain. These interaction counters respect Do Not Track and Global Privacy Control. Separate hashed network identifiers enforce request limits. Hosting infrastructure may process IP addresses and operational logs for delivery and security.

Support messages include the email address and information you choose to send. We use them to answer your request and resolve service or privacy issues. Contact us about access or deletion of support correspondence.

Providers and storage

Railway hosts the service and database; Google and Apple provide the sign-in option you choose. HeiGIT/openrouteservice processes routing and place requests, OpenFreeMap provides map tiles, and Open-Meteo provides weather. These providers receive the requests needed for their services and process them under their own policies. Map requests can reveal the viewed area and network address. We do not sell personal data or use cross-app advertising tracking.

Native app session credentials stay in the iPhone Keychain. Server sessions expire after 30 days. Apple revocation credentials are encrypted on the server with a separate encryption key. OAuth requests expire within 10 minutes, and pending browser sign-in completion within 2 minutes.

Guest trial eligibility

Clearing guest content or deleting an account does not refill the introductory spins. A separate random trial cookie, usage counter, short-lived deletion protection and, on supported iPhones, an app-attestation public key and replay counter are retained for up to 30 days from trial creation. They contain no account identity, rides or location history. Verification challenges expire after two minutes; expired server records are removed by hourly housekeeping. Trial cookies and app-attestation key identifiers stay in the iPhone Keychain separately from account sessions.

When native enforcement is enabled, Apple DeviceCheck records whether this device already received the trial. That eligibility flag can persist across app deletion, reinstall and device transfer, and is not reset by clearing Bike Roulette data. It does not block ordinary signed-in use. Observation mode queries DeviceCheck without writing this flag. Contact giedriuson@gmail.com about a transferred device or eligibility issue. This protection is used for service abuse prevention, not advertising or fingerprinting.

Your choices and deletion

You can use a typed address instead of location, deny or change location access in Settings, use guest planning, and choose whether to share. In Account, choose Delete account and confirm to remove your live account, sessions, history, collection, city passport, route feedback, favourite places, identities and owned shared links. Guests can choose Clear guest data. Deleting from one device invalidates all server sessions; copies on other devices are cleared when they next contact the service. Shared copies outside the service cannot be recalled.

Apple token revocation is queued durably with deletion and retried automatically if Apple is temporarily unavailable. The queue contains only the encrypted credential and identifiers needed for revocation, and is erased after success. Infrastructure backups, if enabled, may contain earlier copies until their configured rotation; contact us for the current retention. Backups are restricted to recovery/security use. Aggregate totals and short-lived network abuse limits are kept separately from account records and are not reset by deletion.

Signed Apple account-change notifications can invalidate sessions. Permanent deletion of an Apple Account removes an Apple-only Bike Roulette account and its owned links. If another sign-in identity is connected, its account data remains available through that identity. Revoked Apple consent requires fresh authorization.

Routes you create

The route creator keeps a draft of chosen points and preferences on your device, separately for each account or guest, for up to 30 days after your last edit. Clearing the draft, reviewing it successfully, clearing guest data or deleting the current account removes that draft. Preview requests send chosen points to our server and the same routing provider; a private calculation cache can remain in server memory for up to five minutes. Reviewed routes saved to your account follow the history and deletion rules above. Editing does not automatically start GPS tracking or share a route.

Your rights

Where applicable, account services use the data needed to provide the service you request; optional location/sharing follow your choices, and security processing protects legitimate service interests. You may request access, correction, a copy, deletion, restriction or objection by contacting giedriuson@gmail.com. You may also contact your local data protection authority. Processing may involve providers outside your country, under their applicable transfer safeguards. Contact us about current provider/hosting arrangements.

We update this page when data practices change. The date above identifies this version.