Delete your account

How to have your BikeScout account and everything attached to it erased from our servers. BikeScout is operated by OpenBikeControl UG (haftungsbeschränkt). This page lists the steps, the exact data that goes with the account, and — honestly, including the parts we do not control — what is kept afterwards and for how long.

Version 1.0 · last updated 2 August 2026 · applies to the pre-release app and to this site

The short version

Send one e-mail. Write to support@bikescout.app from the address you sign in with, subject “Delete my account”. That address is the account, so sending from it is how you prove it is yours. Full steps below.
Most of BikeScout never needed an account. Routes, route push, ride download, alerts and rules all work signed out. If you never used live tracking, ride e-mails or Strava, there is probably nothing on our side to delete — check first.
Deletion is total, not a flag. The account row is removed and every table that references it cascades: sessions, position points, group rides, watcher messages, your saved contacts, and the Strava link. The full list.
Your routes and rides are on your phone, not on our servers. Deleting the account cannot remove them, and does not need to. Uninstalling the app does. Why.
It is done in days, and no later than one month — Art. 12(3) GDPR. Afterwards, only provider-side traces remain (backups, request logs), and §5 says exactly which.

1. Do you have an account at all?

Worth checking, because in BikeScout an account is the exception rather than the rule. Planning and editing routes, pushing them to an ELEMNT or an Edge, pulling rides back off the head unit, alerts, rules, weather and voice control all work signed out. Nothing about them reaches an account.

An account exists for exactly three features:

Live tracking — publishing a watch link while you ride;
Ride-notification e-mails — mailing that link to contacts you saved;
The Strava link — importing routes and activities, uploading rides.

If you never used any of those, there is no account and nothing on our servers to erase. There is no password to worry about either: signing in is a magic link sent to your e-mail address, or sign in with Strava. We never held a password of yours.

Signing out is not deletion. Signing out ends the session on that phone and leaves the account intact. Deleting the app removes everything the app kept on the phone, but leaves the account intact too. Only the request below removes the account.

2. How to ask — the steps

There is no self-service button in the app yet. Deletion is by e-mail, and it is deliberately short:

Open your mail app and start a message to support@bikescout.app.
Send it from the e-mail address you sign in to BikeScout with. That address is what identifies the account, so sending from it is the identity check — there is no form to fill in and no document to attach. (Signed in with Strava? See the note below.)
Put Delete my account in the subject line. You do not have to give a reason, and we will not ask for one.
Reply once to our confirmation e-mail. We answer with a short message naming the account we are about to delete; one reply confirming it, and it goes. This exists so that a spoofed or forwarded request cannot delete someone else's account.

If you signed in with Strava

A Strava-first account has no real e-mail address: Strava does not hand over the athlete's address, so BikeScout creates the account under an internal placeholder of the form strava-<athlete id>@no-reply.bikescout.app, which nobody can send or receive mail from. Step 2 therefore cannot apply to you as written.

Instead, write from the address on your Strava account and include your Strava athlete ID or a link to your Strava profile. We match it against the athlete ID stored with your connection, and confirm as in step 4.

Before you write, please also disconnect Strava in the app — that is the one action that actively revokes BikeScout's authorisation at Strava. Deleting the account removes our copy of your tokens but does not tell Strava anything; see §6.

3. What happens after you ask

We confirm. You get a reply naming the account, so nothing is deleted on the strength of one unverified message.
We delete. The account record is removed, and the database removes everything that references it in the same operation — see §4. It is a deletion, not a “deactivated” flag: there is no restore, no grace period and no way for us to undo it afterwards.
We tell you it is done.

How long: usually within a few days of your confirmation. The binding limit is Art. 12(3) GDPR — one month from the request, extendable only in genuinely complex cases, and we will say so if that ever happens rather than going quiet.

If you would rather have a copy of your data before it goes (Art. 15 / Art. 20 GDPR), say so in the same e-mail and we will send it first.

4. What is deleted

Everything below is stored against your user id and is removed with the account. This is not a promise about a cleanup script: every one of these tables declares your account as a foreign key with cascade delete, so removing the account row removes them in the same transaction. Described in rider terms, with the technical name in brackets where it helps:

What it is	What is in it
The account itself	Your e-mail address and sign-in timestamps, and — if you signed in with Strava — the Strava athlete ID and display name. There is no password, no profile, no photo.
Your live-tracking rides (sessions)	The rider name shown to watchers, the route's name, the planned route line, its distance, the coordinates it started at, your two sharing switches, the share token behind the /r/… link, and the ride's timestamps.
Every position you shared (live points)	Latitude and longitude, elapsed time, gradient and ride state for each point — plus speed, distance, ETA and ascent remaining if “share speed” was on, and heart rate and power if you switched those on.
Group rides you created (live groups)	The group's name, its /g/… token, status and timestamps.
Messages watchers sent you	The message text, who sent it and when. They hang off the ride, so they go with it.
The e-mail addresses you saved for ride notifications (contacts)	Each address, the name you gave it, its unsubscribe and message tokens, and whether it unsubscribed or hard-bounced.
The groups you sorted those contacts into	Group names, which is your default, and which contact belongs to which group.
The record of who was mailed about which ride	One row per contact per ride, with its delivery status — the bookkeeping that stops anyone being mailed twice for the same ride.
The Strava link	Your Strava access and refresh tokens, athlete ID and name, the granted scopes and when you connected.
Strava leftovers tied to you	The cached copies of your Strava routes and activities, your personal read counter, and any half-finished authorisation attempt.

That is the complete inventory of what our database holds about a rider. There is no analytics profile, no crash-report history, no advertising identifier and no event log about you anywhere in the product, because none of those exist in BikeScout at all — see the privacy policy.

What is not deleted, because it is not about you

Three caches on our side are keyed by place, never by rider, and hold no user id that a deletion could match: the weather cache, the POI cache and the geocoding cache. A weather answer for a set of coordinates is the same answer for everyone who asks; nothing in those rows says who asked. They expire on their own — weather after 2 hours, POI results after 24 hours, geocoding after 8 days.

The same is true of our Strava rate-limit counters at application level, which are keyed by time window and copied from Strava's own response headers. They count requests, not riders, and contain no user id. (The per-rider read counter is a separate table and is deleted — it is in the list above.)

5. What is kept, and for how long

The parts below outlive the deletion. Some are ours; most are not, and where we could not establish a provider's retention window we say so rather than invent a number.

What	Kept for	Why
Database backups at Supabase	We cannot state a figure. Backup and point-in-time-recovery retention is set by our backend provider, not by anything in our code, so we will not put a number here we cannot stand behind. Ask and we will get Supabase's own answer in writing.	A row deleted today can still exist inside a backup snapshot taken yesterday, until that snapshot ages out. This is true of every hosted database, including ones whose policies do not mention it.
Request logs at Cloudflare	Cloudflare's own retention limit for Workers Logs, which is a small number of days and is set by Cloudflare, not by us — we could not pin the exact figure from our configuration, only that logging is switched on and persisted.	The Worker that sends ride-notification e-mails keeps error and invocation logs so that a failed send is diagnosable. Those lines carry internal record IDs and delivery errors — not your rides, not your positions.
Mail delivery logs	Also Cloudflare's window, above.	Sending mail necessarily leaves a trace of the attempt at the sending infrastructure.
Your request e-mail, in our support mailbox	Deleted once the request is closed and confirmed.	We have to read it to act on it. We keep no separate list of who asked.
Position points and rides, if you never ask us anything	24 hours and 7 days	Worth knowing: even with no deletion request, live position points are swept 24 hours after a ride ends or expires, and the ride record itself 7 days after it ends or expires — group rides likewise. A minutely job enforces both. Deleting the account simply removes them sooner.

Nothing in that list is retained for our benefit — there is no “deleted users” archive, no shadow copy and no retained analytics record, because there is no analytics. What is left is what any hosted service unavoidably leaves behind: a backup taken before you asked, and a server's own log of having handled a request.

6. What a deletion cannot reach

A server-side deletion removes what is on our servers, and riders reasonably assume that means everything. It does not, and the difference is worth stating plainly.

Everything on your phone stays on your phone. Your route library, the rides you pulled off the head unit or recorded, their GPX and FIT files, your settings and rules and saved locations, and the diagnostic log if you ever switched it on — all of that lives in the app's own storage on the device and was never uploaded to us. Deleting the account cannot remove it, because we cannot reach it. Uninstalling the app removes it, and you can clear the diagnostic log from settings at any time before that. A phone backup you made may still contain a copy.
Anything you exported or shared. A route you shared as a link carries the route inside the link itself rather than on a server, so an old link keeps working for whoever holds it. Files you exported are wherever you sent them.
E-mails already delivered. Ride-notification e-mails that have gone out are in your recipients' inboxes. We cannot recall them, and they show the address you signed in with, because their Reply-To is set to it so people can answer you.
Your data at Strava. Rides BikeScout uploaded to Strava belong to your Strava account and are governed by Strava's policy, not ours; deleting your BikeScout account does not touch them. Nor does it revoke BikeScout's authorisation at Strava — the account deletion drops our copy of your tokens, but only the Disconnect button in the app actively tells Strava to revoke them. Disconnect first, or remove BikeScout yourself under Settings → My Apps on Strava.
Your relationship with the app store. Apple's and Google's own account, purchase and diagnostic records exist between you and them, and we can neither see nor delete them.
Rides on the head unit. Files stored on your ELEMNT or Edge are on that device. Delete them there.

7. Deleting less than everything

Deleting the account is the largest hammer available, and it is often not the one you want. Each of these you can do yourself, in the app, right now:

Stop sharing your position — end the live share. Upload stops immediately; the sweeps in §5 then clear what was stored.
Remove a contact — delete it from your contacts, and its saved address goes with it. A recipient who would rather not hear from you at all can use the unsubscribe link in any notification e-mail; that needs no account and stops all further mail to that address.
Cut the Strava link — Disconnect revokes the authorisation at Strava and removes the stored connection.
Stop sharing heart rate, power or speed — the two sharing switches take effect for the next ride; nothing further is uploaded.
Clear the diagnostic log — from settings, at any time.

None of these needs to involve us, and none of them requires deleting the account.

8. Contact

Deletion requests, questions about this page, or any other data-protection request (access, correction, portability, objection — Art. 15 to 21 GDPR): support@bikescout.app. Messages are read by a person, not a ticket robot.

The controller is OpenBikeControl UG (haftungsbeschränkt), Ludwigsburg, Germany — full postal details on the imprint page, and the processing this deletion undoes is described in the privacy policy.

If you think we have handled a request badly, you may complain to a data protection supervisory authority — in the EU, the one where you live, where you work, or where the alleged infringement took place (Art. 77 GDPR).