Privacy policy

1. Who is responsible

The controller for the processing described here, within the meaning of Art. 4(7) GDPR, is:

Full company details are on the imprint page. There is no statutory data protection officer; write to the address above for anything on this page.

2. What never leaves your phone

The following is held in the app's own storage on your device and is not uploaded anywhere by BikeScout. It leaves only if you personally export or share it.

• Your route library. Routes are files on the phone — geometry plus an index. Sharing a route produces a self-contained link that carries the route inside it; no route is uploaded to a server to be shared.
• Your rides. Rides pulled off the head unit, and rides recorded by the phone, are stored as FIT and GPX files on the device. They leave only when you share them or when you have turned on Strava upload.
• Voice control. Speech recognition is configured to run on-device, and commands are interpreted first by an offline grammar and then, if needed, by an on-device model (Apple Foundation Models or Gemini Nano). There is deliberately no cloud speech or cloud language tier — no audio and no transcript is sent to any server.
• Your settings, rules, saved locations and notification-forwarding configuration.
• Notifications forwarded to the head unit (Android only). If you grant notification access, the app reads phone notifications in order to display them on the ELEMNT or Edge and passes them straight over Bluetooth. Their contents are not stored by the app and never reach a server.
• Everything the app does with the head unit itself — pairing, route push, ride download, alerts on the screen — happens over a direct Bluetooth link between your phone and your device. No vendor cloud and no BikeScout server sits in that path.

3. Your account

An account is required only for live tracking, ride-notification e-mails and the Strava link. Everything else works signed out.

You can sign in in one of two ways: a magic link sent to your e-mail address, or sign in with Strava. There is no password and no profile. What is stored is a user record held by our backend provider (Supabase) containing your e-mail address and sign-in timestamps, plus — for Strava sign-in — the Strava athlete id and display name.

Your e-mail address is used to identify you, and its local part (the piece before the @) becomes the rider name shown to watchers of a live link. If your address is [email protected], watchers see jane.doe. Bear that in mind when choosing which address to sign in with.

To delete your account and everything attached to it, write to support@bikescout.app. Deleting the account cascades: sessions, live points, contacts, notification records and the Strava connection go with it.

4. Live tracking

This is the one feature that publishes where you are. It is off unless you start it, and it ends when the ride does.

What a shared link is

Starting a live ride creates a session with a share token: 20 characters drawn from a cryptographic random source, giving a link of the form bikescout.app/r/<token>. Anyone who has that link can watch, with no account and no sign-in. The link is the credential, so treat it like one — pass it to people you actually want watching. Watchers are shown only what is listed below; they are never given your e-mail address, your account id or the token of any other session.

A watcher's browser receives a short-lived access token scoped to that one session and capped at six hours. The database enforces this column by column: the session's owner and its share token are not readable by watchers at all.

The app shows you a live count of how many people are watching. It does not tell you who they are — no watcher identity is collected.

What a live point contains

Points are sent while you ride, throttled by time and distance. Each one carries:

What the session itself contains

Alongside the points: your rider name (see §3), the route's name, the planned route line, its total distance, the coordinates the route starts at, the two sharing switches above, whether messages are enabled, the session status and its timestamps, and — for a group ride — which group it belongs to.

When it ends, and when it is deleted

A session expires at whichever of these comes first, and expiry is checked every minute:

• the expiry time set when you started it — six hours by default;
• 45 minutes after the last point or keep-alive from the app, so a forgotten ride does not stay “live” all evening;
• 60 minutes after it was created, if no position ever arrived.

Deletion then follows automatically:

• Position points are deleted 24 hours after the session has ended or expired.
• The session record is deleted 7 days after it ended or expired, taking anything still attached to it with it.

Group rides work the same way: a group link is valid for 12 hours, holds at most 10 riders, and the group record is deleted 7 days after it ends. Ending a share from the app stops the upload immediately; the sweeps then clear the stored data on the schedule above.

5. Messages from watchers

If you enable messages, someone who reached your link through one of your notification e-mails can send you short messages, which appear on your head unit. A general watcher who merely has the link cannot — sending requires a per-contact token that only the mailed link carries.

A message stores its text, the sending contact and a timestamp. Senders are limited to three messages per hour. Messages are attached to the session and are deleted with it — so within the same 7-day window as §4. Messages are stored in readable form on the server; they are not end-to-end encrypted.

6. Ride-notification e-mails

You can save contacts so that starting a live ride e-mails them the link. Nothing is sent unless you pick a group when you go live; choosing “nobody this ride” sends nothing.

What is stored per contact: the e-mail address (lower-cased), an optional name, an unsubscribe token, a message token, and — if applicable — when they unsubscribed or when mail to them hard-bounced. Contacts are visible only to you; the database denies anonymous access to them entirely.

What the e-mail contains and reveals: your rider name, the route name and distance, the watch link, when the link expires, and an unsubscribe link. It is sent from [email protected] by a Cloudflare Worker on our behalf, and its Reply-To is set to your own e-mail address so that a recipient can answer you directly — which means your recipients can see the address you signed in with.

Limits: one e-mail per contact per ride (a contact cannot be mailed twice for the same session), at most 50 members in a group, and at most 200 notification e-mails per rider per rolling 24 hours.

Unsubscribing: every e-mail carries a footer unsubscribe link and standard one-click unsubscribe headers, so a mail client's own “unsubscribe” button works. An unsubscribe needs no account and stops all further ride notifications to that address.

Your responsibility: when you add someone else's e-mail address you are asking us to mail a person who has not dealt with us. Add only people who expect to hear from you. Contacts have no automatic expiry — they are kept until you delete the contact or your account.

7. Strava

Linking Strava is optional. Authorisation happens in your system browser on Strava's own pages; BikeScout never sees your Strava password.

• Permissions requested: read, read_all, activity:read_all and activity:write — enough to list and import your routes and activities and to upload rides.
• Where the tokens live: your Strava access and refresh tokens are stored server-side only, in our backend, and are readable by nothing except the server function that uses them. The phone holds only a short-lived value kept in memory during the sign-in handshake, never written to disk.
• What goes up: the ride file itself (a compressed FIT), plus an optional name and description, when you upload a ride.
• What comes down: your Strava routes and activities, GPX exports of routes, and the position/altitude/time streams of an activity when you import it as a route. Responses are cached against your account and deleted after 48 hours.
• Disconnecting revokes the token at Strava and removes the stored connection. Until you disconnect, the connection record persists — it has no automatic expiry.

What Strava then does with your data is governed by Strava's own privacy policy. Strava is a US company and using it involves a transfer of data to the United States.

8. Weather, POI, geocoding, routing and maps

Several features need to ask an outside service about a place. There is a meaningful distinction in how they are asked:

• Through our backend — weather forecasts, POI search along a route, geocoding, and everything Strava. Your phone asks our server function; the server function asks the outside service. That service therefore sees the coordinates or search terms, but not your IP address.
• Directly from your phone — route calculation (BRouter) and map tiles (the OpenStreetMap tile server). Those services receive the request from your device, so they see your IP address along with the coordinates or the map area you are looking at, and may log it under their own policies.

Weather, POI and geocoding answers are cached on our side so repeated lookups do not re-ask: POI results for 24 hours, weather for 2 hours, geocoding for about a week. Caches are keyed by place, not by rider.

One detail worth stating plainly: POI search uses the public Overpass API at overpass-api.de, and if that is unavailable it falls back to a public mirror hosted at maps.mail.ru, operated in Russia. Only the search area and the categories being searched are sent, and the request comes from our server rather than your phone.

9. The diagnostic log

The app can keep a technical log to make Bluetooth problems reportable.

• It is opt-in and off by default. Nothing is logged until you turn it on in settings.
• It stays on the phone. Two rotating files in the app's own storage, nothing more. There is no upload path in the app at all — no automatic transmission, no silent collection.
• It leaves only when you send it. Sharing opens your mail composer, pre-addressed to support, with the files attached — or the system share sheet if you have no mail app. You see the message and choose to send it. You can clear the log at any time.
• What is in it: app version and build, phone model, operating system version, locale and time zone, plus a technical trace of device connections and app events. Live-share tokens are truncated before being written. It can contain position coordinates — at least one device feature logs the rider's latitude and longitude. Treat a diagnostic log as data about you, and only send one when you want to.

10. Third parties we use

The complete list of outside services the app, the backend and this site contact. There are no others, and in particular there is no analytics, attribution, advertising or crash-reporting service anywhere in the product.

The app stores are separate: if you install BikeScout from Apple's App Store or Google Play, that store's own account, purchase and crash-reporting arrangements apply between you and them, and are outside our control.

10.1 Shorebird, and why it contacts a server without asking

BikeScout is released through Shorebird, which lets us ship a fix to the app's Dart code over the air, between store releases. It is the mechanism behind a patch arriving without a store update.

The part you should know: the app checks for a patch on launch, automatically, and there is no setting to turn it off. Our configuration does not disable the automatic check, and the app offers no opt-out — the only way to stop it is not to run the app. We would rather say that plainly than bury it.

We do not operate Shorebird's servers and cannot observe what its updater sends, because the updater is built into the app's runtime rather than into code we write. What such a check necessarily involves, though, is not a matter of opinion: to be answered at all it must identify which app is asking (our Shorebird app id, which is not secret and is the same for every install) and which version and patch level is already installed, and — like any network request — it reaches Shorebird's servers from your IP address. Assume Shorebird can see at least that much, and that it may log it as any host logs requests.

Two things we could not establish and will not guess at: the exact contents of that request beyond the above, and the country its servers sit in. If you need either before installing, ask us and we will get Shorebird's own answer in writing rather than speculate here.

What we can rule out: the check is not tied to your account, and BikeScout works signed out, so the request carries no identity we have given it. A patch changes the app's code — never your data, your rides or your routes.

11. Phone permissions

The app asks for as little as it can, and each permission is used for exactly one thing.

The app does not ask for photos, camera, your phone's contact list, calendar, or any advertising identifier, and it does not use Apple's tracking permission because it does not track.

12. Retention at a glance

Server and platform logs kept by our hosting providers (Supabase, Cloudflare) follow those providers' own retention defaults and may briefly contain IP addresses as an unavoidable part of serving a request.

13. Legal bases

• Art. 6(1)(b) GDPR — performing what you asked for. Signing you in, running a live share you started, sending the notification e-mails you requested, uploading a ride to a Strava account you linked, calculating a route you drew.
• Art. 9(2)(a) GDPR — explicit consent for health data. Heart rate and power are health data. They are uploaded only when you switch “share heart rate & power” on; the switch is off by default and switching it off stops the upload.
• Art. 6(1)(a) GDPR — consent for the optional diagnostic log, and for sending it when you do.
• Art. 6(1)(f) GDPR — legitimate interests in keeping the service working and unabused: rate limits, one-mail-per-contact-per-ride guards, bounce handling, and the minimal request logging our hosts perform.

Withdrawing consent is always possible and takes effect going forward: end the share, turn the switch off, turn the log off, disconnect Strava, delete the contact.

14. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict processing (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time.

Write to support@bikescout.app and we will handle it. Much of it you can also do yourself in the app: end a share, delete a contact, disconnect Strava, clear the diagnostic log.

If you think we have got this wrong, you may complain to a data protection supervisory authority — in the EU, the one where you live, where you work, or where the alleged infringement took place (Art. 77 GDPR).

15. This website

bikescout.app is a set of static pages hosted on Cloudflare. It sets no cookies, runs no analytics, and stores nothing in your browser's local storage. There is nothing here to consent to, which is why you are not being asked.

Every asset a page here needs is served from this site. The typefaces (Geist and Geist Mono) are hosted by us rather than fetched from a font CDN, precisely so that reading a page does not hand your IP address to a third party. There is no embedded video, no tag manager, no share widget, no web font service. The only party that necessarily sees your request is Cloudflare, which hosts the pages — unavoidable, since something has to serve them.

The live-tracking viewer at bikescout.app/r/… and the group viewer at /g/… additionally load the shared ride's data from our backend and map tiles from OpenStreetMap. Opening a viewer link deliberately keeps no session in your browser: the access token it uses is held in memory for that visit only and is not persisted. Watchers are counted, not identified.

Viewer links are excluded from search engines by robots.txt, and each carries a noindex instruction, so a shared ride is not meant to turn up in search results.

16. Children

BikeScout is not directed at children and is not intended for use by anyone under 16. We do not knowingly collect data from children. If you believe a child has used the app with an account, write to us and we will delete it.

17. Changes

The app is pre-release and still changing. If what it collects changes, this page changes with it, and the version and date at the top move. Material changes will be pointed out in the app rather than slipped in quietly.

18. Contact

Questions, requests, or a correction to something on this page: support@bikescout.app.

See also the terms of use and safety disclaimer and the imprint.