Version 1.9 · Effective 1 October 2026

Privacy Policy

This policy covers the RideCommit website, waitlist and the current iPhone and Android apps. The apps are distributed through Apple (TestFlight and the App Store) and Google Play; which features you have depends on the version installed. We will update this policy before releasing features with different data handling.

1. Who is responsible

Konstantine Khomeriki (კონსტანტინე ხომერიკი), Tbilisi, Georgia, is responsible for RideCommit’s processing of personal data. Contact khomeriki.dev@gmail.com for privacy questions or requests.

2. Information the app handles

3. Local processing and manual cloud transfers

No account is required to record and analyse rides offline. Recording and ride analysis run on the phone. Signing in does not upload anything. When you sign in on a phone where your account is not set up yet, the app downloads your profile and motorcycle details, photos, ride summaries, precise routes and analysis results to that phone; raw recordings are not included. Other transfers happen only when you tap them in Profile. Upload to server sends profile and motorcycle details, photos, ride summaries, precise routes, analysis results, and raw GPS and inertial recordings from this device to your account, including rides recorded before you signed in. Sync from server downloads that information, including full recordings, from your account to this device and keeps local changes that have not been uploaded. Nothing uploads automatically, and nothing else downloads automatically.

Uploaded information is associated with your account and stays there until you delete it; not tapping Upload again does not remove earlier copies. Account creation, authentication and server-side deletion requests use the server. If a transfer fails, for example because the connection drops, your local data is kept and you can try again. Part of a transfer already received by the server may remain stored. On iPhone, device-level backups may include local photos and other app data according to your device settings. The Android app excludes its data from Android’s automatic cloud backup. Signing out does not delete information already synchronised.

4. Heart rate from Apple Watch

On iPhone, RideCommit uses your heart rate only if you turn on “Heart rate from Apple Watch” in Profile. Your watch then records a workout while you record a ride and saves it to Apple Health. RideCommit reads the heart rate for that ride from Apple Health to show it on the ride and its corners.

Heart rate stays on your iPhone and in Apple Health. It is never uploaded to our servers, included in account sync or shared with anyone, and it is not used for advertising. You can turn it off in Profile, and remove RideCommit’s access or its workouts in the Health app at any time.

5. Why we use information

We use information to authenticate your account; record, analyse and replay your rides; synchronise supported data between your devices; remember profile preferences; process deletion and support requests; and maintain service security and reliability. Rider feedback is stored with the relevant ride. It does not automatically change the corner’s score.

Where data-protection law requires a legal basis, we rely on performance of the service agreement for account and requested service functions, consent where required for optional processing, legitimate interests for proportionate security and service administration where permitted, and legal obligations where applicable. Device permission is a technical control and does not replace any separate legal consent that is required.

We do not sell personal ride data or use private routes for targeted advertising. The app does not use advertising or third-party analytics integrations. The website uses Google Analytics only if you accept it, as described in section 6. The app loads map images from OpenFreeMap, described in section 7. We will update this policy before changing that.

6. Website and waitlist

If you choose “Notify me”, we store your email address, registration time and expiry date to contact you about RideCommit availability, based on your request and consent. Joining does not create an app account. We store the list in our private PostgreSQL database on DigitalOcean in New York, United States. Entries expire after 365 days and are removed by a daily cleanup when the service is running. Repeated submissions do not extend that period. You can withdraw consent or request earlier removal at khomeriki.dev@gmail.com. We do not send an automatic confirmation email; any availability message will provide a way to opt out. We do not use the list for unrelated marketing.

The website serves its fonts, images and its own scripts from its own server. The website does not use advertising cookies. DigitalOcean hosts the website. Our web server is configured without routine request access logs. The API temporarily holds IP addresses in memory for rate limiting; it does not store them with waitlist entries. Infrastructure and security logs may still contain connection information needed to operate and protect the service.

We use Google Analytics to understand which pages visitors open, how they move between them and which links they follow, so we can improve the website. It runs only after you choose Accept in the website’s cookie notice; if you choose Decline or make no choice, the website loads nothing from Google. With your consent, Google Analytics sets first-party cookies (named _ga and _ga_ followed by an identifier) that last up to two years, and your browser sends Google your IP address, device and browser information, the pages you view, the page that referred you, how far you scroll, clicks on links that leave the website, file downloads, and when you start or submit a form (but not what you type). Google uses the IP address to estimate your approximate location; Google Analytics 4 does not log or store IP addresses. Advertising features, Google signals and ad personalisation are turned off. We keep event data for 14 months. The legal basis is your consent. Your choice is stored in your browser. To change it, choose Cookie settings at the bottom of any page; choosing Decline removes the analytics cookies the website set. The app does not use Google Analytics, and nothing you enter in the waitlist form is sent to it.

7. Service providers and disclosures

The website and app backend run on a DigitalOcean server in New York, United States. DigitalOcean processes hosted information to run our service. See its Data Processing Agreement. Apple processes information when you use its sign-in or distribution services. Google processes information when you install or test the Android app through Google Play, hosts the optional Android tester group and, if you accept analytics on the website, provides Google Analytics as our processor; see Google’s Privacy Policy and Google Ads Data Processing Terms. Email communications pass through the email services used by you and us, including Gmail for the support address.

When a ride, route, corner or 3D replay screen shows a background map, the app downloads map images directly from OpenFreeMap, a free map service built on OpenStreetMap data. Like any web request, this sends your phone’s IP address, and the map area requested shows roughly where that ride took place. No account details, ride recordings or other ride data are sent. Map images for a 3D replay are saved on your phone with that ride. To avoid these requests, choose Plain as the route background; with no connection the app shows the plain route without asking for a map.

We may disclose information when reasonably necessary to comply with a legal obligation, address a valid legal request, protect rights or service security, or carry out your instructions. We do not publish your private rides by default. Our United States hosting and other providers may process information outside your country. Where applicable law requires safeguards for an international transfer, we use the applicable contractual arrangements and you may contact us for further information.

8. Storage and deletion

Local recordings remain on the device until removed through available app controls or local app data is removed. Synchronised account data remains in the active service until deleted. You can delete individual rides through the ride list and request account deletion through Profile → Delete account. Server deletion requires connectivity.

Account deletion removes the account and its associated active database records, including synchronised profile and motorcycle photos, ride analysis and supported recordings. It also initiates local account cleanup on the requesting device. Offline copies on another device cannot be remotely erased while that device remains offline; remove app data there when necessary.

Server backups are scheduled daily. The configured cleanup removes backups older than seven days after a successful new backup. If backups or cleanup fail, older copies can remain longer. Deletion from the active database is therefore not immediate erasure from every backup. This backup schedule also applies to waitlist entries. Following a restore, deletion requests must be reapplied before using the restored list to send messages.

Where Apple sign-in is used, an encrypted provider token may remain in a restricted retry queue until revocation succeeds. Support messages are kept as needed to resolve your request and document our response; contact us to request their deletion. A sign-in session stays valid on the server until 180 days after it was last used, or until you sign out or delete your account. The app keeps you signed in on the phone while offline; the server checks the session the next time the app connects. Security and operational records are kept only as needed for investigation and service administration. We will retain information required by law only for the applicable purpose and period.

9. Your choices and rights

On the website, choose Cookie settings at the bottom of any page to accept or decline Google Analytics at any time. You can stop a recording and change location, motion, camera or photo permissions in your device settings. Revoking permission affects the related functionality but does not delete existing recordings or server copies.

Depending on the law that applies to you, you may have rights to access, correct, delete or receive a copy of your information, restrict processing, object to certain processing or withdraw consent. Contact us to exercise these rights. We may request proportionate information to verify ownership; never send your password. You may also complain to the competent data-protection authority.

See Account and data deletion for the current in-app route and contact instructions. The app does not currently offer a complete self-service export; contact us for an access or portability request.

10. Security, children and updates

We use authenticated account access and HTTPS for the configured API, along with password hashing and protected credential storage. No method of storage or transmission is completely secure; these controls are not a claim of end-to-end encryption.

RideCommit is designed for motorcycle riders, not as a service directed to children. Contact us if you believe a child’s information has been submitted without legally required authorisation so we can investigate and take appropriate action.

We will update this policy when data handling changes, show its effective date and give any notice or obtain any consent required by applicable law. For privacy enquiries, contact khomeriki.dev@gmail.com.