Privacy Policy

1. Data We Collect

When you use CoffeeRide, we collect the following information:

• Account information: name, email address, and profile photo
• Profile details: bio, bike types, rider style tags, preferred regions, and ride statistics
• Ride data: rides you create or join, including titles, descriptions, dates, starting points, photos, and uploaded GPX route files
• Messages: chat messages exchanged within ride groups and club chats
• Push notification tokens: device tokens (FCM for Android, APNS for iOS) used solely to deliver push notifications to your device
• Referral data: which ride or link you were referred from when you joined the platform
• Device information: device type, operating system, and app version for technical support and compatibility
• Usage data: screen views and in-app events collected for analytics purposes, and page views on our website if you accept cookies (see Section 7)

We do not track your device location. Ride starting points are entered manually by ride creators. GPX route files you upload are stored as content in our database and are not processed for real-time location tracking.

2. How We Use Your Data

We use your data to:

• Provide the CoffeeRide service — matching you with rides and riders
• Display your profile to other riders on the platform
• Enable messaging between ride participants
• Send you push notifications about rides and platform activity
• Measure how features are used so we can improve the app
• Diagnose technical issues and improve app stability

3. Legal Basis (GDPR)

We process your data based on:

• Contractual necessity: providing the core features you signed up for, including your profile, rides, and messaging
• Consent: analytics tracking via Firebase and Meta SDKs, where applicable under your device or jurisdiction settings, and Google Analytics and Google Ads cookies on our website, which are set only if you accept them in the cookie banner
• Legitimate interest: app stability monitoring, fraud prevention, and service improvement

4. Third-Party Services & Data Processors

We work with the following third-party services that may process your data:

• Supabase (database and authentication): our primary backend, hosted within the European Union. Stores your account, ride, message, and notification data. Supabase acts as a data processor under GDPR.
• Firebase / Google (push notifications and analytics): Firebase Cloud Messaging (FCM) is used to deliver push notifications to Android devices. Firebase Analytics collects screen views and custom in-app events, including an anonymised user identifier. Data is processed by Google LLC on servers in the United States.
• Apple (push notifications — iOS): Apple Push Notification service (APNS) is used to deliver push notifications to iOS devices. Apple processes only the token and notification payload required for delivery.
• Meta / Facebook (analytics): the Meta SDK is used to send the same custom in-app events as Firebase Analytics, to measure feature adoption and app performance. Data is processed by Meta Platforms, Inc. on servers in the United States.
• Google Analytics and Google Ads (website): our website (coffeeride.club, including the blog) uses Google Analytics to measure page views and visits, and the Google Ads tag to measure whether our ads lead to sign-ups. Both set cookies and load only after you accept them (see Section 7). Data is processed by Google LLC on servers in the United States.
• Google Analytics and Meta Pixel (web app only): the web version of the CoffeeRide app uses Google Analytics (gtag) and the Meta Pixel to collect page view and session data. This does not apply to the iOS or Android native apps.

5. International Data Transfers

Your core account and ride data is stored within the European Union via Supabase. However, analytics and push notification services provided by Google (Firebase) and Meta operate on servers in the United States.

These transfers are carried out under appropriate safeguards as required by GDPR Article 46, specifically Standard Contractual Clauses (SCCs) adopted by the European Commission. By using CoffeeRide and consenting to analytics, you acknowledge that your usage data may be transferred to and processed in the United States under these safeguards.

You can opt out of analytics data collection by adjusting your device-level settings (for example, limiting ad tracking on iOS, or opting out of analytics personalisation in your Google account settings). On our website, you can decline analytics and advertising cookies in the cookie banner, or withdraw consent at any time through the Cookie settings link in the footer.

6. Data Retention

We keep your account data for as long as your account is active. If you delete your account, all your personal data — including your profile, messages, ride history, and device tokens — will be permanently removed from our systems. Anonymised or aggregated analytics data held by Firebase or Meta may be retained by those services subject to their own retention policies.

7. Analytics, Cookies & Push Notifications

Analytics: the native iOS and Android apps use Firebase Analytics and the Meta SDK to collect screen view and custom event data. This helps us understand which features are used and how the app performs. A user identifier is associated with this data but is not used for advertising targeting by CoffeeRide. The web version additionally uses Google Analytics (gtag).

No advertising cookies in the native app: the native iOS and Android apps do not use advertising cookies or third-party cookie-based tracking. Analytics data is collected through SDKs, not browser cookies.

Cookies on our website: when you first visit coffeeride.club, we ask whether you accept analytics and advertising cookies. Until you accept, no Google tags are loaded and no such cookies are set. If you accept, the following cookies are used:

• _ga, _ga_* (Google Analytics): distinguish visitors and sessions so we can count visits; kept for up to 2 years
• _gcl_au, _gcl_aw (Google Ads): record that you arrived from one of our ads, so we can tell whether it led to a sign-up; kept for up to 90 days

Your choice itself is saved in your browser's local storage so we don't ask on every visit. If you choose Reject, or later withdraw consent through Cookie settings, we delete these cookies and stop loading the tags.

Push notifications: if you grant notification permission, your device token (FCM token for Android, APNS token for iOS) is stored in our database and used exclusively to deliver notifications about ride activity and platform updates. You can withdraw notification permission at any time through your device settings.

8. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Port your data to another service
• Withdraw consent at any time, including for analytics processing
• Object to processing based on legitimate interest
• Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at the email below.

9. Child Safety

CoffeeRide is a cycling community app intended for users aged 16 and over. We have a zero-tolerance policy toward child sexual abuse and exploitation (CSAE). Any content or behavior that sexually exploits or endangers minors is strictly prohibited and will result in immediate account termination and reporting to the relevant authorities.

If you encounter content or behavior of this nature on our platform, please report it immediately to info@coffeeride.club.

10. Contact

For any privacy-related questions or requests, please contact us at info@coffeeride.club.