Privacy Policy

1. Who we are

MyCycleClub is run by Andrew Wilson, and is published on Google Play and the Apple App Store under the publisher name “tonyobtuse”. For the purposes of the DPDP Act, Andrew Wilson is the Data Fiduciary for your personal data, which means we decide why and how it is processed and are responsible for it.

Contact: mycycleclub67@gmail.com. Our Grievance Officer is named in section 14.

2. What we collect, and why

• Sign-in. When you sign in with Google or Apple we receive an account identifier and your email address (Apple may give us a private relay address instead). We use these to create and secure your account and to contact you about it, for example if you win a monthly leaderboard. We do not get or store your Google or Apple password.
• Profile. Your handle (shown to other riders), an optional profile photo, and your home area and city (picked by you, or worked out once from your location when you set up).
• Date of birth (optional). Used only to unlock missions that are marked 18+. It is never shown to other riders.
• Gender (optional). Seen only by our staff, to understand who rides. Never shown to other riders and never used for ranking.
• Weight (optional). Used only to estimate the calories on your ride report. Leave it blank and you simply get no calorie estimate.
• Rides. When you start a ride, the app records your GPS position, speed and GPS accuracy, and readings from your phone’s barometer (to estimate how much you climbed), including while the screen is off or the app is in the background, until you stop the ride. From these we work out distance, time, speed, climb, calories and your XP. A ride is stored as one file on our storage. You can delete any ride from your ride history.
• Location outside a ride. While the app is open on your screen it uses your location to show missions near you and to check you are really at a mission when you take its photo. We store a location only when you complete an action that needs it, such as a mission check-in, a mission photo or a spot.
• Photos. Mission proof photos and spot photos (we keep a compressed copy and the full-quality original), photos attached to an issue report, and your profile photo. The app opens the camera only when you choose to take a photo, and reads your gallery only for a photo you pick. Saving photos to your gallery is optional and happens on your phone.
• Game activity. Missions you start and finish, spots, XP, levels, achievements, area and city unlocks, leaderboard standings, which version of a feature you were shown when we test changes, and records of in-app actions (for example, that a ride was started or a screen was opened). We use these to run the game, to fix bugs and to improve the app.
• What you send us. Issue reports, feedback, mission reports and appeals of a photo decision.
• Device and technical data. A push-notification token and whether your phone is Android or iPhone, so we can send notifications you have allowed. Our servers also keep security logs (such as IP address and the time of each request) to keep the service safe and to meet legal duties.

What we do not collect: your contacts, your microphone or any audio, payment details, or your location when no ride is running and the app is closed. The app shows no ads and does not use an advertising ID.

3. How we use it

• To run the game: verify missions and spots, record rides, award XP, unlock areas and cities, and run leaderboards.
• To keep play fair and safe: for example, rides with impossible speeds earn no XP, and duplicate or fake photos are rejected.
• To answer your reports, feedback and appeals, and to send notifications you have allowed.
• To understand how the app is used, fix problems and make it better. We do this analysis ourselves.
• To create combined, anonymous insights for missions and partners (section 5).
• To publish anonymous open elevation data (section 6).
• To meet our legal duties and to protect riders, the public and the app.

We process your personal data on the basis of the consent you give when you agree to this policy in the app, and where Indian law allows it without consent (for example, to comply with a law or court order).

4. How photos are checked

When you submit a mission photo or a spot, a compressed copy and a short description of what the mission asked for are sent to Anthropic’s Claude AI service, which checks whether the photo matches. Anthropic processes it only to give us that answer, under commercial terms that do not allow it to train its models on our data. Our staff may also look at a photo, for example when you ask for a manual review or when the check is unsure. The full-quality original is never sent to Anthropic; only our staff can open it.

5. Combined insights and partner offers

We look at activity across many riders to plan the game. For example, if we see that riders in one neighbourhood do a lot of food missions, we may team up with a restaurant there so riders get a discount when they visit it as a mission.

Partners only ever get combined, anonymous figures like that, which cannot identify you. They never get your name, handle, email, rides, location history or photos. If a future offer ever needs to share something about you with a partner (for example, to redeem a reward), we will ask you separately first, and you can say no.

6. Open elevation data

We are building an open map of how steep and hilly roads are, for everyone to use. To do that we publish elevation data taken from the barometer and GPS readings of rides. Before anything is published we make it anonymous:

• Names, handles, emails, account IDs, device details and timestamps are removed.
• Points are not grouped by ride or by rider, so the data does not show anyone’s route.
• The start and end of every ride are cut off, so the data cannot point to where a rider lives or works.

What is published is elevation tied to places on the map, under an open data licence. Because it no longer identifies anyone, it is not personal data, and once published it cannot be withdrawn. Contributing to this data is a condition of using the app. If you delete your account, your future rides stop contributing, and none of your personal data is ever published.

7. Who else handles your data

We never sell, rent or trade your personal data. These service providers handle it only on our instructions, to run the app:

• OVHcloud: the servers that run the app and its database.
• Cloudflare (R2): storage for photos, ride files and map data.
• Anthropic: the automated photo check (section 4).
• Expo, Google (Firebase Cloud Messaging) and Apple (Push Notification service): delivering push notifications.
• Google and Apple: sign-in, and app distribution through their stores.

We may also disclose personal data when we have to:

• when Indian law, a court order, or a lawful request from a government agency requires it;
• to protect someone’s life or safety in an emergency, or to investigate fraud, cheating or misuse;
• if the app is ever transferred to a new owner, who would then have to keep to this policy, and we would tell you first.

What other riders see: your handle, profile photo, level and leaderboard results. You can hide yourself from leaderboards in Settings. Your photos, rides, date of birth, gender, weight and email are never shown to other riders. Anything you choose to share yourself, such as a ride share card, goes wherever you send it.

8. Where your data is stored

Some of our service providers store or process data outside India, for example in Europe or the United States. The DPDP Act allows this, except to countries the Government of India restricts, and we follow any such restriction.

9. How long we keep it

• Your account data, rides and photos: for as long as your account exists, unless you delete them sooner.
• A ride you delete: its route file is removed straight away.
• When you delete your account it is closed immediately and taken off leaderboards, and your personal data is erased within 30 days.
• We keep a small amount longer only where the law requires it, such as security logs (kept for up to one year). Anonymous combined figures and published open elevation data are kept, because they no longer identify you.

10. How we protect it

All data travels over encrypted connections (HTTPS). Photos and ride files are never public; they are opened through short-lived private links. Sign-in sessions are stored as one-way hashes, and only a small team of staff can reach the admin tools. We follow reasonable security practices as required by Indian law. If a breach ever affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

11. Your rights and choices

Under the DPDP Act you have the right to:

• get a summary of the personal data we hold about you and who it has been shared with;
• have it corrected, completed or updated;
• have it erased;
• withdraw your consent at any time, as easily as you gave it;
• nominate someone to use these rights for you if you die or cannot act yourself;
• have a complaint dealt with by our Grievance Officer, and then take it to the Data Protection Board of India.

Much of this is in the app: edit your profile, clear optional fields, hide yourself from leaderboards, delete rides, or delete your account. For anything else, email mycycleclub67@gmail.com.

The app cannot run without your sign-in, your rides and your location during a ride, so withdrawing your consent to those means deleting your account. Withdrawing consent does not affect what we did before you withdrew it.

12. Riders under 18

Riders under 18 may use the app only with the permission of a parent or lawful guardian. The parent or guardian agrees to this policy and our Terms of Use on the rider’s behalf and is responsible for their use of the app. We do not show ads, and we do not use anyone’s data to target ads.

Missions marked 18+ only unlock for riders who have added a date of birth showing they are 18 or older. These missions only ever ask you to visit a place and photograph it from outside; no mission asks you to buy or drink alcohol. A parent or guardian can contact us to see or delete a young rider’s data.

13. Deleting your account

In the app, open the menu, then Settings → Delete my account, and confirm.

Your account is closed straight away: you are signed out on every device and removed from leaderboards. Your personal data (profile, rides, photos, reports) is then erased within 30 days, except what section 9 says we must keep. If you can no longer open the app, email mycycleclub67@gmail.com from the email address on your account and we will delete it for you.

14. Grievance Officer and contact

Grievance Officer: Andrew Wilson
Email: mycycleclub67@gmail.com

We acknowledge every complaint within 24 hours and resolve it within 15 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

15. Changes to this policy

When we change this policy in a way that matters, we update the date and version at the top, and the app asks you to read and agree to the new version before you carry on.