Privacy Policy.

This policy describes what personal data RideXplorers collects, why, how long it is kept, and how you can exercise your rights. It supplements the Terms of Use.

This policy applies to the RideXplorers mobile app for iOS, the ridexplorers.com website, and the services that power them (api.ridexplorers.com, auth.ridexplorers.com).

Part of the app can be used without an account. In that case, we do not collect any account data; only the technical data strictly necessary for the security of the service is processed (Section 3.6).

3.1 Account

• Email address, username, first and last name where applicable, profile photo, bio, display and notification preferences.
• An internal account identifier, linked to your activity.
• If you use Sign in with Apple: the opaque Apple identifier and the email address provided by Apple, which may be an anonymous relay address if you choose to hide yours.

3.2 Content you publish or save

• Reviews and ratings of rides and parks, comments and likes on the activity feed.
• Photos you publish on a ride or park page, with their caption and the date taken that you state. The file is downsized and re-encoded on your iPhone before it is sent: its metadata, including the GPS location where it was taken, never reaches us.
• Logged rides, favorites, places visited.
• Contributions to the database: proposed technical specs, train configurations, cadence readings, error reports on a page.
• Reports of content or profiles, and the list of accounts you block.
• If you use the import feature: the content of the coaster-count profile you send us, and the result of matching it against our database.

3.3 Location

• Your location, approximate or precise, when you allow it, to show nearby parks and rides.
• If you create an alert that depends on your presence in a park, your last known location is sent to our servers to evaluate that condition. Only one record is kept per account, overwritten at each update: no movement history is built.
• During a park visit, if the "Park visit" Live Activity is turned on, your location is tracked continuously, including when the app is in the background, to show the nearest ride on the Lock Screen and in the widget. Tracking stops when you leave the park, after eight hours at most, or as soon as you stop it. These locations stay on your iPhone and are never sent to our servers.

3.4 Calendar

• If you limit a wait time alert to your stays, RideXplorers reads your iPhone's calendar to find events whose title contains the text you choose, for example the name of the park. Only that text and the time ranges of the matching events (at most 60 time slots over the next 120 days) are sent to our servers and attached to the alert, so that you are notified only during your stays. The titles, locations, attendees, and notes of your events never leave the device.
• Calendar access can be revoked at any time in iOS Settings; the alert then becomes permanent again and the saved time slots are erased at its next update.

3.5 App usage

• The ride and park pages you view, to feed your personal statistics and the "recently viewed" modules. This history is linked only to your account and is never exposed to other users.
• A device token (APNs) if you turn on notifications, as well as the history of the notifications sent to you.

3.6 Technical and security data

• Request logs for authenticated sessions: IP address, user agent, method and path called, response code, duration. They are used for technical diagnostics and abuse detection.
• Account event log (sign-ins, profile changes, moderation actions).
• IP addresses behind abusive behavior (automated scanning, intrusion attempts), temporarily blocked at the firewall level.

3.7 Motion and altitude (Ride Analyzer)

During a Ride Analyzer session, your iPhone's motion sensors and barometer are read on the device only. The raw high-frequency recording (accelerations, altitude) never leaves your phone.

A lightweight backup of your sessions is, however, kept on our servers so that you can get them back if you change devices: the ride concerned, start and end timestamps, and a summary calculated on the device. This backup is limited to your 50 most recent sessions and remains private by default. It is visible to other users only if you explicitly choose to publish a session to the activity feed, and only the summary is then shared.

3.8 The ridexplorers.com website

• If you sign up for the newsletter, we keep your email address and the boxes you checked, for the sole purpose of sending you news about RideXplorers.
• The website sets no cookies for tracking, audience measurement, or advertising, and no third-party cookies.

• No third-party software development kit for analytics, measurement, or advertising: the app uses only frameworks provided by Apple.
• No sale, rental, or transfer of your personal data.
• No advertising profiling, and no automated decision-making that produces legal effects concerning you.

6.1 What is visible to other users

Your public content (username, profile photo, bio, reviews, ratings, logged rides, published photos and their captions, activity published on the feed) is visible to other users when your profile is public. You can make your profile private in your account settings. Your favorites, places visited, viewing history, location, and alerts are never exposed to other users.

6.2 Processors and third parties

We do not share your data with any other third party, except when required by an authorized judicial or administrative authority.

You can delete your account directly in the app, from Settings › Privacy and account › Delete my account. After confirmation, the deletion is immediate; no further step with us is necessary. If you no longer have access to the app or to your account, write to contact@ridexplorers.com from the email address associated with your account: the deletion then takes place within 72 hours and you receive confirmation of it. The steps are detailed on the support page.

• Deletion is permanent. The account, profile, reviews, rides, favorites, published photos, contributions, alerts, notification tokens, saved location, and Ride Analyzer session backups are erased from our databases in a single operation.
• Deletion is irreversible: a deleted account cannot be restored.
• The database's technical backups, encrypted and kept for 8 weeks at most, may still contain the account data until rotation overwrites them. They are neither accessed nor used in normal operation: their only use is to restore the service after an incident.
• If your account was created with Sign in with Apple, we revoke the associated authorization with Apple just before the erasure: the app then disappears from the "Apps Using Apple ID" list in your iOS Settings. If Apple is temporarily unavailable, your deletion is not delayed as a result: the revocation is automatically retried afterward, and the token kept for that retry is encrypted and then destroyed as soon as it succeeds.
• Only two items remain beyond this operation, and neither makes it possible to restore the account:
  • The technical logs mentioned in Section 3.6, because they are indexed by date and not by account. They disappear on their own within a maximum of 30 days. On request, we delete them without waiting for that period to end.
  • The text of a comment you published that another user reported, copied into the report file so that the moderation decision can still be reviewed. This copy is visible only to moderation, never reappears in the app, and is erased 12 months after the file is closed. We keep it as part of the handling of reports required by the EU Digital Services Act.

In accordance with the General Data Protection Regulation (GDPR), you have the right of access, rectification, erasure, restriction, objection, and portability, as well as the right to withdraw your consent at any time.

• Rectification of your profile data and erasure of your account are carried out directly in the app.
• For any other request (access, export, restriction, objection), write to contact@ridexplorers.com from the address associated with your account. We respond within one month.
• You can file a complaint with the CNIL, Commission nationale de l'informatique et des libertés (www.cnil.fr).

• All network traffic is encrypted with HTTPS/TLS.
• Passwords are stored as cryptographic hashes, never in plain text.
• Authentication tokens are stored in your device's secure Keychain.
• Access to administration interfaces is restricted and authenticated, and sensitive operations are logged.
• The service is protected by rate limiting and by filtering of abusive behavior at the firewall level.

The app is not intended for children under 13, and we do not knowingly collect their data.

Article 8 of the GDPR lets each Member State set the age of digital consent between 13 and 16. Because the data controller is established in France, the age set by French law applies: 15 years old (Article 45 of the French Data Protection Act, "loi Informatique et Libertés"). Between 13 and 15, processing is lawful only if consent is given jointly by the minor concerned and the holder or holders of parental authority.

If you believe that a child under 13 has provided us with personal data, or that a minor under 15 has done so without this consent, write to contact@ridexplorers.com: the account and the associated data will be deleted.

Your data is hosted in France. Two processing activities may involve a transfer outside the European Union: Sign in with Apple authentication and delivery of push notifications, both operated by Apple. These transfers are governed by the European Commission's standard contractual clauses, within the framework of the terms applicable to Apple developers.

We may update this policy, in particular to reflect changes to the service or to regulations. The date of the last update appears at the top of the page. In the event of a material change, you will be informed in the app.

For any question about this policy or to exercise your rights: contact@ridexplorers.com.

See also the Terms of Use and the Legal Notice.