on your wheel

Privacy Policy

Last updated: 23 October 2026

This policy explains what personal data On Your Wheel collects, why, who we share it with, and your rights. If you live in Washington, Nevada or another US state with a consumer health data law, also read our Consumer Health Data Privacy Policy.

1. Who we are

The controller of your data is Scope Enterprise LLC, 30 North Gould Street, Sheridan, WY 82801, United States. Contact: privacy@onyourwheel.app.

• EU representative (GDPR Article 27): being appointed; details will be published here.
• UK representative (UK GDPR Article 27): being appointed; details will be published here.
• Serbia representative (Law on Personal Data Protection, Article 44): being appointed; details will be published here.

2. What we collect

You give us:

• Account: email address, password (stored only as a salted hash), and whether you signed in with Google.
• Profile: first name, username, age, gender, photos and videos, bio, answers to prompts, bike, riding disciplines and what you're looking for (ride buddy, friends, group rides, dating).
• Dating preference: if you turn on dating, the gender you want to meet. This can reveal your sexual orientation, so we only use it with your explicit consent.
• Fitness data: FTP (power) and body weight, used to work out your level in watts per kilogram (W/kg). Only W/kg is shown to others. Your weight is never shown. We treat weight as health data and use it only with your explicit consent.
• Content: posts, captions, routes, rides, trips, chat messages, reports.
• Consents and choices: what you agreed to, which version, and when.
• Purchases: if you buy Premium, your plan, status and renewal date. Card details are handled by Stripe; we never see your full card number.

Collected automatically:

• Location. If you allow it, your phone's location while the app is open. Your phone rounds it to about 1 km before sending it to us. We store a further shifted area on a ~2.5 km grid for showing you to others. Others see that approximate area, your town only, or nothing, depending on your setting. We never track you when the app is closed.
• Usage and device: IP address (to protect against abuse, for example rate limits, and to guess your country at sign-up), app version, crash reports, and when you were last active.
• Push notifications: a push address from your browser, if you turn notifications on.
• Analytics: Cloudflare Web Analytics counts page views without cookies and without identifying you.
• Advertising and ad measurement (Meta pixel): only where it runs for you (see section 9 and section 10), the Meta pixel tells Meta that someone opened our website or app, created an account, or finished their profile, together with your IP address, browser and device details, and Meta's cookie ids. It never sends your email, name, profile, level, weight, dating choice, messages or location.

UK age check: if you're in the UK, the law (Online Safety Act) requires us to check that you're 18 or over before you can see or contact other riders. Stripe Identity checks a photo of your ID and a matching selfie for us. Stripe processes those images (including a face match) under its own privacy policy; we only receive whether the check passed and your date of birth, and we never see or keep your ID or selfie. If the check shows you're under 18, we close the account.

From services you connect:

• Strava or Intervals.icu: your activities (distance, climbing, time, power, the map line) and basic profile, only if you connect them. Activity data from Strava is shown only to you, never to other users, and is deleted when you disconnect.
• Google: your name and email when you sign in with Google.

We don't collect data about children. If we learn a user is under 18, we delete the account.

3. Why we use it, and our legal bases

We do not sell your personal data for money, or use automated decision-making that has legal or similarly significant effects on you. We share limited data with Meta only for marketing and ad measurement (page views and sign-up events, see section 10), and you can opt out. We never share your profile, dating preference, fitness or health data, messages or location with Meta or any other advertiser. We don't use your data to train AI models, and we never use Strava data with AI tools.

4. Who we share it with

• Other users see what your profile and settings allow: first name, age, photos, bio, level (W/kg), disciplines, approximate area or town, your posts and rides. Dating profiles are shown only to people who also chose dating. People you chat with see your messages.
• Service providers that process data for us under contract:
• Cloudflare, Inc. (USA): hosting, database, file storage, email sending, cookieless analytics.
• Stripe, Inc. (USA): payments, and the UK age check (Stripe Identity).
• Google LLC (USA): sign-in with Google.
• Services your phone talks to directly when you use the map and planner (they receive your IP address and the map area or route points you request): OpenFreeMap (map tiles, Germany), Amazon Web Services (elevation tiles), BRouter at brouter.de (route planning, Germany), ipwho.is (country lookup at sign-up), Wikipedia and Wikimedia Commons (photos of places).
• Meta Platforms Ireland Ltd. (Ireland, for people in the EU, EEA, UK and Switzerland) and Meta Platforms, Inc. (USA, for everyone else), as our advertising partner, to measure our ads through the Meta pixel (see section 10). We and Meta are jointly responsible for collecting and sending this data; after that, Meta uses it as an independent controller under its own Privacy Policy, for example to measure, improve and deliver ads. You can use your rights with us or with Meta.
• Strava and Intervals.icu, only if you connect them, under their own privacy policies.
• Authorities, when the law requires it, or when we believe someone's life or safety is at risk.
• A buyer or successor if the business is transferred, under this policy.

5. International transfers

We are in the United States, and our main providers process data in the US and worldwide. For transfers from the EU, UK and Switzerland we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified (Cloudflare, Google, Stripe and Meta are), and on the European Commission's Standard Contractual Clauses as a backup. Ask us at privacy@onyourwheel.app for a copy of the safeguards.

6. How long we keep it

• Your account and content: until you delete them or your account.
• Inactive accounts: hidden from others after 120 days without use; deleted after 24 months without use, after an email warning.
• Login codes: 15 minutes. Abuse counters (with IP addresses): up to 40 days. Server logs: per Cloudflare's short retention.
• Strava and Intervals.icu data: deleted straight away when you disconnect or delete your account.
• Reports and moderation records: up to 2 years after the decision, longer if needed for a legal claim.
• Payment records: 7 years, for tax law.
• Your cookie choice on our website and in our apps: on your device until you change it or clear the app or browser data. Meta keeps pixel data under its own retention rules.
• Messages you sent to others may stay visible to them in group chats after you leave; deleting your account removes them from your direct chats.

7. Security

We use HTTPS everywhere, store passwords only as salted hashes, keep login sessions in secure cookies, encrypt Strava and Intervals.icu tokens, never store your exact location, and limit admin access. Chat messages are encrypted in transit and at rest on our provider's systems but are not end-to-end encrypted. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.

8. Your rights

Wherever you live, you can:

• see and download your data: Settings > Download my data;
• correct it in your profile;
• delete your account and data: Settings > Delete account;
• withdraw consent at any time (turn off dating, live location, notifications or ad measurement, remove your weight, disconnect Strava), without affecting what happened before;
• ask questions or make a request: privacy@onyourwheel.app. We reply within 30 days (45 days where US state law allows), and we don't charge.

EU, UK and Switzerland: you also have the rights to restrict or object to processing (including processing based on legitimate interests), and to data portability. You can complain to your data protection authority (for example the Austrian Datenschutzbehörde, the German authority of your state, Croatia's AZOP, Serbia's Commissioner for Information of Public Importance and Personal Data Protection, or the UK ICO).

US states (including California, Colorado, Connecticut, Virginia, Oregon, Texas and others): you have the rights to know, access, correct, delete and port your data, and to opt out of sale, targeted advertising and profiling. We don't sell personal data for money. We do share limited data with Meta for ad measurement: page views and sign-up events from our website and apps, with your IP address, device details and cookie ids. California law calls this "sharing" for cross-context behavioural advertising, and other states call it "targeted advertising". You can opt out at any time: on our website, choose Cookie settings at the bottom of the page and pick Reject non-essential; in our apps, go to Settings > Privacy > Cookies and ads, or email privacy@onyourwheel.app; or turn on Global Privacy Control in your browser. We don't profile you in ways that produce legal effects. We only process sensitive data (dating preference, health-related data, precise location) with your consent, and we never share it with Meta or any advertiser. If we refuse a request, you can appeal by replying to our answer with "Appeal" in the subject; we'll respond within 45 days, and if you're unhappy with the result you can contact your state Attorney General. You can use an authorised agent. We won't discriminate against you for using your rights. We honour Global Privacy Control signals as an opt-out of sharing and targeted advertising.

9. Cookies and storage

We use one essential login cookie, a small cookie that remembers which country you're connecting from (so we know which cookie rules apply to you), and your device's local storage to keep you signed in, remember your settings and remember your cookie choice. We don't use analytics cookies: Cloudflare Web Analytics is cookieless.

Meta pixel. We use the Meta pixel on our website and in our apps to market On Your Wheel and measure our ads (what it sends is in section 10). When it runs, it loads code from Meta and sets Meta cookies (such as _fbp).

• On our website: if you're in the EU, EEA, UK, Switzerland or Serbia (or we can't tell where you are), a cookie dialog asks you first. Nothing from Meta loads unless you choose Accept all, or switch on Marketing under Customize and save. Everywhere else the pixel is on by default, and we don't load it if your browser sends Global Privacy Control.
• Cookie settings: everyone can change their choice any time: on our website with Cookie settings at the bottom of the page, and in our apps under Settings > Privacy > Cookies and ads. Your choice is kept on your device. Turning marketing off stops the pixel straight away, and it isn't loaded again.
• In our apps: the same rules as on our website. If you're in the EU, EEA, UK, Switzerland or Serbia (or we can't tell where you are), the app asks you first and nothing from Meta loads unless you accept. Everywhere else it's on by default, and we don't load it if your browser sends Global Privacy Control. In our iPhone app it also only runs if you allow tracking when your iPhone asks (Apple's App Tracking Transparency); you can change that any time in your iPhone's Settings > Privacy & Security > Tracking.

10. Advertising and marketing

We use a small amount of data to market On Your Wheel and to see which of our ads on Facebook and Instagram bring people to us. We do this with the Meta pixel from Meta, our advertising partner.

• What we send to Meta: that someone opened our website or app, created an account, or finished their profile, together with your IP address, browser and device details, and Meta's cookie ids. If you're logged in to Facebook or Instagram in the same browser, Meta may link this to your Meta account and use it to measure, improve and show ads, including ours.
• What we never send: your email, name, photos, profile, level, weight, dating choice, messages, rides, health or fitness data, or location.
• Where it runs: on our website and in our apps; in the EU, EEA, UK, Switzerland and Serbia only with your consent, and in our iPhone app only if you allow tracking. Details are in section 9.
• How to opt out: on our website, choose Cookie settings at the bottom of the page and pick Reject non-essential. In our apps, go to Settings > Privacy > Cookies and ads. On iPhone you can also turn off tracking for On Your Wheel in your iPhone's settings. Or email [privacy@onyourwheel.app](mailto:privacy@onyourwheel.app) and we'll switch it off for your account. You can also change the ads you see in your Facebook and Instagram ad settings. Opting out doesn't change how On Your Wheel works for you.

11. Changes

We'll tell you about important changes in the app or by email before they apply. The date at the top shows the latest version.

12. Contact

Scope Enterprise LLC, 30 North Gould Street, Sheridan, WY 82801, USA. privacy@onyourwheel.app.