Privacy Policy
Last updated: 11 October 2026
1. Who We Are
Velobooker ("we", "us", "our") is a cycling tour management
platform operated by Dragan Jovanović. You can contact us at
hello [at] velobooker.com
.
2. What Data We Collect
2.1 Account Data
When you create an account or sign in via a third-party
provider, we receive:
| Provider |
Data received |
| Google |
Name, email address, profile photo |
| Apple |
Name, email address (or private relay), Apple
ID |
| RideWithGPS |
Name, email address, athlete ID |
We do not receive or store your passwords. Authentication is
handled entirely by the third-party provider via OAuth 2.0.
2.2 Tour and Route Data
-
GPX route files imported from RideWithGPS or uploaded
directly (GPX/TCX/FIT)
-
Tour details: name, dates, description, day plans, rest
days, meeting points
-
Your membership status and role within a tour (organiser or
participant)
- Tour chat messages and expense entries you create
2.3 Expense Data
-
Expense entries you create: description, date, amount,
currency
- Receipt photos you choose to attach (optional)
2.4 Media
- Photos and videos you upload to a tour gallery
-
Files are stored on our servers and accessible to other
members of the same tour
-
Files may contain EXIF metadata (e.g. capture date, GPS
position). We read it to organise the gallery by day; the
location metadata is not shown publicly by Velobooker
2.5 Live Tracking and Ride Logging
-
Live tracking is optional and consent-gated.
Only when you explicitly share your position for a specific
tour day ("consent to share my position, today only") do we
ingest and display your position to consenting tour members
on the crew map
-
Position sources: your phone, or connected tracking services
(Garmin LiveTrack, Coros safety feeds, Wahoo) that you
register and on whose share links/polling we act per
provider's terms
-
Recorded rides: files you upload (FIT/TCX/GPX) or ingested
via a connected provider are matched to planned routes and
shown to tour members
-
Retained positions/rides are kept for up to 365 days, after
which they expire automatically
-
Without consent you never appear on the crew map; consent
can be revoked at any time for future days
2.6 Usage Data
-
Basic server logs (IP address, request timestamps, error
logs) for operational purposes
-
Anonymous, privacy-first product analytics via PostHog (EU
cloud, Frankfurt). On this website analytics are fully
cookieless — no cookies, no local storage, and no consent
banner is needed. Visitors are counted with a daily-salted
hash instead, and IP addresses are not stored
-
In our mobile app: anonymous usage events and crash reports
(e.g. screens viewed, uncaught errors) tied to a random,
device-local identifier. We never link these to your
account, and no advertising identifiers are used
3. How We Use Your Data
| Data |
Purpose |
| Account data |
Identify you, display your name and photo to tour
members
|
| GPX and route data |
Generate daily briefings, weather forecasts,
elevation analysis
|
| Chat messages |
Deliver to tour members; organiser announcements to
the tour
|
| Expense data |
Calculate cost settlements between tour participants
|
| Media |
Display in-tour photo/video gallery to tour members
|
| Live tracking data |
Show consenting riders' positions on the tour's crew
map (only for riders who consent)
|
| Ride logging data |
Match recorded rides to planned routes; show
activity feeds
|
| Push/email delivery |
Send login codes and tour notifications to your
devices/email
|
| Server logs |
Diagnose errors, ensure platform security |
We do not use your data for advertising. We do not sell, rent,
or share your personal data with third parties, except as
described in Section 6.
4. Legal Basis for Processing
We process your personal data under the following legal bases
(GDPR Article 6):
| Legal basis |
Applies to |
| Contractual necessity |
Account, tour/route, chat, expense, media and
ride-logging data — required to provide the service
you signed up for
|
| Legitimate interest |
Server logs — necessary for platform security and
error diagnosis
|
| Consent |
RideWithGPS data — you explicitly authorise access
via OAuth
|
| Consent |
Live-tracking positions — you explicitly share your
position, per tour day, revocable
|
| Consent |
Push notifications — you register a device; you can
deregister at any time
|
| Consent |
Media uploads — you choose to upload photos/videos
to a tour gallery
|
You may withdraw consent at any time by disconnecting the
relevant third-party provider in your account settings or by
contacting us. Withdrawal does not affect the lawfulness of
processing carried out before withdrawal.
5. Data Storage and Security
-
Data is stored on servers hosted on Google Cloud Platform in
the EU (europe-west region)
- Data in transit is encrypted via TLS (HTTPS)
- OAuth tokens are stored encrypted at rest
-
GPX files and media are stored in object storage (Cloudflare
R2) with access-controlled URLs
-
Access is authenticated and tour-scoped; all endpoints
require authorisation, provider webhooks are
signature-verified
-
We never store payment card data — payments (when paid plans
are available) are handled entirely by our payment provider,
Paddle
6. Data Sharing
We share data only in the following limited cases:
-
Within a tour
: your name and profile photo are visible to other members
of tours you join; your live position and recorded rides
only with your consent
-
RideWithGPS
: when you import a route or event, we make API calls on
your behalf
-
OpenMeteo
: we send GPS coordinates (from route waypoints) to the
OpenMeteo API to fetch weather forecasts. No personal data
is sent.
-
Geocoding providers (Google Geocoding API,
LocationIQ)
: we send place names or route coordinates to geocoding
services to label waypoints in daily briefings and in the AI
assistant. No personal data is sent.
-
Map tile providers (OpenFreeMap)
: when you view maps, the app and website load map tiles
from OpenFreeMap's EU servers, which process your IP address
for delivery under
OpenFreeMap's privacy policy
. No personal data is sent by us.
-
PostHog
: anonymous product analytics and crash reports are
processed by PostHog (PostHog EU cloud, Frankfurt, Germany —
an EU data processor operating under a data processing
agreement). Analytics events contain no account identity
and, on the website, no cookies.
-
Amazon Web Services
: transactional email (login codes, tour notifications) is
delivered via Amazon SES; static site assets are served via
AWS CloudFront/S3.
-
Expo (Exponent, Inc.)
: if you enable push notifications, the Expo push service
delivers notifications using your device token. Message
content for tour notifications is included so it can be
shown on your device.
-
Paddle
: if and when you purchase a paid plan, payments and
invoicing are handled by Paddle (Paddle Payments Ltd,
Ireland, as Merchant of Record), which processes your
payment details and billing address. We receive only your
subscription status — never payment card data.
-
Google Apps Script / Google Workspace
: form submissions (contact form, early-access list) are
delivered to our Google Group mailbox; the contact form is
protected by Google reCAPTCHA.
-
Legal obligation
: if required by law, court order, or to protect the rights
and safety of our users
7. Data Retention
| Data type |
Retention |
| Account data |
Until you delete your account |
| Tour and route data |
Until the tour organiser deletes the tour, or you
delete your account
|
| Expense data |
Until the tour is deleted, or you delete your
account
|
| Chat messages |
Until the tour is deleted, or you delete your
account
|
| Media |
Until deleted by the uploader or tour organiser, or
account deletion
|
| Live-tracking positions |
Up to 365 days, then expire automatically |
| Recorded ride activities |
Up to 365 days, then expire automatically |
| Push device tokens |
Until the device is deregistered or you delete your
account
|
| Email login codes |
Until used or expired (minutes) |
| Server logs |
90 days rolling |
8. Your Rights
Under GDPR, you have the right to:
-
Access
the personal data we hold about you
-
Correct
inaccurate data
-
Delete
your account and associated data
-
Export
your data in a portable format (GPX files, tour media,
expense records)
-
Restrict
processing of your personal data in certain circumstances
-
Object
to processing based on legitimate interest
-
Withdraw consent
at any time for processing based on consent (e.g., a
provider connection, position sharing, push notifications)
-
Disconnect
third-party providers (Google, Apple, RwGPS) or tracking
devices (Garmin/Coros/Wahoo) at any time
-
Lodge a complaint
with the Spanish Data Protection Authority (Agencia Española
de Protección de Datos —
www.aepd.es
) or your local EU supervisory authority
To exercise any of these rights, contact us at
hello [at] velobooker.com
. We will respond within 30 days.
9. Children
Velobooker is not directed at children under the age of 13. We
do not knowingly collect personal data from children under 13.
If you believe a child has provided us with personal data,
please contact us and we will delete it.
10. Changes to This Policy
We may update this policy from time to time. We will notify
users of material changes by posting a notice in the app or by
email. The "Last updated" date at the top of this page reflects
the most recent revision.
11. Contact
For any privacy-related questions or requests:
Email:
hello [at] velobooker.com
Website:
velobooker.com