Privacy Policy

Information you give us directly:

• Profile data — your name, display name, profile photo, role (coach or rider), date of birth, and timezone.
• Health data — your date of birth, maximum heart rate and resting heart rate, whether you enter them or let the app read them from Apple Health on iPhone or Health Connect on Android (see below), used to set your training zones.
• Content — posts, comments, reactions, and any other content you share on the platform.
• Messages — direct messages you send to other riders, which we store so the conversation is there on every device, and in-class chat, which is relayed live to the riders in that class and not stored by us.
• Live video and audio — your camera and microphone during a live class, if you turn them on. They are streamed to the other people in the class through Daily (see section 5) and are not recorded by us.
• Reports — if you report another rider, what you tell us, and the message or content you reported.

Information collected automatically:

• Account data — your email address, provided by Google or Apple when you sign in.
• Usage data — which features you use, classes you attend, and interactions on the platform (follows, RSVPs, etc.).
• Device data — browser type and general location (country/region), collected for analytics and security purposes.

Information a partner clinic sends us:

If you were tested by an exercise-physiology clinic we work with (today, Human Powered Health) and agreed to it, that clinic may send us your name, your email address, the heart-rate zones and heart rate at VO₂max from your test, the test date, and a training plan drafted from their report. The report itself never reaches us.It is read on the clinic’s own computer, in their browser, and only those numbers and the report’s written recommendations leave it. Your email address is used only to match the submission to your account when you join with that address and, if the clinic asks us to, to send you one email inviting you to see the plan. If you never join, nothing is applied, and the submission stops being usable after 180 days.

To draft that plan, we send Groq(see section 5) your first name, your zones, your test results and the report’s recommendations — never your email address, your surname or the report. The draft is for the clinic to check and edit; nothing reaches you unless they choose to send it.

Apple Health, on iPhone and Apple Watch:

If you grant permission, the app reads your heart rate, resting heart rate, heart rate variability, VO₂ max, active energy and date of birth from Apple Health, and saves each class you ride to Apple Health as a workout.

• Saved to your account: your date of birth, your resting heart rate, and the maximum heart rate we estimate from your age (if you have not set your own). We store these with your Ride Director account so your training zones are the same on your iPhone, your Apple Watch and the web. You can see and change them in the app under Settings ▸ Heart rate, they are not shown to other riders, and they are deleted with your account.
• Kept on your device: heart rate variability, VO₂ max, active energy, and the trend in your resting heart rate. These are only used to show you your own recovery and fitness cards, and are never uploaded.

Nothing read from Apple Health is used for advertising, sold, or shared with anyone outside the processors named in section 5.

Your live heart rate during a class is different: it leaves your device by design, because showing it is what a live class is. It is sent to our servers so it can appear on the class screen and in your ride recap, and other riders in that class see it alongside your name unless you turn it off in Settings ▸ Privacy & Safety ▸ Live metrics. After a ride, your Apple Watch also fills any gaps in that ride’s heart rate from what Apple Health recorded during it. Cadence and power work the same way. You can revoke Apple Health access at any time in the iOS Health app, under Sharing ▸ Apps.

Health Connect, on Android phones and Wear OS watches:

If you grant permission, the Android app reads your resting heart rate, heart rate variability and VO₂ max from Health Connect, and saves each class you ride to Health Connect as an exercise session with its heart rate. The Wear OS watch app reads your heart rate from the watch’s sensor while you ride a class.

• Saved to your account: your resting heart rate, only when your profile does not already have one, so your training zones are the same on every device. You can see and change it in the app under Settings ▸ Heart rate, it is not shown to other riders, and it is deleted with your account.
• Kept on your device: heart rate variability, VO₂ max and the trend in your resting heart rate. These are only used to show you your own recovery and fitness cards, and are never uploaded.

Your live heart rate from a Wear OS watch or a Bluetooth heart-rate strap reaches the class exactly as described above for the Apple Watch, and the same Live metrics setting hides it. Ride Director’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements: it is used only to provide the features described here, never for advertising, never sold, and never shared outside the processors named in section 5. You can revoke access at any time in Health Connect (in Android’s Settings, under Health Connect or Privacy, depending on your phone), or in the app under Settings ▸ Health Connect.

Camera-based cadence, on iPhone and Android:

If you turn on cadence, the app analyses your camera on your phone to estimate your pedalling cadence and riding position. That analysis happens on the phone, and we do not store the frames. In a live class, turning cadence on shows the class a view of your legs instead of your face (streamed through Daily like the rest of the class video), along with your estimated cadence and whether you are seated or standing. You can stop sharing the cadence number in Settings ▸ Privacy & Safety ▸ Live metrics, and turn your camera off at any time.

On Android, cadence in a class works while your video is off: the camera is used only for the estimate, and nothing from it is streamed. The analysis uses Google’s ML Kit on your phone, which sends Google diagnostics about how it is running (see section 5), never the camera frames.

• To create and manage your account.
• To run the platform — scheduling classes, syncing live sessions, showing you your feed and notifications.
• To personalize your experience, such as suggesting coaches or riders to follow.
• To send transactional emails — class invites, session reminders, and account notices.
• To give you the zones and training plan a partner clinic measured for you, when you join with the email address they used.
• To improve the product through aggregate, anonymised usage analytics.

We do not sell your data. We do not use your data for advertising.

When you sign in with Google or Apple, we receive your name, email address, and profile photo from that provider. We do not receive your Google or Apple passwords. Each provider’s privacy policy governs what they collect on their end:

• Google Privacy Policy
• Apple Privacy Policy

If you connect Apple Music, Ride Director uses a developer token to initialise the MusicKit player in your browser, or, in the iPhone app, plays through Apple’s own music player on your phone. In the Android app, it plays through Apple’s MusicKit player inside the app: you connect on Apple’s own sign-in screen, and the token Apple gives the app stays on your phone, goes only to Apple, and is forgotten when you sign out. Coaches can search the Apple Music catalogue to choose a class soundtrack, and we store the album they choose with the class. We do not access your Apple Music library, listening history, or payment information. Each user streams audio directly from their own Apple Music account — we never intercept or store audio.

We use a small number of third-party services to operate Ride Director:

• Supabase — our database and authentication infrastructure. Your data is stored on Supabase-managed servers.
• Vercel — our hosting provider. Handles web traffic and edge delivery.
• Resend — used to send transactional emails such as class invitations.
• Daily— runs the live video and audio in a class. When you join one, Daily receives your display name, your user ID, and your camera and microphone streams for as long as the class lasts, along with call-quality measurements (connection and bitrate) from your device. If you have not set a display name, you appear as “Rider” — your email address is never used as your name.
• Apple Music — only if you choose to connect it. Music plays from your own account and we never receive your password or payment details. See section 4.
• Groq— runs the AI model behind two features. To draft a training plan from a partner clinic’s test report, it receives the client’s first name, heart-rate zones, test results and the report’s recommendations, as described in section 1. To suggest songs for a workout, when that is requested, it receives the workout’s stages: their names, lengths, effort and cadence targets, and the coach’s cues. Neither feature sends your email address, and the clinic’s report itself is never sent anywhere.
• Google— on Android only. ML Kit, the on-device model behind camera cadence, sends Google diagnostics about how it is running: your device model and Android version, the app’s version, an identifier for this install, and timings. It never receives camera frames. When you use a Wear OS watch, the phone hands the watch your sign-in over Google’s Wear OS connection, encrypted, so the watch can stream your heart rate. Health Connect is part of Android and keeps the health data it holds on your phone.
• Apple and Google push services— to put a notification on your phone’s lock screen, its words (for example who sent you a message and its first line) travel through Apple’s push service to an iPhone, or Google’s Firebase Cloud Messaging to an Android phone, along with an identifier for the app on that phone. You can turn notifications off in the app’s settings or your phone’s at any time.
• Anthropic— answers the “will my kit work?” question box on our supported-devices page, when that box is available. It receives the question you type there and the earlier questions in the same box, and nothing about your account.

Our code also includes Sentry (crash and error diagnostics) and PostHog (product analytics). Neither is switched on in production today, so neither currently receives anything about you. We list them because they are built in and could be enabled, and we would rather name them than surprise you.

We do not sell your personal data, we do not use it for advertising, and we do not share it with anyone not named on this page except where the law requires it.

We keep your data for as long as your account is active. If you delete your account, your profile, posts, and personal data are permanently deleted within 30 days. Some anonymised or aggregate data (e.g. class attendance counts) may be retained for analytics purposes.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — update your profile information at any time from Settings.
• Deletion — delete your account in the iPhone or Android app from You ▸ Settings ▸ Account ▸ Delete account, or on the web from Settings ▸ Profile ▸ Delete account. This permanently removes your data, including what was read from Apple Health or Health Connect.
• Portability — request an export of your data by emailing us.

To exercise any of these rights, email us at hello@ride-director.com.

We use browser cookies and local storage to keep you signed in and remember preferences (such as your last sign-in method). We do not use advertising or tracking cookies, and we do not sell or share what you do here with advertisers. If we enable the product analytics described in section 5, it will set its own cookie; until then, the only cookies here are ours and our hosting provider’s.

Ride Director is not intended for children under 16. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has created an account, please contact us and we will delete it promptly.

We take reasonable technical and organisational measures to protect your data — including encrypted connections (HTTPS), row-level security on our database, and OAuth-only authentication (no passwords stored). No system is completely secure, but we take this seriously.

We may update this Privacy Policy as the product evolves. If we make significant changes, we will notify you in the app. The date at the top of this page always reflects the latest version.

Questions, concerns, or data requests — we’re here: hello@ride-director.com

Ride Director is a product of: