Privacy Policy

Information you give us directly:

• Profile data — your name, display name, profile photo, role (coach or rider), date of birth, and timezone.
• Health data — your maximum heart rate, if you choose to enter it, used to personalise your training zones.
• Content — posts, comments, reactions, and any other content you share on the platform.

Information collected automatically:

• Account data — your email address, provided by Google or Apple when you sign in.
• Usage data — which features you use, classes you attend, and interactions on the platform (follows, RSVPs, etc.).
• Device data — browser type and general location (country/region), collected for analytics and security purposes.

Apple Health, on iPhone and Apple Watch:

If you grant permission, the app reads your resting heart rate, heart rate variability, VO₂ max, active energy and workout history from Apple Health. These stay on your device. They are used to work out your training zones and to show your own recovery card — they are never uploaded to our servers, never shared with anyone, and never used for advertising.

Your live heart rate during a class is different: it leaves your device by design, because showing it is what a live class is. It is sent to our servers so it can appear on the class screen and in your ride recap, and other riders in that class see it alongside your name unless you turn it off in Settings ▸ Live metrics. Cadence and power work the same way. You can revoke Apple Health access at any time in the iOS Health app, under Sharing ▸ Apps.

• To create and manage your account.
• To run the platform — scheduling classes, syncing live sessions, showing you your feed and notifications.
• To personalise your experience, such as suggesting coaches or riders to follow.
• To send transactional emails — class invites, session reminders, and account notices.
• To improve the product through aggregate, anonymised usage analytics.

We do not sell your data. We do not use your data for advertising.

When you sign in with Google or Apple, we receive your name, email address, and profile photo from that provider. We do not receive your Google or Apple passwords. Each provider’s privacy policy governs what they collect on their end:

• Google Privacy Policy
• Apple Privacy Policy

If you connect Apple Music, Ride Director uses a developer token to initialise the MusicKit player in your browser. We do not access your Apple Music library, listening history, or payment information. Each user streams audio directly from their own Apple Music account — we never intercept or store audio.

We use a small number of third-party services to operate Ride Director:

• Supabase — our database and authentication infrastructure. Your data is stored on Supabase-managed servers.
• Vercel — our hosting provider. Handles web traffic and edge delivery.
• Resend — used to send transactional emails such as class invitations.
• Daily — runs the live video and audio in a class. When you join one, Daily receives your display name, your user ID, and your camera and microphone streams for as long as the class lasts. If you have not set a display name, your email address is used as your name in the class instead.
• Apple Music — only if you choose to connect it. Music plays from your own account and we never receive your password or payment details. See section 4.

Our code also includes Sentry (crash and error diagnostics) and PostHog (product analytics). Neither is switched on in production today, so neither currently receives anything about you. We list them because they are built in and could be enabled, and we would rather name them than surprise you.

We do not sell your personal data, we do not use it for advertising, and we do not share it with anyone not named on this page except where the law requires it.

We keep your data for as long as your account is active. If you delete your account, your profile, posts, and personal data are permanently deleted within 30 days. Some anonymised or aggregate data (e.g. class attendance counts) may be retained for analytics purposes.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — update your profile information at any time from Settings.
• Deletion — delete your account from Settings → Profile → Delete account. This permanently removes your data.
• Portability — request an export of your data by emailing us.

To exercise any of these rights, email us at hello@ride-director.com.

We use browser cookies and local storage to keep you signed in and remember preferences (such as your last sign-in method). We do not use advertising or tracking cookies, and we do not sell or share what you do here with advertisers. If we enable the product analytics described in section 5, it will set its own cookie; until then, the only cookies here are ours and our hosting provider’s.

Ride Director is not intended for children under 16. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has created an account, please contact us and we will delete it promptly.

We take reasonable technical and organisational measures to protect your data — including encrypted connections (HTTPS), row-level security on our database, and OAuth-only authentication (no passwords stored). No system is completely secure, but we take this seriously.

We may update this Privacy Policy as the product evolves. If we make significant changes, we will notify you in the app. The date at the top of this page always reflects the latest version.

Questions, concerns, or data requests — we’re here: hello@ride-director.com

Ride Director is a product of: