Privacy Policy

1Who is responsible

Challenger One SRL (company no. 0769.270.178, VAT BE0769270178), Rue Marc Brison 25, 1300 Limal, Belgium, is the controller of the personal data described here.

Privacy requests and questions: privacy@rydr.gg. General support: support@rydr.gg.

Supervisory authority: the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, www.autoriteprotectiondonnees.be. We have not appointed a Data Protection Officer; we are not required to.

2What this policy covers

This policy applies to rydr.gg (the public site), play.rydr.gg (the RYDR web app, including the phone controller), and the RYDR app for iOS and Android. The games you play inside RYDR are part of RYDR and are covered too.

It does not cover the other companies you deal with around it: your trainer or heart rate monitor's own app, Apple's or Google's stores, or Strava if you choose to connect it. Those have their own policies, and section 6 says what we send them.

3What we collect

Your account. Your email address, and the code your account was created with (an invite code, or the one the iOS app uses for its open sign-up). There is no password: signing in means asking us to email you a 6-digit code, so your email address is also how you prove who you are.

We use that address for sign-in codes and for service messages about your account. We email you about what happens in the game only if you ask us to: the switch is off until you turn it on, it is in the app under Settings, Notifications, and turning it off there stops the mail. Even switched on, we send at most one such email every twelve hours. We do not sell it, rent it, or send you marketing on someone else's behalf.

Your profile. A display name, and optionally a photo. Also, because the games need them to turn what you pedal into what happens on screen: your year of birth, gender, height, your weight and your bike's weight, and your FTP if you tell us it. These are figures you enter, they are used for the physics and for age-appropriate access, and none of them are a medical record.

Your photo is public. Profile pictures are stored in a public bucket and served from a URL that anyone holding it can open, which is what lets your avatar appear on a leaderboard. Do not upload anything you would not put on a public page.

Your rides. When you finish a ride we store what the session produced: how long you rode, your average and peak power, cadence, the game you were playing, and when it happened. If a heart rate monitor is connected, its readings are part of that ride data. You can export a ride as a FIT file.

Your records. When a ride sets a personal best or a world record on a leaderboard, that result, with your display name and avatar, is shown to other RYDR riders in the feed and on the leaderboards. This is the point of the feature, so treat your display name as public within RYDR.

Your equipment. The name and identifier of the trainer, heart rate monitor or controller you pair, so we can reconnect to it and so we can tell which devices work badly. The live sensor stream is processed on your own device; what reaches us is the ride summary above.

Playing in real time. Presence in a room and the inputs from a phone used as a controller travel through our real-time service while you play. They are relayed, not kept: what persists afterwards is the ride and any record it set.

Notifications, if you turn them on. A push token issued by Apple or Google, which platform it is for, a short support string describing the device (for example "iPhone17,2 · iOS 26.5"), and the date the app last used it. Nothing is sent to your device until you accept the prompt.

How RYDR is used. Events (screens opened, sign-in steps completed, rides and runs started and finished, hardware connected or failing to connect), recorded against your account with a session identifier and the app version. We use this to find what is broken and what nobody can find, not to build a profile of you, and we make no automated decisions about you from it.

Crashes and errors, in the app. When the RYDR app crashes or hits an error, a report is sent to our error-reporting provider: the technical detail of the failure, the app version, and your device model and operating system version. It is tagged with your rider identifier, so that a crash can be matched to a support conversation about it. Your name and your email address are deliberately not attached. This applies to the iOS and Android app; the website sends no crash reports.

Files you upload. Avatars, and any media or replay data a game saves for you, are stored with our object-storage provider.

Technical records. Our hosting and real-time providers log the ordinary things a server logs (IP address, user agent, timestamps, errors), which we use to keep the service up and to investigate abuse.

Visits to rydr.gg. The public site counts its visits with Umami, a privacy-focused analytics service: which pages are viewed, the referring site, and the browser, operating system, device type and country derived from the request. It sets no cookies, does not store your IP address, and cannot tell who you are. The web app and the RYDR app do not use it.

The waitlist, from before the open beta. rydr.gg used to offer a form to be told when RYDR opened. For the people who used it we still hold the email address and the IP address the request came from; the IP was there to spot abuse of a public form, nothing else. The form is gone and collects nothing new.

Strava, only if you connect it. Linking your Strava account tells us your athlete name, which the connection card shows you, and from then on we upload each finished ride to Strava for you. Your Strava profile picture becomes your RYDR avatar only if you ask for it with "Use Strava photo" on your profile page; it is then public like any avatar, and it is deleted when you disconnect Strava. Disconnect at any time on your profile page; the rides already uploaded are yours to delete in Strava.

What you write to us. If you email us, we keep the message and its metadata so we can answer and refer back to it.

Kept on your device. Your signed-in session, your profile cache, the games registry and the analytics session identifier live in your browser's storage on the web, and in the operating system's own app storage (UserDefaults on iOS, SharedPreferences on Android) in the app. They are removed when you clear site data or delete the app. We set no advertising or tracking cookies, and RYDR carries no advertising SDK.

4What we do not collect

• No payment details. RYDR is free and takes no payments.
• No advertising identifiers, no ad networks, no data sold or shared for advertising.
• No location. Android classifies Bluetooth scanning as a location permission, so the system may say so when you pair a trainer. We neither read nor store your position.
• No contacts, calendar, microphone or camera. Photos only if you upload one.
• No Apple Health or Google Fit data: nothing is read from or written to them.
• No profiling or automated decision-making that produces legal or similarly significant effects.

5Why we are allowed to use it

Each purpose below has a legal basis under the GDPR:

• Running the service you asked for (your account, profile, rides, records, the feed, real-time play: necessary to perform our agreement with you.
• Push notifications: your consent, given at the prompt, withdrawable at any time in your device settings.
• Connecting Strava and uploading your rides there: your consent, given when you link the account and withdrawn when you unlink it.
• The waitlist we ran before the open beta: your consent, withdrawn by asking us to remove you.
• Counting visits to rydr.gg, without cookies and without identifying you: our legitimate interest in knowing which pages work.
• Keeping the service working, secure and honest (diagnostics, abuse and cheat detection, operational alerts to our own team: our legitimate interest in a service that functions and a leaderboard that means something.
• Answering you when you write to us: our legitimate interest in supporting riders.
• Accounting, tax, and answering lawful requests: a legal obligation.

Where we rely on legitimate interests you can object: see section 9.

6Who else sees it

Other riders see your display name, your avatar and the records you set. They do not see your ride history, your email address or your profile figures: rides are readable only by their owner, enforced in the database itself rather than only in the app.

We use these providers, each for one job, each under a data processing agreement:

• Supabase: sign-in, database, file storage and our server-side functions. Hosted in the EU.
• Vercel: hosting and delivery of the website and these pages; server logs.
• Umami: counting visits to rydr.gg, as section 3 describes. It receives the page request, never anything about your account.
• Cloudflare: object storage for uploads and replays, and the real-time service behind presence and the phone controller.
• Sentry: crash and error reporting for the iOS and Android app, so we can find what is breaking and fix it. It receives the technical detail of the failure, the app version, your device model and operating system version, and your rider identifier. Hosted in the EU (Frankfurt).
• Apple Push Notification service and Google Firebase Cloud Messaging: delivering notifications to your device.
• Resend: sending the email we address to you: your sign-in codes, and the notification emails if you switch them on. It receives your email address, and for a notification your display name and the name of the game involved. Resend stores message content and delivery logs in the United States for 30 days, under the standard contractual clauses in our agreement with them and their EU-US Data Privacy Framework certification.
• Google Fonts: typefaces are loaded from Google's font servers, so Google receives the request, including your IP address.
• Google Cloud Text-to-Speech: generating game voice-over. It is sent scripted lines written by us, never anything about you.
• Telegram: our team receives operational alerts (a new rider, a world record, a trainer that failed to connect) in a private staff chat. These name the rider involved, which is what makes them useful for support; the chat is not public.
• Strava: only if you connect it, and only what section 3 describes.

We do not sell your personal data. We disclose it outside this list only where the law requires it, and we will tell you when we are allowed to.

7Where it is stored, and transfers outside the EEA

Your account, profile, rides and records are held in our Supabase project in the European Union (AWS eu-west-1, Ireland), so the core of the service involves no third-country transfer.

Some of the providers in section 6 are established outside the EEA or process data there, notably Apple and Google for push delivery, Google for fonts and speech, and Telegram for staff alerts. Where a transfer needs a safeguard we rely on the EU Standard Contractual Clauses, or on the provider's certification under the EU-US Data Privacy Framework where it holds one, together with encryption in transit and access controls on our side.

8How long we keep it

• Your account, profile, rides and records: until you delete your account. You can do that yourself in the RYDR app for iOS or Android, at the bottom of your profile page, with Delete account permanently; it takes effect immediately.
• Deletion, however you ask for it: completed within 90 days, backups included, except where the law requires us to keep something (accounting records, for instance). The live service forgets you at once; that window is for the backups rolling forward.
• Push tokens: removed when you sign out on that device, and pruned once a device has not opened the app for six months.
• Usage events: while your account exists; afterwards only in aggregate, with nothing identifying you.
• Technical and security logs: up to 12 months.
• Crash reports: up to 90 days.
• Waitlist entries: until you ask to be removed, and at most 24 months after your last contact with us.
• Visits to rydr.gg: Umami keeps only the counts described in section 3.
• Emails you send us: up to 24 months after the exchange ends.

9Your rights

Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to a particular use, and to receive it in a portable form. You can withdraw any consent you have given (notifications in your device settings, Strava on your profile page) without affecting what we did before you withdrew it.

Write to privacy@rydr.gg from the address you ride with. We answer within one month, extendable where the law allows. If you write from another address we may ask you to confirm who you are, because handing an account's data to the wrong person is the worse failure. Portable copies are provided as JSON or CSV of your own data; we do not publish internal schemas.

Deletion does not need us at all: in the RYDR app for iOS or Android, Delete account permanently at the bottom of your profile page removes the account there and then. Email us instead if you ride on the web or no longer have the app installed. Both routes reach the same place.

Either way it removes your profile, your rides and your records, and takes your results off the leaderboards and the feed with them. What survives, and for how long, is set out at https://rydr.gg/delete-account.

If you think we have handled this badly, tell us first: most of it is faster to fix that way. You can also complain to the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, www.autoriteprotectiondonnees.be, or to the authority where you live.

10Security

What we do:

• Sign-in uses one-time email codes and the PKCE flow, so no password of yours exists to be leaked and the code verifier never leaves your device.
• Rides and profile rows are owner-only at the database level, not merely hidden by the interface.
• Traffic is encrypted in transit; keys for our server-side functions are held as server secrets and never shipped to a browser.
• Access to production data is limited to the people who need it.

None of that makes a service unbreakable. If a breach affects your data we will notify the supervisory authority within 72 hours where the law requires it, and tell you directly where the risk to you is high.

11Children and young riders

RYDR is not for anyone under 13, and we do not knowingly collect data from children under that age. The profile asks for a year of birth, which is what lets us apply this.

Between 13 and 18 a parent or guardian has to agree to the Terms and permit the account, and we would rather they were around for the riding as well (see the health and safety section of the Terms. A parent can exercise every right in section 9 on their child's behalf.

If you believe a child under 13 has an account, write to privacy@rydr.gg and we will delete it and the data with it.

12Changes to this policy

Minor changes (wording, clarifications, a renamed provider) take effect when we publish them, and the date at the top moves.

Material changes take effect no earlier than 15 days after we tell you, by email or in the app. If you do not accept them you can delete your account before that date.

The current version is always at https://rydr.gg/privacy. We keep the previous ones internally.

13Contact

Privacy: privacy@rydr.gg. Support: support@rydr.gg.

By post: Challenger One SRL (company no. 0769.270.178, VAT BE0769270178), Rue Marc Brison 25, 1300 Limal, Belgium.