PedalPing — Privacy Policy

Last updated: 16.07.2026

EN · DE · FR

PedalPing lets you tell your friends you're going on a bike ride with one tap. We built it to collect as little about you as possible. This page explains what we collect, why, and your rights.

What we collect

• Account details — your email address (if you sign in with email) or a Google account identifier (if you sign in with Google), and the display name you choose. Used to create your account and show you to your friends.
• Friend connections — the friend code you share and the list of friends you connect with. Used to deliver your ride notifications to the right people.
• Nicknames — an optional name of your own that you can give a friend, to tell people with the same name apart. Stored privately in your account: only you can read it, the person you named cannot see it, and it is never used in notifications.
• Groups — group names you choose yourself (for example "Town XY") and the list of friends in each, so you can pick who gets notified about a ride. Stored privately in your account: only you can read them, and members see neither the name nor the fact that they are in a group.
• Notification tokens — a device identifier ("push token") from Firebase Cloud Messaging. Used solely to send you notifications. Stored privately; other users cannot read it.
• Ride activity — when you start and end a ride, and any optional details you choose to add (a duration, a distance you type in after the ride, and a free-text destination). Used to notify your friends and show recent activity in the app.
• Feedback — if you send feedback, the message text, your user ID, and your platform. Used only to fix bugs and improve the app.
• Crash reports — if the app crashes, a technical report (device model, OS version, and what the app was doing at the time) is collected via Firebase Crashlytics so we can find and fix the bug. Crash reports are not linked to your name, email or friends.

What we do NOT collect

• No location data. The QR scanner uses your camera only to read a friend code on your device — no images are stored or uploaded.
• No advertising and no ad identifiers.
• No usage analytics or behavioral tracking — crash reports (above) are the only diagnostics we collect.
• We do not sell your data to anyone.

How your data is stored and processed

PedalPing runs on Google Firebase (Authentication, Cloud Firestore, Cloud Functions and Cloud Messaging, provided by Google Ireland Ltd. and Google LLC), which acts as our data processor under the Google Cloud data processing terms. Your account, friend and ride data is stored in the European Union region (europe-west).

International transfers: some services process data outside the EU — notification delivery (Firebase Cloud Messaging) and crash reporting (Firebase Crashlytics) may involve processing on Google servers in the United States. These transfers are safeguarded by the EU–US Data Privacy Framework, to which Google is certified, and Google's Standard Contractual Clauses.

Who can see your data

The only people who see your activity are the friends you connect with: they can see your display name and the ride information you choose to broadcast (that you're riding, and any duration/distance/destination you added). We do not share your personal data with any other third parties, except the infrastructure provider (Google Firebase) described above.

Legal basis (GDPR)

• Account, friends, rides, notifications — performance of a contract (Art. 6(1)(b) GDPR): this is the service you signed up for.
• Optional ride details (duration, distance, destination) — your consent (Art. 6(1)(a)); simply leave them empty to not provide them.
• Crash reports — our legitimate interest (Art. 6(1)(f)) in keeping the app stable and secure. Reports contain no name, email or friend data.
• Feedback — your consent (Art. 6(1)(a)), given by sending it.

You can withdraw consent at any time by not using those features or by deleting your account. We do not use automated decision-making or profiling.

Your rights

• Access & portability — request a copy of your data.
• Correction — change your display name in the app at any time.
• Deletion — delete your account directly in the app (Settings → Delete account). This permanently removes your profile, friend connections, ride history, notification tokens and all other account data. You may also email us to request deletion.
• Restriction & objection — you may request that we restrict processing (Art. 18 GDPR) or object to processing based on legitimate interest (Art. 21 GDPR) by contacting us.
• Complaint — you may lodge a complaint with your local data protection authority.

Data retention

We keep your data for as long as your account exists. When you delete your account, your profile, friendships, ride history and private data (including notification tokens) are deleted immediately; feedback you submitted is retained in anonymised form (your user ID is removed) to help us improve the app. Crash reports are retained by Firebase Crashlytics for 90 days and then deleted automatically.

Children

PedalPing is not directed at children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as the app evolves. We will update the date at the top and, for significant changes, notify you in the app.

Contact

Questions or requests: pedalpingapp@gmail.com.
Postal address and legal notice: see the Impressum.