Privacy Policy
Last updated: August 2026
1. Introduction
RideAware ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use RideAware at rideaware.com.au.
We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
RideAware is operated by Ride Aware Pty Ltd (ACN 701 074 660, ABN 17 701 074 660), of Sydney, New South Wales, Australia. We are the entity responsible for the personal information described in this Policy.
2. Information We Collect
2.1 Information you provide directly
- Account details — name, email address (if you register)
- Emergency contact — name and phone number (if you enable fall detection)
- Personal details — age and weight (optional, used to improve calorie calculations)
- Hazard reports — type and approximate location of hazards you submit
- Saved places and routes — including the names and coordinates of places you save, which may include your home or workplace
- Route planning requests — the free-text descriptions you type into the AI route planner
- Your own phone number (optional) — kept on your device and sent to our servers only if a fall is detected while you are sharing a live tracking link, so that whoever is watching it can tap “call the rider”. It is erased when the ride ends.
2.2 Information collected automatically during use
- Location data — your GPS coordinates during navigation and ride tracking. This is the core data that powers RideAware's routing and safety features. See section 4 for exactly when location is accessed
- Ride data — route taken, distance, duration, speed, and (if you connect Strava) heart rate and heart-rate zones
- Fall events — if fall detection triggers, we log the time, location, and which escalation steps occurred (whether an SMS was sent and whether the emergency dialler was opened). We do not store the emergency contact's number or the message content against the fall record
- Device data — accelerometer data (processed on your device only, never transmitted or stored) and, during live ride sharing, your device battery level
- Push notification identifiers — if you enable hazard alerts, a device push token so notifications can be delivered to you
- Record of your consent — when you accept these Terms we record the time, the version you accepted, your IP address, and a random identifier stored on your device. That identifier lets us link an acceptance you made before creating an account to your account afterwards
- IP address — recorded as part of the consent record above, and used temporarily to limit how often the AI route planner can be called
- Usage data — which features you use, so we can understand what is worth improving. This is a small fixed set of events (such as opening the App, calculating a route, or completing a ride) and includes a persistent identifier stored on your device so a returning visitor is counted once, whether or not you have an account. We record that a feature was used, never the content — for example that you planned a route, not where you went
We do not use a third-party analytics or advertising service. Usage data is written directly to our own database, is never combined with data from other apps or websites, and no advertising identifier is stored on your device.
2.3 Information from third-party integrations
- Strava — if you connect Strava, we receive your activity data including distance, duration, heart rate, and GPS routes
2.4 Sensitive information
Heart rate and heart-rate-zone data imported from Strava, and fall events recording that you may have been involved in a cycling accident, are health information under the Privacy Act. We collect this information only with your consent — heart rate only if you choose to connect Strava, and fall events only if you enable fall detection. You can withdraw that consent at any time by disconnecting Strava or turning off fall detection in Settings.
3. How We Use Your Information
We use your information to:
- Provide turn-by-turn navigation and route recommendations
- Calculate real-time safety scores
- Display relevant hazard alerts on your route
- Enable fall detection and emergency response features
- Share your live location with people you choose during a ride
- Send you notifications about new hazards on routes you have saved. To do this, our servers periodically compare your saved routes against live hazard data while you are not using the App
- Convert your plain-English route requests into route settings using an AI service (see section 8.1)
- Sync ride data with Strava
- Send transactional emails (account confirmation, password reset)
- Send automated emergency SMS alerts to your emergency contact if fall detection escalates
- Keep a record of your acceptance of these Terms and this Policy
- Understand which features are used, so we can decide what to improve
We do not use your information for:
- Advertising or marketing to third parties
- Selling your data to any third party
- Profiling you for commercial purposes unrelated to cycling safety
- Training artificial intelligence or machine learning models
4. Location Data — Special Notice
Location data is sensitive and we treat it with care:
- By default, your precise location is only accessed while the App is open and in use.
- Background tracking is available as an optional setting. If you turn on "Background ride tracking" in Settings, the App will continue recording your location while a ride is in progress even when your phone is locked or the App is in the background. This is off by default. While it is active, iOS displays a blue indicator in the status bar. You can turn it off at any time in Settings, or revoke location permission entirely in your device settings
- We do not access your location when no ride is in progress
- Live location during ride sharing is only visible to people you explicitly share your link with. The link contains a long random token; the tracking page cannot be found by guessing, and it does not reveal your account
- Location data is stored in our databases as described in section 6. Individual location fields are not separately encrypted by the App; they are protected by our hosting providers' encryption at rest and by the access controls described in section 6
- Some location data is sent to third-party services to provide the features you request — see section 8 for exactly what goes where
- You can revoke location permission at any time in your device settings
5. Emergency Contact Data
Your emergency contact's phone number is:
- Stored securely in our database linked to your account
- Only used to send automated SMS alerts if fall detection escalates without response
- Disclosed to Twilio, our SMS delivery provider, solely for the purpose of delivering that alert. The alert message contains your name, your location (as a map link and a What3Words address) and the time
- Not disclosed to any other third party, and never used for marketing
- Deleted when you delete your account or remove the emergency contact
6. Data Storage and Security
RideAware uses two separate databases:
- Supabase — holds your account, profile, saved places, ride history, fall events, live ride shares, hazard reports, usage data, and the record of your consent to these documents
- A separate application database hosted by our platform provider — holds your saved routes, Strava connection tokens, push notification tokens, and notification records
Security measures:
- Data is encrypted in transit (HTTPS)
- Data is encrypted at rest by our hosting providers
- Access controls scope your data to your account. In the Supabase database this is enforced by database-level row-level security policies; in the application database it is enforced by server-side authentication checks on every request
- We do not store payment information — no financial data is held by RideAware
- Access to production data is restricted to authorised personnel only
Where your data is stored. Our Supabase database — holding your account, profile, ride history, fall events, live ride shares and hazard reports — is hosted in Sydney, Australia.
Our separate application database is hosted by our platform provider in the United States. It holds your saved routes, including their start and destination coordinates and the names you give them, which may identify your home or workplace; your Strava connection tokens; and your push notification tokens. This means some of your personal information is stored outside Australia — see the overseas disclosure note in section 8.
Several of the third-party services listed in section 8 also operate outside Australia; that section names each one and the country it operates from.
7. Data Sharing
We share your data only in the following circumstances:
| Recipient | What is shared | Why |
|---|---|---|
| Transport for NSW | Nothing — we receive data from them, not share to them | Hazard data source |
| Strava | Your completed ride data (as a GPX file) | Only if you connect Strava and enable auto-post |
| Emergency contact | Your name, GPS location and the time, via SMS | Only if fall detection escalates |
| Twilio | Your emergency contact's phone number and the alert message | To deliver the emergency SMS |
| What3Words | The coordinates of your fall or hazard report | To convert coordinates into a precise, human-readable address |
| Anthropic | The text you type into the AI route planner | To convert your request into route settings |
| Mapbox, OpenRouteService, Stadia Maps, HERE, Open-Meteo, Foursquare, Open-Elevation, OpenStreetMap | Coordinates and search queries needed to answer your request | To provide maps, routing, search, weather, terrain and traffic data |
| Apple | Your device push token and notification content | To deliver notifications on iOS |
| Live tracking viewers | Your real-time location, route, speed, battery level, and (only after a fall is detected) your phone number if you provided one | Only people you share your tracking link with |
| Law enforcement | Account or location data | Only if required by law |
We do not sell your data to advertisers, data brokers, or any commercial third parties.
8. Third-Party Services and Overseas Disclosure
RideAware uses the following third-party services that may process your data:
| Service | What it receives | Sent from | Country |
|---|---|---|---|
| Supabase — database and authentication | Your account, profile, ride history, fall events, live ride shares and hazard reports | Your device | Australia |
| Replit — application hosting and our second database | Your saved routes (including start and destination coordinates), Strava connection tokens, push notification tokens | Our server | United States |
| Mapbox — map rendering and search | Map tile requests; search queries with an approximate location (rounded to roughly 110 m) | Your device (tiles) and our server (search) | United States |
| OpenRouteService — routing | Route start and end coordinates | Our server | Germany |
| Stadia Maps — alternative routing engine | Route coordinates | Our server | United States |
| HERE Technologies — live traffic congestion | The map area around your route | Our server | Netherlands / United States |
| Open-Meteo — weather data | Coordinates only, no identifiers | Our server | Germany |
| Open-Elevation — terrain and gradient | Route coordinates | Our server | Overseas |
| OpenStreetMap / Overpass — road surface and infrastructure | The map area around your route | Our server | Germany |
| Foursquare — place search | Search queries and location | Our server | United States |
| What3Words — precise location addressing | Coordinates of a fall or hazard report | Our server | United Kingdom |
| Twilio — SMS delivery | Your emergency contact's number and the alert message | Our server | United States |
| Anthropic — AI route planning (see 8.1) | The text of your route request | Our server | United States |
| Apple — push notification delivery | Device push token and notification content | Our server | United States |
| Strava — fitness data integration | Your ride data, if connected | Our server | United States |
| Google — sign-in and web fonts | Authentication details; your IP address when the site loads fonts | Your device | United States |
Where a service is listed as "Our server", your device does not contact that service directly — we send only what is needed to answer your request.
Overseas disclosure. As the table above shows, several of these recipients are located outside Australia. Our two databases are covered separately in section 6. Before disclosing your personal information to an overseas recipient we take reasonable steps to ensure they handle it in accordance with the Australian Privacy Principles. By using features that depend on these services, you acknowledge that your information may be processed overseas.
8.1 AI processing
When you use the "Plan with AI" feature, the text you type is sent to Anthropic's Claude API to extract structured route settings (such as distance, whether you want a loop, and how hilly you want the ride). The AI service only interprets your words — it does not calculate routes, look up addresses, or score safety; all of that happens using your device and our own systems.
We do not send your GPS coordinates, account details, or ride history to the AI service. However, the text you type may itself contain personal information if you name specific addresses or places, so please avoid including anything you would not want processed by a third party.
9. Your Rights
Under the Australian Privacy Act you have the right to:
- Access your personal data — request a copy of all data we hold about you. We will respond within 30 days
- Correct inaccurate data — update your details in Settings, or contact us and we will correct it
- Delete your data — use Settings → Delete my account to delete your data, or contact us. See section 10 for the limited exceptions
- Withdraw consent — disconnect the Strava integration, turn off fall detection, turn off background tracking, turn off notifications, and disable location access at any time
- Remain anonymous — you may use the core routing, navigation and hazard-reporting features without creating an account
- Complain — if you believe we have mishandled your data, contact us first. We will acknowledge your complaint within 5 business days and respond within 30 days. If you are unsatisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au
To exercise any of these rights contact: support@rideaware.com.au
10. Data Retention
| Data type | Retention period |
|---|---|
| Account data | Until account deletion |
| Ride history | Until account deletion or manual deletion |
| Saved places and saved routes | Until you delete them, or until account deletion |
| Recent destinations | Until account deletion |
| Fall events | Until account deletion |
| Live tracking data | Live position data is erased when you end the ride. The sharing link stops working 24 hours after the ride starts |
| Community hazard reports | Hidden from the map after 2 hours (48 hours for magpie swooping reports). The de-identified report is retained |
| Strava tokens | Until you disconnect the integration |
| Push notification tokens | Until you disable notifications or the device unregisters |
| Usage data | Retained in pseudonymous form. Your identity is unlinked from it when you delete your account |
| Record of Terms acceptance | Retained after account deletion. Your identity is removed from this record, but the fact and time of acceptance, the version accepted, and the IP address are kept as a legal record |
11. Children's Privacy
RideAware is not intended for users under 16 without the permission of a parent or guardian. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make a material change we will ask you to review and accept the updated Policy in the App before you continue using it. Continued use of RideAware after changes constitutes acceptance of the updated Policy.
13. Contact
For any privacy questions, requests, or concerns:
Ride Aware Pty Ltd
Sydney, New South Wales, Australia
support@rideaware.com.au
14. Data Breaches
If we become aware of a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under Part IIIC of the *Privacy Act 1988* (Cth).