Privacy Policy

1. Who we are

GoCycling (“we”, “us”, “our”) is an AI-native cycling route planning application. GoCycling.ai is operated by Johannes Bühler, Augustinergasse 21, 4051 Basel, Switzerland (see also the Imprint), who is the data controller for personal data processed through this service.

For questions about this policy or your personal data, contact us at [email protected].

2. Data we collect

Account and profile data

• Name and email address (provided during signup)
• Riding style and preferred devices (optional, provided during signup)
• Account credentials (password stored as a salted hash — we never store plaintext passwords)

Route planning data

• Routes you request, generate, and save
• Start and end points, waypoints, and routing preferences
• Chat conversation history with the GoCycling assistant

Technical data

• IP address (used for rate-limiting and abuse prevention)
• Browser type and operating system
• Pages visited and actions taken within the app, recorded server-side for product analytics
• Browser analytics events, including page location, sent to Cloudflare
• Error logs (sent to Sentry for diagnosis — see Cookies)

3. How we use your data

• To provide the service — generating personalised cycling routes, answering questions via the AI chat, and exporting routes for your cycling devices.
• To monitor quality — When diagnostic content capture is enabled, we record AI prompts, responses and tool inputs/results to investigate errors and assess route-planning quality. These records can contain personal data, as described under service providers.
• To communicate with you — transactional emails (account confirmation, access links, critical security notices). We do not send marketing emails unless you explicitly opt in.
• To ensure security — fraud detection, abuse prevention, and authentication.
• To comply with legal obligations — where required by applicable law.

We do not sell, rent, or trade your personal data to third parties. We do not use your data for behavioural advertising.

4. Legal basis for processing (GDPR Article 6)

• Contract (Art. 6(1)(b)) — Processing necessary to provide the service you signed up for, including generating routes, handling conversation history, and fulfilling tool requests initiated through API or MCP hosts.
• Legitimate interests (Art. 6(1)(f)) — Security, fraud prevention, abuse mitigation, and product diagnostics.
• Legal obligation (Art. 6(1)(c)) — Where required by Swiss or EU law.

Where we rely on consent for any future optional feature, you can withdraw it at any time without affecting the legality of prior processing.

5. Third-party integrations

GoCycling uses the services below to provide routing, map and weather information. BRouter, Mapbox and Open-Meteo do not require a separate account connection.

• OpenStreetMap / BRouter — Map data originates from OpenStreetMap. Routing requests, including your exact start, end and waypoint coordinates, are sent to BRouter, a routing engine we operate ourselves on our own infrastructure — not to any external routing provider. Because precise coordinates can identify a home, workplace or other personal location, we treat them as personal data even though no account identifier travels with the routing request itself.
• Mapbox — supplies the map tiles you see. Your device requests them from Mapbox directly, and each request includes your IP address and the part of the map you are viewing. Mapbox keeps a limited part of that request data, such as your IP address, for its own billing and security purposes, and for that use acts as an independent controller under Mapbox’s privacy policy, not as our processor. We render Mapbox maps using Mapbox GL JS on the web and the Mapbox Maps SDK on iOS, which send SDK telemetry (such as map-load and diagnostic events) to Mapbox; on iOS you can opt out of Mapbox telemetry at any time through the map attribution control.
• Open-Meteo — Weather forecast requests include the supplied geographic coordinates and forecast options, without a GoCycling account identifier. Precise coordinates can still identify a personal location.

BRouter, Mapbox and Open-Meteo are service requests rather than account connections that can be revoked in settings.

Other processors

The following also process data as part of running GoCycling (without a separate opt-in step, except for iOS cloud dictation refining as noted below):

• Ollama Cloud — processes your chat messages and route-planning intent to generate AI responses. We have not confirmed an EU/Switzerland-region agreement with Ollama, so a prompt may be processed outside the EU/Switzerland. Ollama states that it handles prompts transiently, does not train on them, and may process data in the United States.
• OpenAI — when you choose to use cloud dictation refining in the iOS app (or keep the “Refine dictation in the cloud” setting on after the first-use notice), GoCycling sends your voice recording and nearby place names to OpenAI to get place names right. GoCycling keeps neither after the request finishes; OpenAI retains API inputs for up to 30 days for abuse monitoring until Zero Data Retention (ZDR) is approved.
• Sentry — error and performance monitoring (see Cookies below). Configured to include account identifiers in error reports. Our configured project uses Sentry’s EU region; this does not establish where every part of Sentry’s processing takes place.
• Resend — sends transactional email on our behalf (account confirmation, password reset, security notices).
• Cloudflare — sits in front of every request to our servers as a reverse proxy, and can see your IP address and request metadata. Our shared-route page also loads a Cloudflare browser analytics beacon that sends page events, including the page location, to its analytics endpoint. We also store database backups in Cloudflare R2.
• Hetzner — hosts the physical server our application and database run on, in Germany.

We have not yet completed and published a full assessment of each processor’s data-processing agreement, location, and contractual safeguards for cross-border transfers; that work is in progress.

6. MCP and third-party AI hosts

When you connect GoCycling through an AI host such as ChatGPT, that host sends tool arguments to GoCycling and receives the results. These can include route requests, coordinates, routing preferences and route details. When connecting via OAuth/OIDC, the host may also receive your stable internal account identifier (UUID) and, if you authorize the requested email scope, your verified email address via the userinfo endpoint. Processing of tool arguments, identity data, and route responses requested through third-party AI hosts is conducted under Contract (GDPR Art. 6(1)(b) and Swiss FADP) to perform the route-planning services requested by the rider.

The host manages its conversation history under its own privacy policy and settings. GoCycling also stores generated routes and usage records; using another host does not mean GoCycling stores no data. Diagnostic processing described above can also apply to these requests. Deleting your GoCycling account does not delete a conversation retained by the AI host.

MCP routes, usage records and authorization records are governed by the following retention rules and criteria:

• Tool execution data — Tool arguments and raw API responses travel ephemerally during the active request lifecycle.
• Candidate routes — Undecided or unaccepted candidate routes undergo automated age-based cleanup after 7 days.
• Accepted routes — Routes accepted and saved via MCP expire after 30 days unless you open them in the GoCycling app (web or iPhone) or they are preserved through an exempted lineage root. Routes kept this way stay in your library until you delete them.
• MCP tool usage records — Records of tool invocations (user identifier, tool name, credential type, and timestamp) undergo automated cleanup after 30 days and are erased immediately upon account deletion.
• Authorization tokens and access logs — Active authorization tokens remain usable until revoked by you in account settings; expired or revoked tokens undergo automated cleanup after 35 days, and token usage accounting records are retained for 90 days. Security audit records of token-authenticated requests are retained for abuse prevention and rate-limiting enforcement.

An MCP owner-page handoff does not change who can access a route or sign you into your browser. Existing public route URLs can be opened by anyone who has them until the route is made private or deleted. If private-sharing controls are available for a route, creating a share link requires an explicit action by the owner. A recipient with an active share link can access that route. Revoking that link makes the route private and prevents further access through the link; deleting the route also stops access. Neither action retracts copies or downloads a recipient already received. These share links have no separate fixed expiry period.

7. Garmin Connect integration and AI processing

You can connect a Garmin Connect account to GoCycling under Garmin Connect in your account settings on the web, or under Profile in the iOS app. Connecting is optional. You sign in at Garmin, not at GoCycling, and choose on Garmin’s own screen what to share; GoCycling never sees your Garmin password. You can change those choices in Garmin Connect, or disconnect in GoCycling, at any time. Downloading a GPX file or sharing it with another app does not use this integration.

What the integration does

• Courses API — when you choose Send to Garmin Connect for a saved route, or ask the chat assistant to send one, we send that route to your Garmin Connect account as a course, for syncing to a compatible device. A course contains the route’s name and description, its track with elevation, its distance, climbing and descent, and its activity type. Only routes you choose are sent, never automatically.
• Activity API — if you allow Garmin to share your activities, Garmin sends us the activities it receives while you are connected, and we import the cycling ones as rides; other activity types are discarded when they are processed. We do not request your earlier activity history: an activity recorded before you connected is imported only if Garmin sends it to us while you are connected, for example after you change it in Garmin Connect. For each ride we store its name, activity type and recording device, its start time and time-zone offset, total and moving time, distance, elevation gain and loss, average and maximum speed, average and maximum heart rate, average power and cadence, and its GPS track with elevation. Your rides are shown only to you, under Rides, and are included in your account data export.
• Health API — not available. The planned use is optional health/recovery-based personalization of suggested route distance, climbing and effort, using only metrics available through the approved integration. This is for recreational fitness and route planning, not diagnosis or treatment.
• Training API — not available. The planned use is to publish structured cycling workouts and training plans you select to your Garmin Connect calendar for syncing to a compatible device. Exported data would include the selected workout steps, targets and plan schedule. Workout and training-plan export is separate from AI model training.

Your consent to routes going to Garmin

When you connect Garmin Connect, and before any future workout or training-plan export, we tell you what data will be transferred to Garmin, give you the Garmin Connect privacy notice, and ask for your express consent to that transfer; choosing Agree and connect gives it. No route is sent without it. We record when you agreed and to which version of that notice. You can withdraw your consent at any time under Garmin Connect in your account settings, and allow it again there; disconnecting withdraws it too, and connecting again asks again. Once a course is in Garmin Connect, Garmin processes it under its own privacy notice, and deleting the route in GoCycling does not remove the course from Garmin Connect. You must not upload data to Garmin Connect if you are restricted from doing so.

What we keep, and for how long

• The connection — your Garmin user ID, the access and refresh tokens Garmin issues (encrypted at rest), what you chose to share, when you connected, and your consent to sending routes. Deleted when you disconnect, when Garmin tells us you removed GoCycling there, or when you delete your account. When you disconnect, we also ask Garmin to end GoCycling’s access. Tokens from a connection attempt that was abandoned or replaced are kept only until we have ended that access at Garmin, normally within minutes.
• Rides — kept until you delete the ride or your account. Disconnecting stops new imports; rides already imported stay. When you delete a ride we keep only its Garmin activity identifier, so that a later update from Garmin cannot bring it back; that identifier is deleted with your account.
• Courses — which Garmin course each sent route became, so that sending it again updates that course. Deleted with the route or your account.
• Notifications from Garmin — stored until processed, then deleted. One that keeps failing is kept for 30 days without its content, recording only the kind of error. Notifications received while the integration is switched off are deleted after 7 days.
• Backups — Garmin data is stored in our database, which is hosted as described in Section 8, and in its backups. Deleted records can remain in backups until those copies rotate out, as described in Section 9.

AI processing

The chat assistant is told only whether your Garmin account is connected, allows courses and has your consent to sending routes, so that it can offer to send a saved route; when you ask it to, it sends the route as described above. Your imported rides are not given to the chat assistant, to MCP hosts or to any AI provider. We do not use Garmin data or derived prompts, responses, summaries or recommendations for AI training, evaluation, benchmarking or model improvement.

A planned, optional AI feature would process authorized Garmin activity and health/recovery information to suggest routes suited to your recent riding and recovery. It would produce recommendations, not train an AI model. Before enabling it, we must obtain Garmin’s approval for the proposed use and any required written authorization, establish the applicable legal bases for personal and health data, and obtain your explicit consent before AI processing. You must be able to withdraw that consent easily. These AI consent controls are not yet available. The general service-contract and MCP processing descriptions in Sections 4 and 6 do not authorize this future Garmin processing; continued use of GoCycling is not consent to it.

Assessments still open

The processor and international-transfer assessment described in Sections 5 and 8 remains unfinished, including for Garmin data, and so does our assessment of the legal basis for activity data that may reveal information about your health, such as heart rate. The exact data fields, recipients, retention and deletion handling for the planned AI and health features will be confirmed and published before they are activated.

8. Data storage and international transfers

Our application and database infrastructure (PostgreSQL + PostGIS, BRouter) is self-hosted on our own Kubernetes cluster, fronted by Cloudflare as a reverse proxy for all traffic. That server is located in Germany. Where GDPR Chapter V or the Swiss FADP require additional safeguards for a transfer outside Switzerland or the EU/EEA (such as Standard Contractual Clauses), we have not yet completed and published that assessment for every processor listed in “Third-party integrations” above.

9. Data retention

• Account data — Retained for the duration of your account. When you delete your account, your account record and directly owned data (saved routes, sessions, feedback, and authorization tokens) are erased in a single database transaction. This deletion from the live database is immediate, and we do not currently offer a recovery window afterward.
• Database backups — We copy scheduled database backups to Cloudflare R2. Pruning is configured to retain the newest 72 hourly copies and 7 daily copies. These copy-count limits do not guarantee a maximum age: missed or failed backup or pruning jobs can leave older copies for longer. Records deleted from the live database may remain in backups until those copies are removed by this rotation.
• Chat history — A daily cleanup is configured to delete stored chat messages when more than 30 days have passed since the conversation’s last write. Reading a conversation does not reset this clock. Eligibility for this cleanup does not guarantee deletion at exactly 30 days or removal of separate diagnostic records, feedback copies, backups or AI-host history.
• Session usage analytics — Message counts, routes generated, and feedback for a chat session, linked to your account by user ID rather than anonymised. A daily cleanup is configured to delete session records and their summaries once more than 90 days have passed since the session started. This is measured from session start, not last activity, and is not an exact deletion deadline. Failed or missed cleanup runs can delay deletion.
• App activity — For each day you use GoCycling while signed in, which app you used (the web app, the iPhone app, an AI assistant such as ChatGPT, or the API), linked to your account by user ID. We use it to count how many riders use each app. A daily cleanup is configured to delete these records once they are more than 90 days old. They are included in your data export and erased when you delete your account.
• Error logs — Captured server-side and sent to Sentry for diagnosis (see Cookies). Retention is governed by our Sentry plan; we have not published a fixed period for it here.
• Garmin Connect data — The connection, imported rides, course records and notifications from Garmin are kept and deleted as set out in Section 7.
• MCP and API records — Governed by the separate criteria and rules detailed in Section 6 above.
• Legacy Strava data — Strava connections made before v1.0.0 are no longer held: the stored credentials, imported routes and segments, and the cached ride-history summary were deleted when this policy version took effect. The Strava integration is switched off, and we will update this policy before it returns.
• Service discontinuation — If GoCycling shuts down, we will email registered users at least 30 days in advance, keep the account export available for that period, and then delete all personal data, with backup copies expiring under the rotation above.

10. Your rights (GDPR and Swiss FADP)

As a data subject under the GDPR and the Swiss FADP, you have the following rights:

• Access (Art. 15) — Request a copy of all personal data we hold about you.
• Rectification (Art. 16) — Correct inaccurate or incomplete data.
• Erasure (Art. 17) — Request deletion of your personal data (“right to be forgotten”).
• Restriction (Art. 18) — Restrict how we process your data in certain circumstances.
• Portability (Art. 20) — Receive your data in a machine-readable format (JSON/GPX for route data).
• Objection (Art. 21) — Object to processing based on legitimate interests.
• Withdraw consent — At any time for consent-based processing.

The Swiss FADP grants the same rights: access (Art. 25 FADP), data portability (Art. 28 FADP), and rectification or deletion (Art. 32 FADP).

To exercise any of these rights, email [email protected]. We will respond within 30 days. If you are unsatisfied, you can lodge a complaint with your data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU/EEA the supervisory authority of your member state.

11. Cookies

Cookies used for authentication and security include:

• JSESSIONID — Session authentication; a Secure, HttpOnly browser-session cookie.
• XSRF-TOKEN — CSRF protection; a Secure browser-session cookie that the application reads to protect requests against cross-site request forgery.
• cf_clearance — A persistent Cloudflare security cookie used for visitor and challenge verification. Cloudflare describes its purpose and how duration depends on the site’s Challenge Passage setting in its clearance documentation. We do not state a fixed duration here.

These cookies support signing in, request protection and Cloudflare security checks. The Cloudflare browser analytics beacon described in Section 5 is a separate processing activity.

We also use Sentry for error and performance monitoring, including session replay. Browser reports can be sent directly to Sentry’s infrastructure. An optional relay is also supported; it is not required for direct delivery. Session replay masks all on-screen text and blocks embedded media by default, and is never captured on pages that handle your credentials.

12. Children’s privacy

GoCycling is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email (to registered users) and by updating the “Last updated” date above. Continued use of the service after the effective date constitutes acceptance of the updated policy.

14. Contact us

For privacy-related enquiries or to exercise your rights:

• Email: [email protected]
• Response time: within 30 days

For general support: [email protected]