Privacy Policy

Introduction and organizational info

Bikepackia ("Bikepackia", "we", "us", "our") is an experimental, pre-commercial AI-assisted bikepacking route planner available at bikepackia.com and as the Bikepackia mobile app for iOS and Android. The project is currently run by an individual operator and is not yet an incorporated company; that operator is the data controller responsible for the personal data described in this policy.

Controller: Masoud Ahmadi, an individual based in France, operating under the name "Bikepackia". You can reach us about privacy or any data request at contact@bikepackia.com.

We have not appointed a Data Protection Officer (our scale does not require one), but we take your privacy seriously and aim to respond to any request promptly. We process personal data only for the purposes set out below — providing and improving the Service, supporting users, and meeting our legal and billing obligations — and we apply security measures designed to protect it.

Scope and application

This policy protects the personal data of everyone who interacts with Bikepackia — visitors who simply browse bikepackia.com, people who use the Bikepackia mobile app on iOS or Android, registered users who create an account, and customers who purchase credits or a plan. It applies to both the website and the mobile app, and explains what we collect, why, who we share it with, and the rights you can exercise.

Data we collect and process

Depending on how you use the Service, we collect and process the following categories of personal data:

• Identity and account data — when you create an account, our identity provider Clerk processes your email address and name on our behalf. Anonymous use is possible without an account, in which case no account data is collected.
• Route data — the trip briefs you write and the routes generated for you, including start and finish points, waypoints, coordinates, and any notes you enter or that the planner produces.
• Device location (mobile app only) — with your permission, the mobile app reads your device's precise location to show where you are on the route map while you use it. This is processed on your device only: we do not track your location in the background, and we do not send it to or store it on our servers.
• Push notification token (mobile app only) — if you allow notifications, the app registers a device push token and stores it on our backend, linked to your account, so we can send you trip and service notifications. It is not your location and cannot read anything on your device; you can turn notifications off at any time in your device settings.
• Payment data — when you buy credits or a plan, our payment provider Stripe collects and processes your payment details. We never receive or store your full card number.
• Usage and analytics data — only if you consent, we use Google Analytics (loaded via Google Tag Manager) to understand how the Service is used. This may include pages viewed, interactions, device and browser type, and IP-derived approximate location. Analytics does not run until you opt in through our Cookiebot consent banner.
• Acquisition and referral data — if you arrive from an advertising campaign and then create an account, we store how you found us, linked to your account: the Google Ads click identifier (gclid); the campaign source, medium, name, search term and ad content; the landing page you arrived on; the referring website; the date and time of your first visit; and the dates you created your account and first generated a route. We use this to measure which campaigns bring people to Bikepackia. It exists only if you granted Marketing consent, because it comes from the bikepackia_attr cookie described under “Cookies & tracking” — that consent is the basis for this processing too, and you can withdraw it at any time (see “Your rights”).
• Technical and session data — basic technical information such as IP address, device and browser type, and session cookies needed to operate, secure, and debug the Service.

What we do not collect

We only process data that is necessary to provide the Service, meet a legal obligation, or — with your consent — improve the Service. We do not collect special-category (sensitive) data, government identifiers such as passport or social-security numbers, or dates of birth. We do not track your location in the background or build a location history. In the mobile app, precise device location is read only while you use the map and only with your permission, solely to show your position — it is not transmitted to or stored by us. The only location data we store is the route points you choose to enter and the approximate, IP-derived location used by analytics when you have consented to it.

Mobile app permissions

The Bikepackia mobile app asks for two optional device permissions. Both stay off until you grant them, and you can revoke either at any time in your device's system settings — the app keeps working without them, with only the related feature disabled.

• Location (while using the app) — used only to show your current position on the route map. The app does not access your location in the background and does not store or transmit it.
• Notifications — used to send trip reminders and service updates. Declining simply means you will not receive push notifications.

How we use your data

We use your personal data to:

• Provide the Service — generate routes, save them to your account, and export GPX files.
• Show your position on the route map in the mobile app, when you grant location permission.
• Send trip and service notifications to your device in the mobile app, when you allow notifications.
• Authenticate you and keep your account, credit wallet, and preferences secure.
• Process payments and prevent fraud.
• Operate, secure, and debug the Service and prevent abuse.
• Understand and improve how the Service is used (only with your analytics consent).
• Communicate with you about service-related matters and respond to your requests.
• Meet legal, accounting, and tax obligations.

Legal bases for processing

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you ask for, including accounts, route generation, and billing.
• Consent — for analytics and for advertising measurement. This covers the Google Analytics cookies loaded through our consent banner (Statistics) and our own advertising-attribution cookie, bikepackia_attr (Marketing), together with the acquisition and referral data it produces. Both are set only if you opt in, and each category is a separate choice. You can withdraw either at any time via the cookie settings; when you withdraw Marketing consent the attribution cookie is deleted from your device.
• Legitimate interests — to secure the Service, prevent abuse and fraud, and improve our product, balanced against your rights. You can object to processing based on our legitimate interests at any time (see “Your rights”).
• Legal obligation — where we must keep records, for example for tax or accounting.

Data storage and protection

Your data is processed and stored on infrastructure operated by reputable hosting and storage providers located in the European Union and the United States (see “Third parties & processors” below). We select providers that maintain strong, industry-standard security and that commit to appropriate data-protection safeguards.

We apply technical and organisational measures including encryption in transit (HTTPS), restricted need-to-know access controls, and regular review of access permissions. No system is perfectly secure, but we work to keep your data safe and to notify you and the relevant authorities of a breach where the law requires.

Third parties & processors

We share personal data with a small number of third parties. Most of them are service providers (processors) who handle it only on our behalf, under contract (Data Processing Agreements) and only as needed to run the Service. Where a recipient instead decides for itself how it uses the data — currently only Google Ads, for advertising conversion measurement — its entry below says so. We do not sell your personal data. The third parties we share data with are:

• Clerk (Clerk, Inc.) — authentication and account management; processes your email and name.
• Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.) — payment processing for credits and plans; processes your billing and payment details. We never store your full card number.
• BRouter and other routing providers — generate route geometry from the coordinates and waypoints you supply.
• Expo (650 Industries, Inc.) — mobile push-notification delivery; processes your device push token to relay notifications to your device.
• Apple Push Notification service (Apple Inc.) and Firebase Cloud Messaging (Google Ireland Limited) — the operating-system push transports that deliver notifications to iOS and Android devices respectively.
• Cloudflare (Cloudflare, Inc.) — content delivery, security, and R2 object storage for generated files such as GPX exports; processes technical data (e.g. IP address) and stored route files.
• Render (Render, Inc.) — hosting for the Bikepackia API.
• Vercel (Vercel, Inc.) — hosting for the Bikepackia website.
• Google Analytics (Google Ireland Limited) — usage analytics, only with your consent; may process usage, device, IP, and approximate-location data.
• Google Tag Manager (Google Ireland Limited) — tag management used to load analytics after consent.
• Google Ads (Google Ireland Limited) — advertising conversion measurement. When you reach Bikepackia from a Google ad and then create an account, we send Google the ad click identifier (gclid) — via Google Analytics, from where the sign-up is imported into Google Ads as a conversion — so we can measure which ads lead to sign-ups. For this conversion measurement Google acts as an independent or joint controller, not solely as our processor. Data may be transferred to Google LLC in the United States under the European Commission's Standard Contractual Clauses and, where it applies, the EU–US Data Privacy Framework.
• Cookiebot, a Usercentrics product (Usercentrics A/S) — cookie consent management; records your consent choice and processes limited technical data such as a truncated IP address.

Sharing and disclosure

Each service provider above is bound by a Data Processing Agreement requiring appropriate technical and organisational safeguards, and is permitted to use your data only to provide its service to Bikepackia. The exception is the Google Ads conversion measurement described above: for that limited purpose Google acts as an independent or joint controller rather than solely as our processor, and its own privacy policy (policies.google.com/privacy) governs what it does with the data. Beyond these third parties, we may disclose personal data where required by law or a valid legal request, to enforce our terms, or to protect the rights, safety, and security of Bikepackia, our users, or the public.

International transfers

Some of our providers operate outside the European Economic Area, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses or an adequacy decision — to protect your data to a standard equivalent to that required within the EEA.

Cookies & tracking

We use cookies and similar technologies to operate the Service, remember your session, measure usage, and measure how well our advertising works. Essential cookies are always active because the Service cannot function without them. Every other cookie is set only after you opt in through our consent banner, powered by Cookiebot, and the banner asks separately for each purpose: Statistics covers Google Analytics, loaded through Google Tag Manager, and Marketing covers our own advertising-attribution cookie described below. Accepting one does not accept the other.

You can change or withdraw your consent at any time through the cookie settings on the banner. Withdrawing Marketing consent deletes the advertising-attribution cookie from your device.

Under the Marketing category we set the following first-party cookie:

• bikepackia_attr — records which ad or campaign referred you (including the Google Ads click identifier “gclid” and the campaign source, medium and name), so we can measure advertising effectiveness. First-party; stored for up to 90 days. It is set only if you have granted Marketing consent AND you arrive from a link carrying campaign parameters — neither on its own is enough — and it is deleted if you later withdraw that consent. If you create an account while it is set, the information it holds is saved to your account (see “Acquisition and referral data”) and the Google Ads click identifier is shared with Google to measure ad conversions (see “Google Ads” under Third parties & processors). You can also remove it at any time by clearing cookies in your browser.

Your rights

Subject to applicable law, and in particular the GDPR, you have the right to:

• Access (Art. 15 GDPR) — request a copy of the personal data we hold about you and information about how we process it.
• Rectification (Art. 16 GDPR) — ask us to correct inaccurate or incomplete data.
• Erasure (Art. 17 GDPR) — ask us to delete your data (the “right to be forgotten”). Account deletion is currently handled on request by email and completed within 30 days; it also removes the acquisition and referral data linked to your account.
• Restriction (Art. 18 GDPR) — ask us to restrict processing under certain conditions.
• Portability (Art. 20 GDPR) — receive your data in a structured, commonly used, machine-readable format.
• Object (Art. 21 GDPR) — object to certain processing, including direct marketing.
• Withdraw consent (Art. 7(3) GDPR) — for processing based on consent, such as analytics, at any time and without affecting prior lawful processing.
• Complain (Art. 77 GDPR) — lodge a complaint with your local data protection supervisory authority (in France, the CNIL).

Exercising your rights

To exercise any of these rights, contact us at contact@bikepackia.com. We will respond within the timeframes set by applicable law. To protect your data, we may need to verify your identity before acting on a request.

Data retention

We keep personal data only as long as needed for the purposes described here: account and route data for as long as your account is active, and after that for a limited period to meet legal, accounting, and security obligations. Generated trips held in temporary storage are short-lived and may be cleared when our systems restart. You can ask us to delete your data at any time, subject to any retention we are legally required to keep.

Acquisition and referral data (see “Data we collect and process”) is kept for at most 25 months from your first visit, and is deleted when you delete your account (see “Your rights”), if that is sooner.

Children's privacy

The Service is not directed at children, and we do not knowingly collect personal data from anyone under the age required to consent in their jurisdiction. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Please review it periodically.

Contact

Questions about this policy or your personal data? Email us at contact@bikepackia.com.