Privacy Policy

Introduction and organizational info

Bikepackia ("Bikepackia", "we", "us", "our") is an experimental, pre-commercial AI-assisted bikepacking route planner available at bikepackia.com and as the Bikepackia mobile app for iOS and Android. The project is currently run by an individual operator and is not yet an incorporated company; that operator is the data controller responsible for the personal data described in this policy.

Controller: Masoud Ahmadi, an individual based in France, operating under the name "Bikepackia". You can reach us about privacy or any data request at contact@bikepackia.com.

We have not appointed a Data Protection Officer (our scale does not require one), but we take your privacy seriously and aim to respond to any request promptly. We process personal data only for the purposes set out below — providing and improving the Service, supporting users, and meeting our legal and billing obligations — and we apply security measures designed to protect it.

Scope and application

This policy protects the personal data of everyone who interacts with Bikepackia — visitors who simply browse bikepackia.com, people who use the Bikepackia mobile app on iOS or Android, registered users who create an account, and customers who purchase credits or a plan. It applies to both the website and the mobile app, and explains what we collect, why, who we share it with, and the rights you can exercise.

Data we collect and process

Depending on how you use the Service, we collect and process the following categories of personal data:

• Identity and account data — when you create an account, our identity provider Clerk processes your email address and name on our behalf. Anonymous use is possible without an account, in which case no account data is collected.
• Route data — the trip briefs you write and the routes generated for you, including start and finish points, waypoints, coordinates, and any notes you enter or that the planner produces.
• Device location (mobile app only) — with your permission, the mobile app reads your device's precise location to show where you are on the route map while you use it. This is processed on your device only: we do not track your location in the background, and we do not send it to or store it on our servers.
• Push notification token (mobile app only) — if you allow notifications, the app registers a device push token and stores it on our backend, linked to your account, so we can send you trip and service notifications. It is not your location and cannot read anything on your device; you can turn notifications off at any time in your device settings.
• Payment data — when you buy credits or a plan, our payment provider Stripe collects and processes your payment details. We never receive or store your full card number.
• Usage and analytics data — only if you consent, we use Google Analytics (loaded via Google Tag Manager) to understand how the Service is used. This may include pages viewed, interactions, device and browser type, and IP-derived approximate location. Analytics does not run until you opt in through our Cookiebot consent banner.
• Technical and session data — basic technical information such as IP address, device and browser type, and session cookies needed to operate, secure, and debug the Service.

What we do not collect

We only process data that is necessary to provide the Service, meet a legal obligation, or — with your consent — improve the Service. We do not collect special-category (sensitive) data, government identifiers such as passport or social-security numbers, or dates of birth. We do not track your location in the background or build a location history. In the mobile app, precise device location is read only while you use the map and only with your permission, solely to show your position — it is not transmitted to or stored by us. The only location data we store is the route points you choose to enter and the approximate, IP-derived location used by analytics when you have consented to it.

Mobile app permissions

The Bikepackia mobile app asks for two optional device permissions. Both stay off until you grant them, and you can revoke either at any time in your device's system settings — the app keeps working without them, with only the related feature disabled.

• Location (while using the app) — used only to show your current position on the route map. The app does not access your location in the background and does not store or transmit it.
• Notifications — used to send trip reminders and service updates. Declining simply means you will not receive push notifications.

How we use your data

We use your personal data to:

• Provide the Service — generate routes, save them to your account, and export GPX files.
• Show your position on the route map in the mobile app, when you grant location permission.
• Send trip and service notifications to your device in the mobile app, when you allow notifications.
• Authenticate you and keep your account, credit wallet, and preferences secure.
• Process payments and prevent fraud.
• Operate, secure, and debug the Service and prevent abuse.
• Understand and improve how the Service is used (only with your analytics consent).
• Communicate with you about service-related matters and respond to your requests.
• Meet legal, accounting, and tax obligations.

Legal bases for processing

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you ask for, including accounts, route generation, and billing.
• Consent — for non-essential cookies and analytics. You can withdraw consent at any time via the cookie settings.
• Legitimate interests — to secure the Service, prevent abuse and fraud, and improve our product, balanced against your rights.
• Legal obligation — where we must keep records, for example for tax or accounting.

Data storage and protection

Your data is processed and stored on infrastructure operated by reputable hosting and storage providers located in the European Union and the United States (see “Third parties & processors” below). We select providers that maintain strong, industry-standard security and that commit to appropriate data-protection safeguards.

We apply technical and organisational measures including encryption in transit (HTTPS), restricted need-to-know access controls, and regular review of access permissions. No system is perfectly secure, but we work to keep your data safe and to notify you and the relevant authorities of a breach where the law requires.

Third parties & processors

We share personal data only with service providers (processors) who handle it on our behalf, under contract (Data Processing Agreements) and only as needed to run the Service. We do not sell your personal data. Our current processors are:

• Clerk (Clerk, Inc.) — authentication and account management; processes your email and name.
• Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.) — payment processing for credits and plans; processes your billing and payment details. We never store your full card number.
• BRouter and other routing providers — generate route geometry from the coordinates and waypoints you supply.
• Expo (650 Industries, Inc.) — mobile push-notification delivery; processes your device push token to relay notifications to your device.
• Apple Push Notification service (Apple Inc.) and Firebase Cloud Messaging (Google Ireland Limited) — the operating-system push transports that deliver notifications to iOS and Android devices respectively.
• Cloudflare (Cloudflare, Inc.) — content delivery, security, and R2 object storage for generated files such as GPX exports; processes technical data (e.g. IP address) and stored route files.
• Render (Render, Inc.) — hosting for the Bikepackia API.
• Vercel (Vercel, Inc.) — hosting for the Bikepackia website.
• Google Analytics (Google Ireland Limited) — usage analytics, only with your consent; may process usage, device, IP, and approximate-location data.
• Google Tag Manager (Google Ireland Limited) — tag management used to load analytics after consent.
• Cookiebot, a Usercentrics product (Usercentrics A/S) — cookie consent management; records your consent choice and processes limited technical data such as a truncated IP address.

Sharing and disclosure

Each processor above is bound by a Data Processing Agreement requiring appropriate technical and organisational safeguards, and is permitted to use your data only to provide its service to Bikepackia. Beyond these processors, we may disclose personal data where required by law or a valid legal request, to enforce our terms, or to protect the rights, safety, and security of Bikepackia, our users, or the public.

International transfers

Some of our providers operate outside the European Economic Area, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses or an adequacy decision — to protect your data to a standard equivalent to that required within the EEA.

Cookies & tracking

We use cookies and similar technologies to operate the Service, remember your session, and — only with your consent — to measure usage. Essential cookies are always active because the Service cannot function without them; analytics and other non-essential cookies run only after you opt in through our consent banner, powered by Cookiebot.

You can change or withdraw your consent at any time through the cookie settings on the banner. The live, always-current list of the cookies we use is shown at the end of this section.

We also set the following first-party cookie:

• bikepackia_attr — records which ad or campaign referred you, so we can measure advertising effectiveness. First-party and functional; set when you arrive from a campaign link, stored for 90 days, and never shared with third parties.

Your rights

Subject to applicable law, and in particular the GDPR, you have the right to:

• Access (Art. 15 GDPR) — request a copy of the personal data we hold about you and information about how we process it.
• Rectification (Art. 16 GDPR) — ask us to correct inaccurate or incomplete data.
• Erasure (Art. 17 GDPR) — ask us to delete your data (the “right to be forgotten”).
• Restriction (Art. 18 GDPR) — ask us to restrict processing under certain conditions.
• Portability (Art. 20 GDPR) — receive your data in a structured, commonly used, machine-readable format.
• Object (Art. 21 GDPR) — object to certain processing, including direct marketing.
• Withdraw consent (Art. 7(3) GDPR) — for processing based on consent, such as analytics, at any time and without affecting prior lawful processing.
• Complain (Art. 77 GDPR) — lodge a complaint with your local data protection supervisory authority (in France, the CNIL).

Exercising your rights

To exercise any of these rights, contact us at contact@bikepackia.com. We will respond within the timeframes set by applicable law. To protect your data, we may need to verify your identity before acting on a request.

Data retention

We keep personal data only as long as needed for the purposes described here: account and route data for as long as your account is active, and after that for a limited period to meet legal, accounting, and security obligations. Generated trips held in temporary storage are short-lived and may be cleared when our systems restart. You can ask us to delete your data at any time, subject to any retention we are legally required to keep.

Children's privacy

The Service is not directed at children, and we do not knowingly collect personal data from anyone under the age required to consent in their jurisdiction. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Please review it periodically.

Contact

Questions about this policy or your personal data? Email us at contact@bikepackia.com.