Privacy
policy

An account is required. You sign in with Apple (on iPhone) or with Google. Firebase Authentication stores an account identifier and the email address and name that service shares with us (Apple lets you hide your email behind a private relay address). Accounts created before version 1.1.0 signed up with a phone number verified by SMS; that number stays on the account, and those riders can add Apple or Google in Settings → Account to keep signing in. Firebase may use platform integrity checks or reCAPTCHA during authentication. Your email address is never shown to other riders.

Firebase also processes IP addresses, app and SDK versions, installation and device identifiers, and app/device integrity information to operate the service, verify sign-ins, prevent abuse and deliver notifications. These services use encrypted connections. Boring Ride does not include an advertising SDK or use an advertising identifier.

Your profile includes your name, gender answer and birth year. A helmet avatar, bike details, registration plate and emergency contact are optional, and so is a profile photo, described under Notifications, photos and external services below. Profile, bikes, active-bike choice, units, appearance and app-update notification preferences are stored locally and backed up privately in Firebase Firestore under your account. They are restored when you sign in on another device. Other riders cannot read your private account document or saved rides; what they see is your rider profile, described under Optional social features below.

During a ride, the app records GPS coordinates, timestamps, reported accuracy, optional speed and altitude, and whether the OS flagged a mock location. The mock-location flag excludes that ride from public ranking; it is not proof that other GPS data is authentic. These produce the route, distance, moving time and elevation. Location access may continue while the screen is locked so a ride can be recorded. Recording ends when you end the ride; interrupted recordings can be resumed from the last saved points.

Finished rides, their statistics, bike attribution and recorded events are backed up to your private Firestore account. Cloud routes are simplified to at most 500 points and coordinates are rounded to five decimal places. A restored ride therefore has a simplified route; the recording phone retains the original saved points. Backup requires a connection and may be delayed or fail.

On iPhone, a ride in progress also appears as a Live Activity on the lock screen and in the Dynamic Island: distance, ride time, current speed, a GPS signal warning and, on a group ride, the group's name and how many riders are online. It is drawn on the phone from the ride being recorded, and nothing in it leaves the phone. Because the lock screen is visible without unlocking, anyone who can see the phone can read those ride figures and the group name. Its SOS button only opens the app; the SOS still has to be held there. The activity ends with the ride. You can turn it off in iOS Settings → Boring Ride → Live Activities.

The leaderboard is automatic. Any rider with a synced display name and qualifying rides in the current month appears on it, and other signed-in riders can see that rider's display name, profile photo when one is set, monthly riding distance and qualifying ride count. It does not expose phone numbers, account identifiers, routes, locations, bike details or emergency contacts. Your synced profile name and current profile photo are used; later changes to either also appear. You can hide yourself at any time in Profile → Privacy by turning off "Show me on the leaderboard"; a hidden rider can still browse the board.

The server calculates distance from eligible uploaded rides ending in the current UTC calendar month. Your visibility choice is stored with your account and applies across months and devices until you change it. Hiding requires a connection and removes your entry when the server confirms. A finished-ride deletion reduces your total after cloud sync. Account deletion removes the entry as soon as the server accepts the request. Signing out alone does not hide you. Another rider may retain a previously viewed result until refreshing, or may have taken a screenshot.

Connecting with a code shares your display name and online presence with other members. Quick alerts and an SOS are stored in the group's Realtime Database channel. An SOS includes a fix only when it is at most 30 seconds old and has reported accuracy of 25 metres or better. Its timestamp and accuracy accompany the coordinates; otherwise the SOS states that location is unavailable. Server acceptance does not guarantee delivery or assistance. An SOS expires after 10 minutes or can be resolved by its sender. Temporary delivery records contain event IDs, retry state and hashed token receipts; scheduled cleanup removes them after expiry. They do not duplicate route coordinates. An SOS push contains the sender's name and group identifiers, not coordinates. Device registration tokens are stored privately so the server can address group pushes.

Live location sharing in a group is off by default and chosen per ride. When you turn on "Share my live location" on the Ride Together screen, your position is sent to the other riders in that connected group only and drawn as a coloured dot on their maps, refreshed roughly every few seconds while you ride. It is not stored as history and is not shown to anyone outside the group. It stops the moment you turn the toggle off, disconnect or end the ride, and a position older than sixty seconds is dropped rather than shown. A rider who never turns it on shares no location with the group. Sharing beyond the group is a separate choice, described under Live location sharing (Journeys) below.

Group channels are removed after extended inactivity or their maximum age by a scheduled cleanup. The current limits are 30 minutes of inactivity or 24 hours from creation, checked in bounded batches every 15 minutes. A backlog can require more than one scheduled pass. Codes expire after 12 hours. Network or service failures can delay cleanup.

Firebase Cloud Messaging delivers app updates and group notifications. App updates can be disabled in Profile → Notifications. Group SOS uses a separate path; delivery still depends on OS permission, connectivity and platform setup. Messages received while the app is open, and a notification used to launch a closed app, are saved in its local inbox. The inbox is not a complete server-side notification archive and does not restore onto another device.

The app uses photos in two separate ways. A share-card photo is accessed only when you select one for a share card; it stays on the phone and is never uploaded to the app's account backend. A card you choose to share leaves the app through the system share sheet. By default, cards show only one continuous route section outside 500-metre areas around the original start and end, including any mid-ride returns to those areas. Short routes with no safe section show no route. This reduces location exposure but does not make a shared card anonymous. You can turn this protection off. Plates are excluded from cards.

A profile photo is optional and is the only image the app uploads. When you choose one from your photo library or camera, the phone crops it square, shrinks it to 512 pixels and compresses it to a WebP file of roughly 20–40 KB, removing all embedded metadata, including location, before upload. The file is uploaded to Firebase Storage (Google Cloud, region asia-south1) under your account. A server function re-encodes it, makes a 128-pixel copy and checks it automatically with Google Cloud Vision SafeSearch; adult, violent or similar images are rejected and never shown. An accepted photo is served from a public, unguessable address and appears wherever your name appears: to followers, in chat, on the roster of a connected group, on your rider profile and in search, in Journeys and the live viewer, on the public /live/<username> page while a journey is public, and on the monthly leaderboard. Replacing the photo deletes the previous files; removing it, or deleting your account, deletes all of them. The files are served with a one-year cache header, so browsers and other riders' phones may keep a cached copy for up to a year after removal, which cannot be recalled. Riders can report a profile, and we can remove a photo.

Maps request tiles from OpenStreetMap's tile service. Journey labels use the platform geocoder with trimmed route endpoints. These services receive the requests needed to return their maps or place names. The app does not request address-book or call-log access. The microphone is requested only for the group intercom, described below. The emergency-contact action opens the dialler; it does not place a call automatically.

The intercom (hold to talk) sends your voice live to the riders in your connected group. It is available only while you are recording a ride and connected to a group. While you are connected to a group during a recording ride, the microphone stays open but muted so that talking can start instantly; nothing is transmitted until you hold to talk and hold the group's talk floor, and transmission stops when you let go. The microphone closes when you leave the group or end the ride; it is never open on a solo ride. Android shows the system microphone indicator for as long as it is open. You may decline the microphone and still hear the group.

Audio is carried over WebRTC through Cloudflare's Realtime SFU, which relays it between phones in real time. Neither the app nor Cloudflare records or stores the audio, and no transcript is made. Cloudflare processes connection metadata (IP address, session identifiers, timing) to relay the media. Our server exchanges connection descriptions with Cloudflare on your behalf and stores, in the group's Realtime Database channel, the identifier of your voice session so other members' phones can subscribe to it; this record is removed when you leave voice, leave the group, or delete your account. Only the rider holding the talk floor is played by other phones. A mute control silences incoming voice without leaving the channel. Voice depends on connectivity and is not a safety channel; use SOS for emergencies.

Local data is separated by account. Signing out hides your profile, bikes, history, preferences and inbox from the next person who signs in. Your private cache and unsynced work remain on the phone for when you return to the same account. The one exception is the copies of other riders' public profiles you opened (what their profile page shows) and the last leaderboard you saw, kept so they open instantly: those are deleted from the phone as soon as you sign out or switch account, and a profile that has since been hidden from you or blocked you is removed the next time you open it. Uninstalling removes the app's local data according to the platform's storage behavior; it does not delete your cloud account. Android backup and device-transfer rules exclude app-private data. On iOS the application Documents directory containing account databases is excluded from OS backup. The app uses its explicit Firestore backup for account restoration.

Delete an individual finished ride from its detail screen. The phone removes its route and events immediately and queues cloud deletion when offline. Other devices apply the deletion when they next sync. A deletion marker containing the ride identifier is retained to prevent an old device from uploading it again.

Delete your account in Profile → Account and backup, or at Delete account. You must first confirm it is you with Apple, Google or your phone number, whichever the account uses; for an account that uses Sign in with Apple, the app also revokes its Apple sign-in token. A confirmed request also removes your rider profile, all profile photo files, follows in both directions, invitations, nearby entry, published highlights, direct conversations involving your account and messages you authored in group chats. A confirmed request removes your profile, bikes, preferences, saved rides, device registrations, Firebase Auth account and your private presence, location, SOS and receipt entries in active groups. The app also clears this account's local database. Other devices clear their account cache after they next connect and learn of the deletion. Offline or already signed-out devices may retain a private cache until their app data is cleared.

Deletion is retried if a backend step fails. A minimal account-deletion marker (account identifier, request/completion timestamps and status) is retained to block stale credentials and track cleanup. Events already saved in another rider's private ride history, or cards shared outside the app, are not removed from their copies by your deletion request. Copies of a removed profile photo cached by browsers or other riders' phones expire on their own within a year and cannot be recalled. Contact us about retained legacy local data whose owner cannot be established or other deletion/access requests.

Every rider has a rider profile, separate from the private account profile. It shows your display name, your profile photo when you have set one, your bio, bike and interests, your city if you choose to show it, and your follower and following counts. When your account is created, your name and the make and model of your active bike are copied into it; you can edit them, hide the bike and add a bio or city at any time. Your rider profile is visible to signed-in riders and searchable by name by default. Turn on “Hide me from search” to leave search and suggestions; a hidden profile can still be opened by riders who follow you and by riders you follow. Any signed-in rider can follow you without approval. Followers can see your live position only on rides where you choose the Followers rung, described under Live location sharing (Journeys) below. You can see who follows you and remove any follower at any time, which ends their access to Followers sharing immediately. Follows, blocks, invitations and messages are stored in Firestore. Direct chat and ride invitations are open only between two riders who follow each other, and group chat requires current group membership. There are no friend requests: following is the only connection between riders. Messages use encrypted transport but are not end-to-end encrypted. Reports and their reasons are accessible to authorized administrators for moderation. Blocking stops direct chat, search, suggestions, profile viewing and following in both directions between the two accounts and removes any follow between them; messages from blocked riders are filtered from group chat on refresh.

You also choose a username when you set up your rider profile: 3 to 20 lowercase letters, numbers, underscores or dots. Your username is public. It is shown beside your name wherever riders are listed (search and suggestions, your rider profile, followers and following, chat, invitations and blocked riders, Nearby, chat, Journeys and the live viewer), riders can find you by it unless you hide from search, and it is the address of your public page. You cannot change it yourself. We may rename a username to resolve a conflict, impersonation or abuse; each rename is recorded, and the old name is held unused for 30 days so an old link does not open someone else's page. A copy is kept in your account backup so it restores on a new phone. Deleting your account frees your username immediately, after which another rider may choose it.

Nearby discovery requires a separate opt-in during a recording ride. Coordinates are rounded to a 0.02-degree grid before being published to signed-in riders. Visibility consent lasts up to 30 minutes, and each location update is visible for no more than two minutes. Ending a ride or choosing Hide me requests removal immediately. Offline or interrupted sessions disappear after the two-minute server lease; previously viewed information or screenshots cannot be recalled. No complete route, speed, plate or emergency details are published through Nearby. App integrity checks do not prove that a reported GPS position is authentic.

Public highlight links are accessible to anyone with the link. They show your chosen title and public name, distance, moving time and rider count, without a route or live location. Unpublishing, turning off your public profile or Hide me from search, or deleting the source ride disables access on the server. Copies already saved or shared by others cannot be recalled. Messages and social records remain until account deletion or administrative removal; location leases control visibility, not guaranteed physical deletion time.

Separately from groups, you can broadcast a ride to an audience of your choice. The ride screen offers Off (the default), Followers or Public, chosen per ride; the one-tap “Share live” button chooses Public. While sharing, your positions are written to your own buffer in Firebase Realtime Database. No other client can read that buffer; positions reach viewers only through a server function that checks the audience on every request. Followers see live positions in the app only when you pick Followers; anyone signed in can follow you without approval, and removing a follower or blocking them ends their access at once. Public positions are delayed by at least 1 minute (1 minute for the one-tap link; 1 to 15 minutes, as you choose, inside a journey), and when the home-area option is on, nothing within 500 metres of your home area is ever shown; the home point itself never leaves the server. The raw buffer is deleted when the share ends.

A journey is a trip you create with a title. Its title, dates, totals and the simplified routes of rides you add to it are stored in Firestore under your account. While a journey is public, a page at this website's /live/<username> shows your public name, bio, the journey's title and totals, and the delayed route; anyone can read it, including without an account, and riders who are public right now can also be listed on the website's home page. Turning the dial to Off ends the broadcast, and ending the journey or deleting your account removes it from the page. We can revoke public access or stop a broadcast for abuse. Copies, screenshots or recordings already made by others cannot be recalled.

Release builds use Firebase Crashlytics for crash reports and selected failure reports, such as a failed ride save. These include stack frames, app/OS and device information, timestamps and SDK installation identifiers. App-written Dart failure reports use fixed operation codes; they do not attach the original exception text, rider UID, name, phone number, tokens or route coordinates. Native crash diagnostics are also processed by the SDK. These reports support reliability, not behavioral analytics. Diagnostic records are managed separately from account backup; the app does not associate them with your account UID.

Firebase App Check uses Play Integrity on Android and App Attest with DeviceCheck fallback on Apple devices to help reject unauthorized backend requests. These providers process app/device integrity information. They do not verify that a recorded journey actually happened, and no additional GPS samples are requested for this check. Contact us for questions about diagnostic data or retention.

Data supports authentication, ride recording, account restoration, connected ride features, the leaderboard, optional live sharing and journeys, and messages from the app. This code does not implement ads, behavioral analytics, payments or sale of rider data. Firebase and the map/geocoding providers process requests necessary for these features. For access, correction or deletion questions, email theboringteamone@gmail.com.