Privacy Policy
Last updated: 26 March 2026
1. Who We Are
Velobooker ("we", "us", "our") is a cycling tour management
platform operated by Dragan Jovanović. You can contact us at
hello [at] velobooker.com
.
2. What Data We Collect
2.1 Account Data
When you create an account or sign in via a third-party
provider, we receive:
| Provider |
Data received |
| Google |
Name, email address, profile photo |
| Apple |
Name, email address (or private relay), Apple
ID |
| RideWithGPS |
Name, email address, athlete ID |
We do not receive or store your passwords. Authentication is
handled entirely by the third-party provider via OAuth 2.0.
2.2 Tour and Route Data
-
GPX route files imported from RideWithGPS or uploaded
directly
- Tour details: name, dates, description, day plans
-
Your membership status and role within a tour (organiser or
participant)
2.3 Expense Data
-
Expense entries you create: description, date, amount,
currency
- Receipt photos you choose to attach (optional)
2.4 Media
- Photos and videos you upload to a tour gallery
-
Files are stored on our servers and accessible to other
members of the same tour
2.5 Usage Data
-
Basic server logs (IP address, request timestamps, error
logs) for operational purposes
-
Anonymous, privacy-first product analytics via PostHog (EU
cloud, Frankfurt). On this website analytics are fully
cookieless — no cookies, no local storage, and no consent
banner is needed. Visitors are counted with a daily-salted
hash instead, and IP addresses are not stored
-
In our mobile app: anonymous usage events and crash reports
(e.g. screens viewed, uncaught errors) tied to a random,
device-local identifier. We never link these to your
account, and no advertising identifiers are used
3. How We Use Your Data
| Data |
Purpose |
| Account data |
Identify you, display your name and photo to tour
members
|
| GPX and route data |
Generate daily briefings, weather forecasts,
elevation analysis
|
| Expense data |
Calculate cost settlements between tour participants
|
| Media |
Display in-tour photo/video gallery to tour members
|
| Server logs |
Diagnose errors, ensure platform security |
We do not use your data for advertising. We do not sell, rent,
or share your personal data with third parties, except as
described in Section 6.
4. Legal Basis for Processing
We process your personal data under the following legal bases
(GDPR Article 6):
| Legal basis |
Applies to |
| Contractual necessity |
Account data, tour/route data, expense data —
required to provide the service you signed up for
|
| Legitimate interest |
Server logs — necessary for platform security and
error diagnosis
|
| Consent |
RideWithGPS data — you explicitly authorise access
via OAuth
|
| Consent |
Media uploads — you choose to upload photos/videos
to a tour gallery
|
You may withdraw consent at any time by disconnecting the
relevant third-party provider in your account settings or by
contacting us. Withdrawal does not affect the lawfulness of
processing carried out before withdrawal.
5. Data Storage and Security
-
Data is stored on servers hosted on Google Cloud Platform in
the EU (europe-west region)
- Data in transit is encrypted via TLS (HTTPS)
- OAuth tokens are stored encrypted at rest
-
GPX files and media are stored in object storage (Cloudflare
R2) with access-controlled URLs
6. Data Sharing
We share data only in the following limited cases:
-
Within a tour
: your name and profile photo are visible to other members
of tours you join
-
RideWithGPS
: when you import a route or event, we make API calls on
your behalf
-
OpenMeteo
: we send GPS coordinates (from GPX waypoints) to the
OpenMeteo API to fetch weather forecasts. No personal data
is sent.
-
PostHog
: anonymous product analytics and crash reports are
processed by PostHog (PostHog EU cloud, Frankfurt, Germany —
an EU data processor operating under a data processing
agreement). Analytics events contain no account identity
and, on the website, no cookies.
-
Legal obligation
: if required by law, court order, or to protect the rights
and safety of our users
7. Data Retention
| Data type |
Retention |
| Account data |
Until you delete your account |
| Tour and route data |
Until the tour organiser deletes the tour, or you
delete your account
|
| Expense data |
Until the tour is deleted, or you delete your
account
|
| Media |
Until deleted by the uploader or tour organiser, or
account deletion
|
| Server logs |
90 days rolling |
8. Your Rights
Under GDPR, you have the right to:
-
Access
the personal data we hold about you
-
Correct
inaccurate data
-
Delete
your account and associated data
-
Export
your data in a portable format (GPX files, expense records)
-
Restrict
processing of your personal data in certain circumstances
-
Object
to processing based on legitimate interest
-
Withdraw consent
at any time for processing based on consent (e.g., a
provider connection)
-
Disconnect
third-party providers (Google, Apple, RwGPS) at any time
-
Lodge a complaint
with the Spanish Data Protection Authority (Agencia Española
de Protección de Datos —
www.aepd.es
) or your local EU supervisory authority
To exercise any of these rights, contact us at
hello [at] velobooker.com
. We will respond within 30 days.
9. Children
Velobooker is not directed at children under the age of 13. We
do not knowingly collect personal data from children under 13.
If you believe a child has provided us with personal data,
please contact us and we will delete it.
10. Changes to This Policy
We may update this policy from time to time. We will notify
users of material changes by posting a notice in the app or by
email. The "Last updated" date at the top of this page reflects
the most recent revision.
11. Contact
For any privacy-related questions or requests:
Email:
hello [at] velobooker.com
Website:
velobooker.com