Privacy Policy

Last updated: 29 September 2026

Introduction

This Privacy Policy explains how Kandy Apps Ltd collects, uses, stores, and protects personal information within the PeloVelo cycling club application (the “App”).

The App is designed to help cycling clubs organise rides and enable members to participate in club activities. The App does not manage club membership on a club's behalf — for example, it does not handle membership fees, formal membership registration, or renewals. Its role is limited to supporting the practical organisation of rides and related club activities, and to recording the information needed for that purpose, such as who is affiliated with a club for the purpose of ride participation.

Kandy Apps Ltd is committed to protecting your privacy and handling your personal information transparently and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller for the App is:

Kandy Apps Ltd
26 Park Rd, Bath, BA1 3EE, United Kingdom
Registered in England and Wales, Company No. 15180525

If you have any questions regarding this Privacy Policy or your personal information, you may contact us by email at info@pelovelo.app.

2. Information We Collect

The App may collect and process the following information:

Account Information

When you create an account using Firebase Authentication:

• Unique account identifier (Firebase UID)
• Email address (stored and managed by Firebase Authentication)
• Authentication status

The App itself does not expose member email addresses to other users.

Profile Information

Depending on the information you choose to provide:

• Display name
• Call sign or nickname
• Profile image
• Contact telephone number — used to identify you to other members when you act as a ride leader (see “Visibility of Your Information” below)
• Month and year of birth
• Gender
• Club membership status
• Administrative or leadership roles within clubs

Your month and year of birth and gender are only accessible to club administrators of a club you belong to. Your contact telephone number (other than when you are acting as a ride leader) is only accessible to club administrators and active ride leaders of a club you belong to. This information is used only for the purposes described in this Policy — it is not shown to other ordinary members.

Emergency Contact Information

The App stores the name and telephone number of an emergency contact, for use if you require assistance during a ride. This is personal information about a third party rather than about you — please make sure that person is aware their details have been provided, and is comfortable with this. This information is visible only to club administrators and ride leaders of a club you belong to.

Ride and Club Activity

The App may store:

• Club memberships
• Ride participation history
• Ride attendance
• Ride creation or organisation records
• Route and meeting information
• Join and leave dates
• Your live location during a ride, if you choose to enable ride tracking
• A “privacy zone” setting you may configure to mask a chosen area, such as around your home, from being shown on tracked or shared routes

Third-Party Route and Activity Services

If you choose to connect a third-party service such as Strava or RideWithGPS, the App stores an access token that allows it to exchange ride and route data with that service on your behalf. You can disconnect this at any time within the App.

Technical Information

The App and its providers may collect limited technical information required for operation and security, such as:

• Device identifiers
• Crash reports
• Log information
• Authentication events

Crash reports and diagnostic logs are collected using Firebase Crashlytics. They include details of the error, your device model and operating system version, and the version of the App you are using. They may also be linked to your account identifier (Firebase UID) so that we can investigate problems affecting your use of the App. Crash reports do not include your email address, telephone number, or location.

Place Search

When you search for a place or address in the App, for example to set a meeting point or cafe stop, the text you type is sent to Google Maps Platform (Places) to return matching results.

3. How We Use Your Information

We use your information to:

• Provide and operate the App
• Authenticate users
• Organise and support club rides and activities
• Record your affiliation with a club for the purposes of ride participation and club administration features
• Display ride participation and club activities
• Enable club administration features for those with an administrative or ride-leader role
• Track your location during a ride, where you choose to enable this
• Contact an emergency contact you have provided, in the event of an emergency during a ride
• Diagnose and fix crashes and other technical problems
• Improve reliability, performance, and security
• Respond to support requests
• Comply with legal obligations

We only collect and process information necessary for the operation of the App. The App does not manage club membership itself, such as membership fees or formal registration — this remains the responsibility of each club.

4. Legal Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

Contract

Processing is necessary to provide the services and features of the App.

Legitimate Interests

Processing is necessary to operate cycling club functionality, organise rides, maintain ride history, diagnose and fix crashes and technical faults, and ensure the security and integrity of the platform.

Vital Interests

Where you provide an emergency contact, processing that information is necessary to protect your vital interests — that is, your life, health, or safety — in the event of an emergency during a ride.

Consent

Where consent is required, such as for optional profile information, live location tracking, or certain notifications, you may withdraw consent at any time.

5. Visibility of Your Information

Your information is only visible within the context of the clubs you join.

Ordinary members will not be shown other members’ email addresses.

If you are acting as a ride leader, your contact telephone number is visible to other members joining that ride, so they can reach you.

Your month and year of birth and gender are only visible to club administrators of a club you belong to. Your emergency contact details are only visible to club administrators and ride leaders of a club you belong to. Neither is shown to other ordinary members.

If you choose to enable live location tracking, your location during a ride is shared only with other participants of that ride, for the duration of the ride.

Certain information may remain visible in historic ride participation records where necessary to preserve ride history and club activity records.

Club administrators and leaders may have access to additional information necessary to manage club activities.

6. Leaving a Club and Redaction

When you leave a club:

• Your membership of that club is removed.
• You will no longer be able to join rides for that club.

You may also choose to anonymise your historic participation records.

If you still belong to other clubs:

• Your account will remain active.
• Your information may continue to be visible within those other clubs.

If you leave your final club membership and request anonymisation:

• Your profile information may be redacted or anonymised within the App.
• Identifiable information such as your display name, profile image, call sign, date of birth, gender, and emergency contact details may be removed from historic records.
• Non-identifiable ride statistics or historical activity records may be retained.

This approach helps preserve ride history and platform integrity while reducing the amount of personally identifiable information retained.

7. Data Retention

We retain personal information only for as long as necessary to:

• Operate the App
• Maintain ride and club records
• Meet legal obligations
• Resolve disputes
• Protect against misuse or fraud

Crash reports and diagnostic logs are retained by Firebase Crashlytics for up to 90 days, after which they are automatically deleted.

Where accounts are anonymised or deleted, identifiable information will be removed or minimised where reasonably practicable.

8. Third-Party Services

The App uses the following services provided by Google to operate on our behalf. Google acts as our data processor under its data processing terms, and processes your information only on our instructions:

• Firebase Authentication
• Firebase Cloud Storage
• Firebase Firestore
• Firebase Crashlytics (crash reporting)
• Google Maps Platform (place search)

If you choose to connect your account to Strava and/or RideWithGPS to import or export ride and route data, information exchanged with those services is handled by them in accordance with their own terms and privacy policies.

International Transfers

Some of these providers may process your information outside the United Kingdom, including in the United States. Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK–US data bridge or the UK International Data Transfer Addendum to standard contractual clauses.

9. Data Security

We take reasonable technical and organisational measures to protect your information against:

• Unauthorised access
• Loss
• Misuse
• Disclosure
• Alteration
• Destruction

However, no online service can guarantee absolute security.

10. Your Rights

Under UK GDPR, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion or anonymisation
• Restrict processing
• Object to certain processing
• Request a copy of your information
• Withdraw consent where applicable

Requests may be submitted by email to info@pelovelo.app, or via our account deletion request page.

If you are unhappy with how we have handled your personal information, you have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint. We would appreciate the chance to address your concerns first, so please contact us before approaching the ICO.

11. Children

The App is not intended for children under the age of 13 without appropriate parental or club supervision.

12. Changes to This Policy

We may update this Privacy Policy from time to time.

Significant changes may be communicated within the App.

The latest version will always be available at this page and within the App.

13. Contact

If you have questions regarding this Privacy Policy or your personal data, please contact Kandy Apps Ltd by email at info@pelovelo.app.