Rydr – Privacy Policy

Version 1.1 · Updated: 6 October 2026

1. Controller and contact

CAPYBARA Cycling GmbH, Altenbachstrasse 17E, 8832 Wollerau, Switzerland, is responsible for the processing described here. Send privacy enquiries to admin@rydr.site.

This policy covers the Rydr app and the corresponding account, contact and platform functions on www.rydr.site. Organisations may also be independently responsible for their own membership, employment and event data. Their notices supplement this policy.

2. The data we process and why

We receive data from you, authorised family or organisation administrators and the services used for the function you choose:

• Account and profile: name, email, any optional contact details, profile picture, account and sign-in identifiers, language, settings and verification status. We use these for sign-in, communication, account management and abuse prevention.
• Carpools: groups and memberships, friendships and preferred drivers, vehicles and seats, events, attendance responses, starting points, destinations and pickup locations, coordinates, times, assignments and ride status. These enable us to create and update plans, inform participants and maintain ride statistics.
• Content and communication: chat messages, group pictures, selected chat backgrounds, invitations, support enquiries and reports. We process them for communication, support and investigation of abuse.
• Family and organisations: children's names and profile links, parent roles, activities and their locations, organisational assignments and invitations. These enable the family or event planning that each user is authorised to carry out.
• Purchases and operations: product and transaction identifiers, subscription duration and status, the associated Rydr account, push device tokens and technical connection, error and security data. This may include IP address, time, device/software details and requested resources. Rydr does not receive complete payment card details for Apple purchases.

We may be unable to provide a function without the information it requires. Optional pictures, optional location sharing and marketing choices are not prerequisites for all other functions.

Registration record: For new accounts, we store the accepted terms version, displayed language and notice version, registration method (email, Apple or Google), the time reported by the device and the server receipt time with the account. This documents contract formation, not advertising or tracking. A technical retry does not constitute a new acceptance. The record is not visible to other users and is deleted with the account; backups follow the retention periods described below.

3. Who can see data within Rydr

Your name and profile picture may be shown to other users according to your search visibility, connections and group membership. Searching for a profile does not, by itself, disclose private account details or saved home locations. A home address used as a pickup location does, however, become part of the necessary ride plan.

Drivers, assigned passengers and authorised event administrators can see the plans and pickup locations intended for their ride or planning responsibilities. Group chats are intended for authorised group members; ride chats for authorised ride participants. Sharing with other participants cannot retrospectively remove information from their memory, their own messages or records they lawfully created.

Parent accounts can see the children they manage and their activities; a linked child account receives the information shared for that child. Organisation administrators receive membership, attendance and planning information appropriate to their role. This does not give an employer general access to a separate private Rydr account.

4. Location, pictures, calendar and notifications

Device location permission and sharing a driver's live location are separate choices. Live sharing applies to an active ride and, with the relevant permission, may continue in the background. The current position is replaced, rather than collected as a continuous location trail in the live-location table. Only authorised ride participants can see it. You can stop sharing and change device permissions in iOS settings. Doing so does not delete locations previously supplied for planning.

If you enable automatic location sharing, it can start again on later active rides until you turn that setting off.

We receive pictures after you select them through the photo or file picker. The app does not read your entire address book. Friendships within Rydr nevertheless form a stored social graph. Calendar export requests write access and adds the selected event or ride to your calendar; it does not read existing calendar entries for this purpose.

Push notifications use a device token associated with your account. Depending on the notification and device settings, names, message text or ride details may appear on the lock screen. Adjust previews and notifications in iOS as needed.

5. Service providers and processing abroad

Hosting in Zurich does not mean that all data stays in Switzerland. International services and their supporting providers may process data, particularly in the United States and other countries identified in their service information. See Google/Firebase, Apple and Resend.

swisstopo is a Swiss federal agency; Photon is operated by komoot, based in Germany. Supabase identifies the United States and Singapore in particular as possible processing countries. This does not establish the storage region of Rydr’s previous project. jsDelivr uses an internationally distributed delivery network.

Published Google/Firebase terms provide for the Swiss-U.S. Data Privacy Framework for covered US recipients, with Standard Contractual Clauses as a fallback. Resend’s processing terms provide for Standard Contractual Clauses adapted for Switzerland. Ask our privacy contact about the safeguards applicable to a particular disclosure.

Service providers also process necessary operational data for security and technical analysis. Google Sign-In, in particular, declares technical analytics data. The Rydr app's current functions do not use advertising tracking SDKs, and Rydr does not sell personal data for third-party advertising.

6. Retention and deletion

We process data for as long as necessary for the stated purpose, legal obligations or the protection of legitimate claims. Different processes apply:

• Account: deletion in the app removes personal data from the active account records and initiates cleanup in Firebase and the media service. External cleanup may follow later. Firebase states up to 180 days after a deletion instruction for authentication data, including backups. Shared groups may be transferred to another responsible person. A limited identifier prevents an old sign-in from recreating a deleted account; a selected deletion reason is stored without an account link.
• Ordinary events: events, their plans and chats are cleaned up after the event and any outstanding return ride have ended. Active rides are not deleted while underway. Account-linked ride statistics may remain; the statistical records do not contain route addresses or event names.
• Corporate: completed Corporate events are archived as history. They do not follow the automatic deletion process for ordinary events. Further retention and deletion depend on the organisation's purpose, the agreement and legal requirements. Rights requests may be sent to us and to the relevant organisation.
• Live location: sharing ends after no more than twelve hours. Ending the ride or withdrawing sharing removes the live position; expired sharing sessions are cleaned up. Old position values are not displayed as a current location.
• Technical working data: change records and completed background jobs are cleaned up after seven days; technical command records used to safely retry API operations after 60 days.
• Backups and logs: the database retains seven automatic backups. This is a number of backups, not a guaranteed seven-calendar-day period. Additional manual operational and migration backups exist in the EU multi-region. They are not automatically covered by the seven-backup limit and must be deleted separately when their purpose ends. Database recovery logs are retained for seven days. Deleted media files remain recoverable under the storage service's protected recovery feature for another seven days. The default log store is set to 30 days; the cloud service's locked mandatory administrative log store to 400 days. The latter is not a general retention period for chats, rides or profiles.

Backups have separate access restrictions and are removed through their retention and replacement processes. Deletion from the active system does not immediately remove every older backup. Any necessary recovery must take previous deletions into account.

During the move from Supabase to Google, earlier data was retained as a fallback. The website still includes transitional sign-in for older accounts: where sign-in or account migration requires it, credentials may be checked with the previous Supabase service and profile and organisation data transferred to the new system. Any remaining legacy data and migration copies must be considered when handling deletion requests. This policy does not confirm that this data has already been deleted.

7. Website, cookies and email

Loading a website requires technical connection data for delivery and security. The current website does not use active analytics or advertising trackers; necessary technical logs kept by integrated services are distinct from such tracking. If you contact us, we process your message and contact details to respond. The relevant sections of this policy apply to account or organisation functions offered through the website.

The website uses necessary browser storage for sign-in and your privacy choices. Your saved choice about optional storage remains valid for 180 days; this does not mean that every browser entry is automatically deleted afterwards. Optional language preferences are stored only with your consent. You can change or withdraw that consent through “Cookie settings”; the optional language preference is then removed.

When signing in, you can choose whether to stay signed in on that device. With this option, your sign-in state is stored locally beyond the browser session; otherwise it is session-based. Sign out after using a shared device.

A website visit, event invitation or Rydr account is not, by itself, consent to a newsletter. You can object to marketing emails at admin@rydr.site. Necessary account and security communications are distinct from marketing.

8. Grounds for processing and planning

We comply with Swiss data protection law. Where the EU General Data Protection Regulation applies, we rely on Article 6(1)(b) for necessary contractual services, (c) for legal obligations, (f) for proportionate security and operational interests and (a) for optional processing that requires consent. Consent can be withdrawn for the future.

Automatic ride planning uses attendance, locations, available seats and planning settings. Its assignments are organisational suggestions, not legally binding decisions about whether a ride is permitted or will take place. Contact the relevant organiser or our support team with questions or requests for changes.

9. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection and, where applicable, receipt or portability of your data. Legal exceptions and other people's rights may limit their scope. We may request the identity evidence needed to match a request securely to the right person. An active subscription is not required for privacy requests.

Contact admin@rydr.site. In Switzerland, you may contact the Federal Data Protection and Information Commissioner and, where applicable, your competent foreign supervisory authority.

10. Security and changes

Our measures include encrypted app connections, role-based access and protected storage. Local offline app data is encrypted separately for each account. Chats are not designed as an end-to-end encrypted service. No technical system can guarantee absolute security.

We update this policy and provide appropriate notice of significant changes. The date above identifies the current version. Publishing a new version does not replace any new consent that is required.