Privacy Notice
Who is responsible
Adrian Clark, trading as RideSet, is responsible for the personal information used to provide RideSet. Contact ridesetdev@gmail.com with a privacy question or rights request.
RideSet's intended audience is adults aged 18 or over in the United Kingdom, United States, Australia and New Zealand. Contact us if you believe somebody under 18 has provided personal information.
Information RideSet uses
Depending on the features you use, information can include:
- Account details, email, display name, identifiers and sign-in information.
- Preferences such as residence country, time zone, units and appearance.
- Bike and component details, suspension settings, usage, schedules and service history.
- Notes, serial or registration details, purchase information, receipts and images you choose to provide.
- Optional Strava connection details, bike matches and activity summaries used to review or count rides.
- Bike identification fields, AI suggestions and operational lookup records such as time, outcome and recorded provider cost.
- Support messages, feedback and technical or security information needed to operate the service.
Use bicycle identification fields for bike information and avoid putting unnecessary personal information into them.
Why information is used
RideSet uses information to provide accounts and requested features, keep records and reminders, maintain security, recover interrupted operations, provide support and meet applicable legal obligations.
The proposed purposes and legal bases are:
- Providing your account and requested features: performing the service contract where the processing is necessary.
- Security, abuse prevention and reliable operation: legitimate interests, balanced against your rights.
- Compliance with an applicable legal duty: legal obligation.
- Optional processing that requires consent: a separate choice for that purpose.
Acknowledging a privacy notice is not blanket consent to every use. You can object to processing based on legitimate interests by contacting us.
Optional connections and AI
You can enter bike information manually without using AI or connecting Strava.
AI bike lookup sends the make, model, variant and year entered to Perplexity to research public specifications. Its designed request does not include your account email, maintenance notes, receipts or individual rides. Information typed into those identification fields can still be included in the request.
Strava supplies information under the connection permissions you authorise. Confirmed local unlink removes the connection credentials, individual Strava ride history, bike matches and discovered bike details. Already credited bike distance, riding time and service progress remain, with limited reconciliation records. The app separately reports whether revocation at Strava was confirmed.
Bike-history sharing, when available
Sharing is optional and uses a report you review before creating or updating its link.
The report can contain bike and component identities, recorded usage and completed service dates, titles and work descriptions. It excludes dedicated notes, performed-by, private nicknames, account/contact fields, serial and registration numbers, purchases, receipts, photographs and individual ride or Strava records.
Included text may contain personal information if you typed it there. Check the preview and remove anything you do not want to share.
Anyone who obtains the link can view and forward the report without an account. The report is a dated snapshot. You can choose 7, 30 or 90 days; the default is 30 days. Confirmed update replaces the current link. Confirmed withdrawal or expiry stops access through RideSet, but cannot recall recipient-held copies.
The viewer does not deliberately keep the report or secret link in local or session storage. Links can remain in browser history, bookmarks or messages. The owner app keeps limited tab-session recovery information, including an access-key hash, rather than the raw key or report.
Suppliers and other recipients
RideSet uses Supabase for authentication, application records and file storage, Lovable and its hosting infrastructure for the website and associated technical services, and Perplexity for requested AI research. Strava is involved when you choose to connect it.
Authorised administrators can access information needed for account management and support. Administrative reporting can include account identity and AI lookup time, outcome and recorded cost.
Private operational backups can be held temporarily through GitHub Actions and separately by the operator. People who receive a sharing link receive the selected report.
The connected database is in Ireland. This does not mean every supplier, support activity, log or backup is processed only there; suppliers can operate internationally.
Device storage and external sites
Device storage supports sign-in, preferences, the selected bike and limited setup or recovery markers. Some preferences and markers remain until replaced or cleared. Signing out does not necessarily remove every stored preference.
Hosting providers may process technical connection information. The separate history viewer avoids the normal app and marketing analytics modules, which is not a promise that infrastructure keeps no logs.
Retailer, affiliate and video sites have their own privacy information. Visiting them can disclose connection information and tracking-link parameters. RideSet may earn commission from qualifying purchases. A supplier click is not blanket consent to all tracking.
Retention and security
How long information is kept depends on the record, your use of the service, recovery requirements and applicable legal obligations. Account, bike and service records support your ongoing use of RideSet; operational records and backups need separate retention treatment.
For history sharing, confirmation previews are usable for 10 minutes. Expired previews and report bodies become eligible for cleanup after 24 hours; confirmed withdrawal clears the current report body and access-key hash. Command and disclosure records become eligible after 90 days where retained revision evidence makes retries safe. Hourly bounded cleanup can be delayed by outages or backlogs.
These sharing rules do not set the retention of your original private bike records, general logs, backups or recipient-held copies.
We use access controls and other safeguards to protect information. Protect your account credentials and sharing links and tell us if you suspect misuse.
Your choices and rights
Contact ridesetdev@gmail.com to request access, correction, deletion, restriction or portability, or to object to processing where the relevant right applies. Where consent is used, it can be withdrawn without affecting earlier lawful processing.
We may need proportionate identity checks and will explain the outcome and any applicable retention exception. This notice does not promise instant deletion or a particular self-service export or restore facility.
You may complain to the relevant privacy regulator, including the UK Information Commissioner's Office where applicable. We will date material updates and explain changes through the appropriate notice process.