Privacy

Last updated 2026-10-22

This covers the Velo services at ridevelo.app and the iPhone app "Velo". The service is hosted and run by Benny Bergle (hereinafter, "the operator"). There is no web app: the iPhone app is how you use it. The server's web pages are this Privacy page, the terms of use, the support page and the home page. They set no cookies and load nothing from anywhere else.

What is stored

• Your account: your email address (the one Apple shares when you sign up, which can be a Hide My Email address), your display name, and the identifier Apple gives Velo for your Apple ID. If the operator has set up Sign in with Apple's server key, also a token from Apple, stored encrypted, which is used only to end the Sign in with Apple link when you delete your account.
• Accounts made before Sign in with Apple may also still hold what they signed in with before: a hash of the password (argon2, so the password itself is never kept), two-factor secrets stored encrypted, recovery codes kept only as a keyed hash, and passkeys' public keys. The app no longer offers those ways in, and accounts made with Apple have none of them.
• Your rides: the original FIT files, GPS tracks and sensor data such as heart rate, power and cadence.
• Your bikes, parts, service records, and the photos and attachments you add to them or to rides.
• Your social settings and what they hold: your username, whether your profile is public, your profile picture and cover photo, who follows you and whom you follow, riders you have blocked, your likes, which of your rides and photos are shared, and the places you set as privacy zones. For each shared ride the server also keeps the trimmed map and charts that followers see.
• The reports you file about other riders' content, and what a word filter held (see Reports and moderation).
• Your notification settings and the notifications sent to you.
• Push tokens for the iPhones you turn notifications on for.
• Sign-in sessions: when each started and was last used, the device name and the app's description of the device, and the IP address it came from. A session ends 90 days after it was last used, and at most a year after signing in; the record of it stays until your account is deleted. Each device you sign in on is also remembered, by that description and when it last signed in, until a year after its last sign-in.
• Failed sign-ins and new sign-ups are counted against the IP address they came from (an old account's failed passwords also against a hash of its email address), to slow down guessing and spam. A count is deleted once it lapses: about an hour after the last failed sign-in, a day after the last sign-up, or a week for an address blocked for making too many accounts. The times of the last day's sign-ups are kept, with nothing else, to cap how many there are.
• If you connect Strava, the login the server needs to sync with it, stored encrypted, and for rides it imports, the names Strava shows of the people who rode with you.

The server logs requests that fail or run slowly, by method, path and result only: no IP address, no query string, nothing you sent. It also logs account events: a sign-up and an Apple ID linked, with the account's email address, and a refused or failed sign-in, with the IP address it came from and any email address it named. The log stays on the server and is overwritten as it fills, a few tens of megabytes for each part of the service. The web server in front of it logs its own errors and nothing else.

Where it is

On the operator's server. The server also makes backups to a cloud storage provider the operator chooses, so a copy of your data sits there too. Everything in a backup (the database and your ride files and photos) is encrypted on the server before it is sent, with a key only the operator holds, so the storage provider holds files it cannot read and sees only how big they are and when they arrive. If the operator keeps ride files in object storage instead of on the server's own disk, that storage provider holds those files as they are.

Connections between the app and the server can pass through a network service the operator uses to protect the server from attacks. The official service at ridevelo.app uses Cloudflare (www.cloudflare.com): it decrypts each request in order to pass it on, so it handles what the app sends and receives in transit, including your IP address. It is not where your data is kept. Cloudflare handles that under its own privacy policy.

Who can see it

The operator can technically read anything in the service's database. Other people with accounts cannot see your garage, your settings or any ride or photo you have not shared. What they can see of you is described under Social, below.

Live tracking is off unless you start it, from the app or, if you turn that on, when your Rider 650 starts a ride. There is no link and no web page for it: nobody can watch a live ride from a browser. The server shows a live ride only in the Velo app, only to followers you approved by hand, and only for a ride you let them watch: you choose for each ride whether followers may watch, and whether they see your position or only your stats.

While you ride, the app sends the server your position, altitude, speed, direction and battery level every few seconds. Inside your privacy zones, and within a few hundred metres of where you started, the server keeps no position, so a follower watching would see only that time passed there. If you have never looked at your privacy zones, the server keeps no position at all. The positions are deleted within two hours after the ride ends. What stays is when the ride started and ended, how many points it had, and a rough circle around where it started, placed off the real spot, kept so the start stays off the map.

Social

Velo has a social side: riders can follow each other and see the rides they share. It is on for every account. You can turn it off in Settings, and you choose a username to take part. Nobody can find you until you do.

• Finding people. Another rider who has social on can search for you by name or username, and may be offered you as a suggested rider (someone followed by a public rider they follow). They see your name, username and profile picture, whether your profile is public, and how many riders follow you and how many you follow. A suggestion never reveals whom a private rider follows.
• Following. Your profile starts private. Someone who asks to follow you waits until you approve or decline, and you can remove a follower at any time. If you make your profile public, anyone with social on can follow you without asking, and can see the rides you share without following you. Requests already waiting are approved when you make it public. Making it private again keeps the followers you have.
• Blocking. You can block any rider. A block ends any follow between you, both ways, and you stop seeing each other in search, suggestions, profiles and feeds. They cannot ask to follow you again. They are not told, but they will no longer find you. You can undo it, and you can still report a rider you have blocked.
• Turning social off. Nobody can then find you, see your profile, your rides or your photos, or follow you, and you see nothing of anyone else's. Your followers, follows and likes are kept, so they are there if you turn it back on. An administrator can also turn it off for you (see Reports and moderation).
• Profile picture and cover photo. Both optional. You choose them from your photos. The picture is cut to a square; the cover, the wide photo behind your profile's header, keeps the shape you crop it to. Each is saved again as a new picture, so nothing of the original file, such as its location, is kept. Anyone who can see your profile sees your picture, including when your profile is private. Your cover photo is seen by everyone who can see your profile while it is public; while it is private, only by you and the followers you have approved.
• Likes. A rider who can see one of your shared rides can like it. Everyone who can see the ride sees how many likes it has. Only you can see who liked it (their name and username, and when). You get one notification in the app's inbox per ride, such as "3 people liked your Sunday ride", and no push. A like lasts until the rider takes it back, or the ride or either account is deleted.
• Your totals. Your followers see your distance, moving time and climb for this week and this month, beside your usual week (the middle of your last 12) and your best month of the last 24. Rides you hide and rides from Strava don't count. Someone who isn't your follower doesn't see them, even if your profile is public, and neither does someone still waiting for you to approve them. A switch in Settings, Social turns this off.
• Your bikes. Your followers can see each bike's name, the photos you add to it (up to three a bike), its type, brand, model and year, and, unless you turn off sharing your totals, its distance and number of rides. Those follow the same rule as your totals: they count only the rides your followers can see (not ones you keep from them, not Strava's), plus the miles you said the bike had before. A shared ride shows its bike's photos to them. Nothing else of your garage is shown: no parts, maintenance, serial number, notes, purchase details or anything you paid. Someone who visits a public profile without following you doesn't see them.
• Notifications. You hear in the app when someone asks to follow you (this one is also pushed), starts following you, or accepts your request. They name the other rider. A follower who turned it on for you, and who may watch the ride, also gets a push when you start a live ride; it names you.

What other riders see of your rides

• Shared by default. A new ride is shared with your followers unless you hide it. You can hide any ride, and share it again later, and a setting turns off sharing new rides automatically, so you choose each one. A ride you hide or delete leaves your followers' view at once. Rides recorded before social launched follow the same setting: when this changed in October 2026 those already here were shared if you had set up social with the setting on (except a ride with a title or photo caption written before social launched, or one that was reported, which stays hidden until you share it), and older rides you add afterwards are shared or not as it says. Turning the setting off doesn't hide rides already shared: hide any one from its own page.
• Stats only. You can share a ride as stats only, from its page. Your followers then see its card without the map: no route and no places for its photos. A ride you recorded while live tracking showed only your stats starts this way.
• Not Strava rides. A ride that comes from Strava is never shared. If the same ride also came from your bike computer, that recording is the one shown and it can be shared. A ride recorded on the phone or entered by hand that Strava also has is shown from Strava's copy, so it isn't shared.
• On a ride's card, a follower sees its title, date and start time, the name of the bike, distance, moving time, climb and average speed, a map (none on a ride shared as stats only), speed and elevation charts, the records and trophies set on that ride, its photos, the bike's photos (to your followers only), and the number of likes. They never see the ride's file, heart rate, power, your garage, maintenance or any other detail of the bike.
• Who sees it. The riders you have approved, and you. If your profile is public, any rider who has social on.
• Photos you add to a ride are shared with it, while it is shared. You can stop sharing any one, from the photo. A shared photo is shown with its caption. The file keeps no location or other details from the camera, and its place on the map is shown only away from your privacy zones.

Your location on shared rides

• The whole route is shown. A shared ride's map shows the route from start to finish. To keep a place such as home off the map, set a privacy zone round it, or share the ride as stats only.
• Privacy zones are cut out. You can set places, such as home or work, with a radius around each. Any part of a route inside a zone is left out, and the server cuts out a little more than you drew, so the edge of a zone can't be read from where a route stops. Your zones are never shown to other riders. The charts leave out the same parts and show no positions.
• No map until you have looked at your zones. A ride's map, and its photos' places on it, are shown only after you have set zones or said you want none. Until then followers see the ride without a map. If you said you want none before the whole route was shown, the app asks you again.
• The rest of the route is shown. Someone who sees many of your maps might work out where you live or ride. Put a zone around any place you want kept private, hide rides, or turn social off. If you change your zones, every map is drawn again.

Reports and moderation

• Reporting. Anyone can report a ride (including its title), a photo (including its caption) or a profile they can see, from the app: they pick a reason and can add their own words. You can't report your own, and no one can file more than 20 reports a day.
• Who sees a report. Only the administrators. They see the reported content (a ride's title and date, a photo's caption, or the profile, with the rider's name and username), the reasons, the words people wrote and how many reports there are. The administrators' screen does not show who reported. The aim is to act on a report within 24 hours.
• What an administrator can do. Dismiss the report. Hide a ride from followers: it stays hidden, on every recording of it, until the administrator undoes that. Unshare a photo, the same way. Or turn social off for a rider, and it stays off until an administrator lifts it. Settings in the app tells you if that has happened to you.
• A word filter. A ride's title and a photo's caption are checked against a list of words. A title or caption that matches is held: you still see it, followers see the ride or photo without it, and the administrators see it and decide whether to let it through. A name or username that matches is refused when you pick it.
• What a decided report keeps after a ride is deleted for good is described under Deleting your data.

What leaves the server

Only these, and only for the feature named. The server makes no other outgoing requests.

• Apple, for Sign in with Apple: the server fetches Apple's public keys to check your sign-in, and, if the operator has set up its server key, trades the one-time code from your sign-in for the token described above. Deleting your account sends that token back to Apple to end the link.
• Apple Push Notification service (only if the operator set it up): to send you notifications on your iPhone. Apple sees the notification's title and text (a follow request names the rider who asked; an "is live" push names the rider riding).
• The backup storage provider: the encrypted backups described above, nothing else.
• Strava (www.strava.com): only if you connect Strava. The server then uses your Strava web session to import your rides. Sending rides to Strava is a separate switch that is off until you turn it on. Nothing is ever edited or deleted on Strava.
• Weather: ride weather comes from a weather server the operator runs beside the app, and only if the operator switches it on. It downloads public weather data files from Open-Meteo's data on Amazon S3. Each request names a fixed tile hundreds of kilometres across and a time, not a place, so your locations and account are not sent; the most the requests show is which large area a ride was in, and roughly when. Amazon sees the server's IP address.

Some things come from your own iPhone instead of the server. The app shows maps with Apple Maps, both live maps and the small map pictures in lists and shared images. Looking at a map sends the map area to Apple, so Apple can send back the map imagery. Your rides are not sent: the route is drawn on the phone, and the app does not show or ask for your location on its maps. Apple handles that under its own privacy policy. Apart from that, and Strava's own sign-in page if you connect Strava from the app, the app talks only to the Velo service you sign in to.

No ads, no tracking

There are no ads, no analytics, no trackers and no third-party tracking code in the iPhone app. Your data is not sold or shared for marketing.

The iPhone app

• Location: only while you are recording a ride, including with the screen locked, or sharing one live. If you share a ride live, your position is sent to the server while you do. If you turn on live tracking from your Rider 650, the app asks for location "Always", so it can start when the unit does with the phone in your pocket. The barometer is used to measure climb.
• Photos: only the ones you choose, including a profile picture or cover photo. If you allow it, the app can also look for photos you took during a ride so you can add them. It never changes your photo library.
• Camera: to take a photo of a bike, part or receipt.
• Bluetooth: to talk to a Bryton bike computer, if you pair one.
• Face ID: to unlock the app, if you turn on the app lock. It is off by default.
• Your sign-in token is kept in the iPhone's Keychain. A home-screen widget keeps a small summary of your rides on the phone.

Deleting your data

To delete your account, use Delete account in the app's Settings. It is permanent and can't be undone: everything of yours in Velo (your rides and their files, photos, garage, settings, stored connections, and your social side: profile picture, cover photo, followers, follows, blocks, likes, privacy zones, sign-in records and the reports you filed) is removed from the server at once, and from the encrypted off-site backups as they age out: the database and ride files and photos within about a month. A file that is also in another account is kept for that account. Reports other riders filed about you are closed and lose the title or username they quoted. Services you connected, such as Strava, are not contacted or changed: what you sent there stays there. The one exception is Apple: if the server holds Apple's token for you (see What is stored), Velo sends it back to Apple to end the Sign in with Apple link, as Apple requires, which changes nothing else in your Apple ID.

A photo you replace or remove is deleted from the server within about a day. Copies can stay for a while elsewhere: in the app's own cache on the devices that showed it, and in the encrypted backups until they age out (about a month).

A ride you delete leaves your followers' view at once, and can be restored from Deleted rides for 30 days (a file of it that arrives later gets its own 30 days). After that it is deleted for good, with its original files, its photos, its likes, its stored map and everything else worked out from it, and leaves the encrypted backups as they age out: the database within about a month (the newest few snapshots are always kept), files and photos within about a month, and any deleted copies the backup storage provider keeps of its own until those go too. So that a ride you deleted isn't imported again (from Strava, your bike computer or the same file), the server keeps a fingerprint of each of its files, from which the ride itself can't be read back, and, if it came from Strava, the Strava activity's number. You can ask Benny Bergle to clear the fingerprints, so you can import the ride again yourself by uploading its file; a ride that came from Strava isn't downloaded from Strava again. A copy already on Strava is not touched: delete it there. If an administrator had hidden the ride after reports, those reports keep when the ride started and ended and nothing else taken from the ride, so it stays hidden if it, or another recording of you riding at that time, comes back; what the reporter wrote and the administrator's note stay with them, and may quote it. The times go if the administrator undoes the decision, or your account is deleted. A title or caption the word filter held stays in that record, so the same words stay held on your other rides.

You can also ask Benny Bergle at [email protected] to remove your account. An account removed that way is deactivated at once and permanently deleted 30 days later, and leaves the backups on the same schedule.

Children

Velo is not for children under 13, and is not directed at them.

Changes

When changes are made, the date at the top of this page will reflect the most recent updates.

Contact

[email protected]