Privacy Policy

Last updated: November 6, 2026

The short version

OpenRydr is built privacy-first. We collect as little as possible, we never sell your data, and we never share it with advertisers or data brokers for marketing.

A few things that matter most:

Your rides are backed up to your account. Rides you record are saved on your phone first and uploaded to your OpenRydr account when you have signal, so they survive a lost phone or a reinstall. Points inside any privacy zones you set, for example around home, are removed on your phone before upload. Rides are private unless you choose otherwise. Other people see your live location only when you use a feature built on it: a live-tracking link for your safety contacts, or a Group Ride.
You're in control. You can export the data on your phone, or delete your account, from inside the app at any time. See Delete your account for what deletion removes and what it keeps.
No ads, ever. OpenRydr shows no ads on any tier, and we don't embed advertising or tracking SDKs.

This policy explains the details.

Who we are

OpenRydr is operated by OpenRydr LLC, a Minnesota limited liability company (“OpenRydr,” “we,” “us,” “our”). This policy covers the OpenRydr mobile app, the OpenRydr website at openrydr.com, and shared-content and tracking links served at openrydr.app.

How OpenRydr is built (and why it matters for your privacy)

OpenRydr is local-first. Your rides, saved routes, saved places, garage and settings live on your phone, and the app works without a connection. Every OpenRydr account is signed in, and the app automatically backs up your rides, saved routes, saved places, privacy zones and garage to your account on our servers. There is no separate sync switch. Most app settings stay on your phone only. The sections below describe what is uploaded, who can see it, and how long we keep it.

Information we collect

Information you provide

Account information. You create an account using Sign in with Apple or Sign in with Google. We receive the basic profile information those services share with us (such as your name and email address, or Apple's private relay email if you choose it). We never receive your Apple or Google password.
Profile and garage. Your display name, unique handle, optional public profile details, and any motorcycles, gear, or photos you choose to add.
Safety contacts. The names and phone numbers you enter for emergency and ride-notification contacts, plus a record of your confirmation that you have each contact's permission to receive automated safety texts (a timestamp and the version of the confirmation text). We store these so the Safety SMS and crash-alert features can reach them.
Emergency info (optional). If you fill in your emergency card (blood type, allergies, medical conditions, medications, and notes), we store it in your account. It stays private unless you choose to share it. When you share it, the names and phone numbers of your safety contacts are shared with it. You can share it with the members of every Group Trip you're on, or with specific trips. With “Share with all my trips” on, riders in a live Group Ride with you can also see it. With “Share automatically in a crash” on, riders in your Group Ride can see it while you have an open Trouble alert or crash alert on that ride. Trip members' phones keep a copy of the cards shared with them so the cards work without signal, and that copy is deleted when the trip ends or they leave it. This is health information, so share it only if you want your riding companions to have it in an emergency.
Friends, messages, and group features. Your friends list and the riders you block; direct messages with friends; and, for Group Rides and Group Trips (Premium), group and trip chat, photos, trip plans (stops, lodging, polls, packing and gear lists), shared expenses, and any payment handles (Venmo, Cash App, or PayPal) you add for settling up. These are stored on our servers and visible to the people in that conversation, ride, or trip.
Reports. If you report another rider's content, we store your report, your reason, and a copy of the content as you saw it, so our team can review it.
Community contributions. Road reviews, route ratings and comments, and community routes you create. Road reviews are linked to your account so we can check each one against your own uploaded ride and prevent abuse. Other riders see only combined road scores, never your individual review. Our team can see reviews by handle when investigating abuse.
Support messages. Anything you send us when you contact support.
In-app feedback. When you submit feedback from within the app, we collect the message you write along with basic diagnostic context so we can reproduce and fix issues: your device model, operating-system version, the app version, and the screen you were on when you opened feedback. A screenshot or your location at the time of submission is included only if you add it. The app’s recent error log (what went wrong and which app version, with locations removed) can be attached too: a bug report includes it unless you switch it off, and other feedback only if you switch it on.
News, polls and questions. OpenRydr shows news posts in the app. If you answer a poll or a question, we store your answer with your account so you can only answer once and can change your answer while the post is open. Answers are seen only by the OpenRydr team, as totals and as written answers without your name; they are never shown to other riders. Poll totals are shown to riders after they vote. Your answers are included in your data export, deleted when you delete your account, and deleted automatically 12 months after the post ends.

Information created as you use the app

Ride and location data. GPS tracks, recorded rides, saved routes, saved places, and ride statistics. These are stored on your phone and backed up to your account automatically. When a finished ride uploads, we receive its full GPS track (about one point every 50 meters) and a simplified copy used to draw its map. Points inside your privacy zones are removed on your phone first. Photos you add to a ride are backed up too, with their location metadata removed. If a ride can't upload, for example because you're out of signal, the app tries again later. Uploaded rides are private unless you, or your default ride-privacy setting, make them visible to friends or the public.
Background location. When you start a ride, begin navigation, or start a safety session, OpenRydr may collect your location in the background — while the app is closed or not in use — so that ride recording and turn-by-turn navigation continue while your phone is stowed or your screen is off, and so crash detection can include your last known location in an alert to your emergency contacts. Background collection only happens during an activity you start. OpenRydr only asks for location access while the app is in use; it keeps working with your screen off because an activity you started is running, not because of an “always allow” permission. Location collected in the background is handled the same way as the rest of your ride data above.
Routing requests. When you plan a route, the start point, destination, and any waypoints are sent to our routing servers to calculate the route. We use these to return your route; we do not build advertising profiles from them.
Map data. Map tiles come from our own tile server (tiles.openrydr.app) and are cached on your phone. Offline regions you download are stored on your phone.
Group riding. During an active Group Ride (a Premium feature), your real-time location is shared with the other members of that ride so the group can coordinate. Sharing stops when the ride ends.
Live tracking links. When you start a ride with safety notifications on, the app creates a private tracking link and sends it to your safety contacts with your ride-start message. While you ride, your location is uploaded so the link can show it, and we keep only about the last two hours of points. When the ride ends, we delete all of that ride's tracking points. For the rest of the link's life it shows only that you've arrived, with your name and the ride's start and end times, and no map. The link stops working 24 hours after the ride starts (or, if the app has to resume an interrupted ride, 24 hours after it resumes). Your privacy zones are hidden from the link only if you turn on “Mask zones in live tracking” in Settings → Privacy & Data.
Crash detection. If the app detects a possible crash and you do not cancel the alert, we send a text message through our SMS provider to your safety contacts, including a short alert message and your last known location. If you don't cancel the alert, it can also include a live tracking link so your contacts can see where you are. Crash alerts and Safety SMS are best-effort features and are described further in our Terms of Service — they are not a guaranteed emergency service and are not a substitute for calling 911.

Safety contacts and automated messages

When you use OpenRydr's safety features, we process the names and phone numbers of the safety contacts you choose, in order to send the notifications you configure and — if crash detection triggers and you do not cancel — to send an automated crash-alert message to those contacts. Automated crash alerts are delivered through our messaging provider (Twilio) from an OpenRydr messaging number. Ride-start and arrival texts, by contrast, are sent from your own phone with your device's messaging app. You tap Send, and OpenRydr doesn't send or see them. The arrival text is off by default. If you turn it on, the app asks before opening your messaging app. Safety contacts who are your OpenRydr friends, and whom you've linked for in-app alerts, also get ride-start, arrival and crash notifications as push notifications. Those are sent through our servers and our push-notification provider.

We use safety-contact phone numbers only to deliver these safety messages. We do not use them for marketing, and we do not sell or share them. When you add a contact (or change their number), the app requires you to affirmatively confirm that you have that contact's permission to receive these automated messages, and we record that confirmation — a timestamp and the version of the confirmation text — as evidence of consent for the messages we send (see our Terms of Service). A contact can stop receiving OpenRydr safety messages by replying STOP to a message; doing so may prevent them from receiving future alerts, including crash alerts.

Information collected automatically

We keep this to a minimum.

No analytics in the app. The OpenRydr app contains no analytics, advertising, or crash-reporting SDK. Our website counts visits with Vercel Web Analytics (see “Our website”).
Notification opens. If you've opted in to ride reminders and news (see “How we use information”) and you open one of those notifications, the app tells us anonymously so we can count how many were opened. It contains no account, device, or location details.
Crash-detection statistics. When a crash alert appears, the app sends an anonymous record of what triggered it (impact strength, speed, and your sensitivity setting), how detection was running (for example while navigating or as a passenger) and, for a passenger in a group ride, whether their rider's vehicle was moving, and how it ended, for example whether you tapped “I'm OK”. It contains no account, location, or contact details. We use it only to reduce false alarms.
Subscription status. We receive your purchase and entitlement status from the app stores and our subscription manager so we can unlock the features you've paid for. We do not receive your full card number (see Payments).
Basic operational and diagnostic information necessary to run the service securely and to detect abuse.

Our website

Email signup. Your email address and the page you signed up from.
Beta applications. Your email; phone platform and model; bike type; years riding and how often you ride; country and state or region; the terrain you ride; whether you use a head unit; any notes; how you heard about us; and the referring page and campaign tags (such as utm_source) of the link you arrived from. Your browser keeps that referral information for the visit so it can be attached when you apply. We use these to choose testers and send access, and a copy of each application is emailed to our team. If you're accepted, we match your application's email to your OpenRydr account when you sign in, to unlock tester access.
Bot protection. Our forms use Cloudflare Turnstile, which checks your browser for signs of automation. Cloudflare processes your IP address and browser details to do this.
Visit statistics. Vercel Web Analytics counts page views without cookies. It records the page address, the site that linked you, and your country, browser, operating system, and device type. Private parts of page addresses (tracking-link tokens, settle-up tokens, and group-ride or trip join codes) are removed in your browser before anything is sent. We also count views of trip invite and settle-up pages.
Cookies. If you sign in on the website, Supabase sets cookies to keep you signed in. We don't use advertising or cross-site tracking cookies.

To have your email-list signup or beta application removed, email privacy@openrydr.com.

How we use information

We use the information above to:

Provide and operate the app's features, including navigation, ride recording, safety features, group riding, community features, and offline maps.
Back up your rides, saved routes, saved places and garage to your account so you can restore them on a new phone.
Send the safety messages and tracking links you trigger.
Process subscriptions and unlock paid features.
If you opt in to ride reminders and news (off unless you tick the box during setup or turn it on in Settings → Notifications), send occasional push notifications about OpenRydr. For example, a reminder to get out and ride if you haven't recorded a ride in a while. We record your choice, when you made it, and the wording you agreed to. You can turn this off at any time in the app.
Respond to support requests.
Improve routing quality and the community road database (using opt-in, de-identified contributions — see below).
Maintain security, prevent abuse, and comply with legal obligations.

We do not use your information to build advertising profiles or to track you across other apps and websites.

How information is shared

We do not sell your personal information, and we do not share it with advertisers or data brokers for their marketing — ever.

Information is shared only in these limited ways:

Service providers (subprocessors). Vendors that operate parts of the service on our behalf, under contract, listed below.
People you choose. Group Ride members see your location during a live ride. Ride and trip members see what you post there. People you share your emergency card with can see it and your safety contacts' names and numbers. Recipients of a share or tracking link see what that link contains. Your safety contacts receive the messages you, or crash detection, send them. Any trip member can create a settle-up link, and for 7 days anyone who has it, including people without OpenRydr, can see the trip name, members' display names, the expenses, who owes whom, and members' payment handles.
Content you share. Community routes and comments you post, and a public profile, are visible to others once you publish them. Rides are private by default. You can make any ride visible to friends or to everyone, or change your default in Settings → Privacy & Data. A ride's share link is created only when you tap Share. One exception: if you're in the founding beta, your new rides default to Public during the beta, which gives each one a share link and lets it appear in community Discovery. Our beta application page explains this, the app tells you after your first ride, and you can turn it off in Settings → Privacy & Data → Publish my rides for testing, or change any single ride's visibility. Points inside your privacy zones are removed from every ride before it leaves your phone. A public ride's web page also leaves out the first and last stretch of the route line (between 500 m and 1 km at each end), so it doesn't point to where you started or finished. Changing a public ride to friends-only or private turns its share link off for good; making it public again creates a new link.
Legal and safety. When required by law, or to protect the rights, safety, and security of users, the public, or OpenRydr.
Business transfers. If OpenRydr is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction, subject to this policy.

Service providers we use

Supabase: database, sign-in, file storage and server functions. Hosted in the United States.
Vercel: hosting for openrydr.com and openrydr.app, and the website's cookieless visit statistics (see “Our website”).
Cloudflare: runs our map-tile, satellite and weather servers, and the bot check on our website's forms (Turnstile). For troubleshooting, Cloudflare keeps those servers' request logs for up to 7 days. They show which map areas were loaded and, for weather, a location rounded to about 1 km, along with the requesting IP address; they don't include your account.
Hetzner: hosts our own routing server (United States) and search server (Germany). Your start, destination, waypoints and, during navigation, reroute positions go to the routing server to calculate routes. The search server receives the text you search for, your location rounded to about 1 km so nearby results come first, and simplified pieces of a route when you look for places, stop signs or traffic lights along it (the first and last 500 m to 1 km, and anything inside your privacy zones, are removed on your phone first). It keeps no access logs.
Twilio: sends crash-alert, all-clear and test text messages to your safety contacts.
Expo: delivers push notifications to your phone through Apple's and Google's push services. It receives your device's push token and the notification text.
Resend: emails our team when someone submits feedback, a report, or a beta application, including what was submitted.
Apple: Sign in with Apple and App Store purchases.
Google: Sign in with Google and Google Play purchases.
RevenueCat: manages subscriptions bought through Apple and Google.

Each provider is used strictly to operate the features described and is bound by its own terms and privacy commitments.

Public services the app contacts

Some features ask public services run by others. They aren't under contract with us, so we send them as little as we can:

OpenStreetMap Nominatim (OpenStreetMap Foundation). Place searches in the United States, Canada and Mexico go to our own search server. Nominatim is asked instead when our server can't be reached, and for searches elsewhere: your phone then sends the text you typed and your location rounded to about 1 km. To name a point our own address database can't (a dropped pin, a saved place, the start or end of a ride), it sends that point. Searches in our website's route planner are sent from our server, so Nominatim sees the search text but not your IP address.
Overpass API (overpass-api.de, run by OpenStreetMap volunteers in Germany). Our own search server answers these lookups; overpass-api.de is asked only when ours can't be reached. Then, to find gas and other places along a route, and stop signs and traffic lights when navigation starts, the app sends simplified pieces of your route, with the first and last 500 m to 1 km and anything inside your privacy zones removed on your phone first. Searching for places near you sends your current location.
U.S. National Weather Service. Weather requests go to our own weather server, which asks the National Weather Service for your location rounded to about 1 km. The Weather Service never contacts your device.
Esri. Satellite imagery (Rydr and Premium) is fetched by our tile server, so Esri sees which map tiles are requested but not your device or account.
U.S. NHTSA. If you enter a VIN in your garage, our server asks NHTSA's public vehicle database to decode it. We don't store the VIN on our servers, and NHTSA doesn't see your device or account.

Payments

In-app purchases are billed by Apple or Google under their respective terms. Card details are handled by Apple or Google and never reach OpenRydr. RevenueCat helps us recognize your subscription across iOS and Android. We don't currently sell subscriptions on our website.

Advertising

OpenRydr shows no ads — on any tier, anywhere in the app, ever. There is no ad-supported tier. We don't embed advertising SDKs, we don't use tracking identifiers for advertising, and we never sell or share your personal information for advertising. The app is funded entirely by optional Rydr and Premium subscriptions.

Analytics

The app has no usage analytics, apart from the anonymous count of opened reminder and news notifications described under “Information collected automatically”. If we ever add any, it will be off until you turn it on, and we'll update this policy first. Our website's visit statistics are described under “Our website”.

Separately, if you turn on “Help improve address coverage” in Settings → Privacy (off by default), OpenRydr records anonymous, aggregate statistics to help us decide where to add better address data. When you search for an address or drop a pin, we record only a coarse approximate area (rounded to roughly 11 km / 7 miles), whether the action was a search or a reverse lookup, and whether our own address database or an external mapping service answered it. We do not record your account, device identifier, precise location, the text you searched, or any timestamps, and the data is stored only as aggregate counts that cannot be tied back to you. You can turn this off at any time.

Community Road Database (opt-in, off by default)

If you opt in, OpenRydr can contribute de-identified road quality signal from your rides to improve scenic and twisty route scoring for everyone. This contribution path is designed so that it cannot be tied back to you:

The contribution request carries no account ID, no authentication token, and no session identifier — it is anonymous.
Your raw GPS trace is never stored, never logged, and never linked to your identity. It is map-matched in memory and then discarded.
The first and last portion of each trace (roughly 500m) is trimmed on your device before anything is sent, to avoid revealing start and end points.
Only road-segment identifiers and aggregate statistics are retained.
If you leave the planned route during navigation, the app notes the IDs of the roads you turned away from (no coordinates) and later sends them anonymously, the same way, to help us improve route choices. This is covered by the same opt-in.

Road reviews are separate from this anonymous contribution and are not anonymous. They're linked to your account, checked against the GPS track of your own ride, and counted toward road scores. Other riders see only the combined scores.

How long we keep information

On-device data stays until you delete it.
Ride backups stay in your account until you delete the ride or your account. On the free tier, the detailed GPS track and any photos of a private ride are deleted from our servers about 20 days after the ride. The ride's summary and simplified map are kept. Rides shared with friends or made public keep their detailed track so their links keep working. Rydr and Premium keep detailed tracks. If a paid subscription ends, the free-tier rule starts applying 30 days after it expires. Your phone keeps its own full copy either way.
Live tracking links stop working 24 hours after the ride starts (or 24 hours after the app resumes an interrupted ride). The location points behind a link are deleted when the ride ends, and in any case once the link expires.
Anonymous road-database contributions are retained as aggregate, non-identifying data.
Answers to News polls and questions are deleted 12 months after the post ends.
When you delete your account, we delete your personal data as described on our Delete your account page, including your direct messages (deleted for both riders) and your profile and bike photos. Group rides and trips you lead are handed to another member, and your place in trip expense ledgers becomes an unnamed “Former member”.

Your choices and rights

Export. Settings → Privacy & Data → Export my data saves a file of your data stored on your phone, including each ride's GPS track in GPX format. For data kept only on our servers, such as group or trip messages, email privacy@openrydr.com.
Delete. Settings → Privacy & Data → Delete account deletes your account right away. See Delete your account for what is removed and what is kept.
Email. Every email we send includes a one-click unsubscribe link.
Device permissions. You control location, motion/fitness, and notification permissions in your device settings. Some features won't work without the permissions they depend on.
Text-message opt-out. Recipients of OpenRydr's automated safety messages can reply STOP to stop receiving them, or HELP for help.
Preference signals. We do not sell or “share” your personal information for cross-context behavioral advertising. Where applicable, we treat a recognized opt-out preference signal (such as Global Privacy Control) consistently with this commitment.

Depending on where you live, you may have additional rights — for example under the EU/UK GDPR or the California Consumer Privacy Act (as amended by the CPRA) — including the right to access, correct, delete, or port your personal information, and to opt out of “sale” or “sharing” of personal information (which we do not do). We do not discriminate against you for exercising any of these rights. We extend core access and deletion rights to all users, wherever you live. To make a request, use the in-app tools above or email privacy@openrydr.com.

Security

We protect your information with encryption in transit, database-level access controls, tokenized payments, and access restricted to OpenRydr maintainers. No method of transmission or storage is ever completely secure, but we work to protect your data and to limit what we collect in the first place.

International users

OpenRydr is operated from the United States, and the providers we use may process data in the United States or other countries. Where required, we rely on appropriate safeguards for international data transfers.

Children

OpenRydr is intended for adults. The app and website are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete it. If you believe a minor has provided us information, contact privacy@openrydr.com.

Changes to this policy

As OpenRydr evolves, we may update this policy. When we make material changes, we will update the “Last updated” date at the top of this page. Where the law requires it, we will tell you about a change, or ask for your consent, before it applies to you.

Contact

Questions, concerns, or privacy requests: privacy@openrydr.com