Version 1.0 · Effective 26 July 2026 · Applies to the RideTogether mobile app and ridetogether.io
Ride Together is operated by RideTogether.io, a company incorporated in Hong Kong ("we", "us", "the Company"). We are the data controller / data user of your personal data. This policy explains what we collect, why, and your rights. It is written to comply with Thailand's Personal Data Protection Act B.E. 2562 (PDPA), the Australian Privacy Act 1988 (including the Australian Privacy Principles), and Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486).
Account data — email address, display name, and profile photo if you add one. Collected when you sign up. If you sign in with Apple or Google, we receive your name and email address from them (or Apple's private relay address if you choose to hide it), never your password. Legal basis: performance of our contract with you.
Rider profile — your birth year, riding level, bike types, interests, languages, gender, home country, short bio, and Strava profile link, where you choose to provide them. Birth year is collected to confirm you are 18 or over; other riders see your age, never your birth year, and only if you allow it. Legal basis: performance of contract.
Location — with your permission, the app reads your device's location only while it is open, at three moments: once during setup to suggest your home city, when you centre a map on yourself, and when you tap "use my location" while choosing a meeting point. Each is a single reading, used on the spot and then discarded — we do not store your coordinates. The only thing saved from the setup reading is the city you end up selecting. The one exception is a meeting point you deliberately publish, which becomes part of that ride for other riders to find. We do not track you in the background, do not follow you during a ride, and keep no record of where you ride. Declining the permission is fine — you can choose your city and meeting points by hand.
Ride data — rides you host or join, including titles, meeting points, routes you link, briefings, and pace descriptions, and messages you exchange with other riders. Legal basis: performance of contract.
Emergency contact details (optional) — the name, phone number and relationship of up to three people you nominate. This is personal data about someone else: you must have that person's permission before adding them, and you should tell them their details will be shared with riders on your rides. Legal basis: your consent, withdrawable at any time by deleting the contact. Shared only with riders on the same ride as you, only for the duration of that ride.
Safety data — reports you make or that are made about you, and riders you block. Kept so we can act on repeat offenders. Legal basis: legitimate interests in keeping the community safe.
Technical data — device type, operating system, app version, crash and error reports, notification token, and IP address, collected automatically to keep the service secure and working. Legal basis: legitimate interests / contract performance.
We do not track your live location, collect health or fitness records, import your Strava activities, run background checks, or sell personal data to anyone. Meeting points and routes are locations you choose to post, not tracking data.
To operate the platform (matching riders, displaying rides and profiles to other users), to keep the community safe (investigating reports of harassment or dangerous conduct, enforcing our Terms), to send you notifications about rides you are part of, to communicate service messages, and to comply with legal obligations. We send marketing communications only with your consent, and every message includes an opt-out.
Other riders see your display name, photo, riding level, and the rides you host or join. Your age, gender, country, ride statistics and Strava link are shown only if you allow it — Profile → Privacy controls each one, and you can restrict your full profile to club-mates only. Emergency contacts are visible only to riders on the same ride as you. Your home location and exact address are never shown to anyone.
We share data with service providers who host and support the platform, under contracts that restrict their use of it:
We also disclose data to authorities where the law requires it. We do not sell or rent personal data.
Your data is stored on servers located in Sydney, Australia, and is accessed by us from Hong Kong. Some of the service providers listed in section 3 process data in the United States and other countries.
If you are in Thailand, this means your personal data is transferred outside Thailand. If you are in Australia, your data is stored within Australia, but we still disclose it to overseas recipients — to ourselves in Hong Kong, and to the providers named above.
In each case we take reasonable steps to ensure recipients protect it to standards comparable to your local law, including contractual safeguards (Thailand PDPA ss. 28–29; APP 8; PDPO). By using the app you acknowledge these transfers; where consent is the applicable basis, you provide it at signup.
We keep account data while your account is active. When you delete your account, your profile, photo, rides you host, messages, emergency contacts and ride history are deleted immediately and permanently. Reports made about you survive with the identifying reference removed, so the moderation record is not erased by the person it concerns. Waiver and terms acceptance records are kept for 7 years, without a link to your deleted account, because we may need them to establish or defend a legal claim.
Depending on where you live, you may request: access to your data, correction, deletion, a copy in portable form, restriction or objection to processing, and withdrawal of consent (without affecting prior processing). Much of this is immediate in the app — Profile → Edit for correction, Profile → Privacy for visibility, and Delete account for erasure. Thailand: you may also complain to the Personal Data Protection Committee (PDPC). Australia: you may complain to the Office of the Australian Information Commissioner (OAIC). Hong Kong: you may complain to the Privacy Commissioner for Personal Data (PCPD). To exercise any right, contact tom@ridetogether.io; we respond within 30 days.
We protect data with encryption in transit, row-level access controls in the database, and least-privilege practices. If a breach is likely to cause serious harm or risk to your rights, we will notify the relevant regulator (within 72 hours where the Thai PDPA requires) and affected users as required by the Notifiable Data Breaches scheme (Australia), the PDPA (Thailand), and applicable Hong Kong guidance.
Ride Together is for adults 18 and over. We ask for your birth year at signup and do not allow accounts for anyone under 18. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.
We will notify you in the app of material changes and, where the change requires it, ask for renewed consent.
Contact: tom@ridetogether.io