Privacy policy

Who controls your data

MXDuro is the service operator and data controller for information used to provide MXDuro. Privacy questions and rights requests can be sent to theophilusbarrett1991@gmail.com.

What we collect

• Account information, including your email address and permanent account identifier.
• Profile information you provide, such as rider name, date of birth, age band, chosen town or region, discipline, bike details, biography and social links.
• Activity such as event attendance, friends, messages, reports, ride plans, referrals, rewards and subscription status.
• Media and posts you choose to upload. Profile and feed images are re-encoded and embedded metadata is removed before storage. Avatar source photos are transient and are not published.
• Technical, security and consent records needed to operate the service, prevent abuse and remember your settings.

Location and public visibility

Your public rider profile shows only the town or region you choose, not your live GPS position. Adults can choose to appear in rider discovery and on the map. Map avatars appear only when at least five discoverable adults are grouped together, are scattered synthetically inside the broad area, and shift every ten minutes. They never represent a home, bike or live position. Email addresses, dates of birth and precise locations are never included in public rider previews. These public-visibility safeguards are separate from the mapping-provider processing described below.

Age and account protection

During the current beta, riders aged 16–17 remain private and excluded from public rider discovery. Age information is used to enforce safety and access permissions; it is not shown in public rider previews.

Maps, directions and Mapbox

Mapbox provides maps and directions. Requests can include your IP address, device and usage information, and coordinates needed for the feature you use. Generating a route sends selected start and route endpoint coordinates to Mapbox Directions; these can include your GPS position when you select it as the start. This does not put your live position on the public rider map.

The native Mapbox SDK has telemetry enabled by default. Its disclosures include location, identifiers, interactions, usage and diagnostics for functionality and analytics. You can opt out through the map’s information/attribution menu and control location permission in your device settings. Telemetry opt-out does not prevent coordinates being sent when you request directions. See the Mapbox privacy policies for its processing and choices.

Why we use it

We use information to create and recover your account, provide maps and events, operate rider features, protect younger riders, moderate content, prevent fraud and theft risk, deliver essential service messages, honour your settings and meet legal obligations. Optional marketing is based on your consent and can be withdrawn.

Service providers

We use specialist hosting, database, authentication, email, mapping, moderation, analytics and payment providers where configured. Providers process information under their applicable contracts and privacy policies. Some, including Mapbox for certain product data, also act as independent data controllers. We do not sell personal information.

Retention and deletion

Your account remains available until you delete it. You can start account deletion inside the iOS app. Public profile data, private profile details, device subscriptions, friends, profile media, feed posts, message attachments and contribution evidence are removed. Limited pseudonymised safety, moderation, reward and transaction records may be retained where necessary for law, fraud prevention, disputes or rider safety. App Store subscriptions must be cancelled separately in Apple subscription settings.

Your rights

Depending on applicable UK data-protection law, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent. Contact us using the address above. You may also complain to the UK Information Commissioner’s Office.

Security, transfers and changes

We use access controls, private storage, signed sessions and data minimisation. No online service can promise absolute security. Some providers may process data outside the UK using recognised safeguards. Material policy changes will be shown in the service before they take effect.

For practical safety guidance, visit the Safety centre.