Privacy policy

Grooop helps people find others to ride with. To do that we need to store some information about you. This page explains what we store, why, who can see it, how long we keep it, and what you can do about it.

Who is responsible

Grooop is a free project run personally by Søren Christian Hornum, Trondheim, Norway.

Contact: privacy [at] grooop [dot] cc, or the contact form. Both work without an account.

What we store, and why

The legal basis is shown for each purpose.

Needed to give you an account (contract)

Name, email address and a hashed password. We never store your password in readable form. If you turn on two-step login, we also store the secret for your authenticator app and your backup codes, both encrypted.
The time we confirmed that you are 18 or older. At sign-up we ask for your date of birth only to check this. We do not store the date, only the result. We cannot verify a date you type in, so we rely on what you tell us.
Sign-in sessions: a random token, when it expires, and the IP address and browser type you signed in with.

Needed to run rides (contract)

Rides you create: title, description, date, place, meeting point, route and settings.
Which rides you join, request to join, leave (with the time you left, so that we can enforce a short wait before you rejoin), or were removed from, and which rides you help organise.
A private route library: every GPX route you upload for a ride is also saved for you, with its name, place, length and climbing, so you can use it again for a new ride. Only you can see it, and you can remove routes from it on My page.
Messages and likes in a ride’s chat.
Routes you suggest for a ride that has no route file yet: the GPX route, its distance and climbing, and when you sent it. The organiser and the riders on that ride see a suggested route without your name, and the organiser chooses one or dismisses it. We keep who sent it only to apply the limit of two suggestions per rider per ride and to tell you what happened to it.
Notifications about your rides, shown under the bell, and emails about them (requests, changes, reminders, and account emails such as email confirmation and password reset). You can turn off ride emails in Settings; every such email has a link to turn them off.
Your home city and its position, if you add them, so we can show rides near you.
Ride alerts you ask for, up to five: the place you searched for (its name and the position of its centre, not your own location) and a radius of 100 km, so we can tell you when a new public ride appears there. You can remove an alert in Settings at any time.

Showing your name on rides (contract, and consent)

To the people on the ride (the organisers and the riders who joined): your name is shown to them because a group ride cannot work otherwise. This is needed to carry out what you asked for when you joined (contract).
To other Grooop members: on a public ride, any logged-in rider can see the names of the organiser and the riders who joined. This goes further than a group ride needs, so we treat it as something you agree to. You are told right before you join or request to join, and by pressing the button you agree (consent). You can withdraw it by leaving the ride, which removes your name from the page at once.
To everyone, including people without an account: only the organiser’s name is shown on a public ride. Organisers are told about this on the form where they create a ride. People without an account see only the number of riders who joined, not their names, and cannot open profile pages. An organiser can choose a hidden ride, where only people with the invite link can open the page.
Profile pages are only for logged-in riders. They list the public rides that rider organises, and show the bio and bikes. Make your profile private to hide the page from other riders.
Organisers can limit a ride to riders with an open profile, so that everyone on the ride can see who they ride with.

Shown to other riders only if you choose (consent)

Date of birth is only stored if you add it in Settings, and only to work out the age we show if sharing is on. You can delete it at any time by clearing the field.
Bio, bikes, profile photo and links to your Strava or social media profiles are only stored if you add them. Only the link is stored; we do not read anything from those sites. Your bio, links and bikes are shown on your profile page, and your links also in the small card that opens when someone hovers over your name on a ride, to other logged-in riders, and your photo to riders on the same upcoming ride, if your profile is not private and sharing is on. Make your profile private to hide the profile page, or remove the items; both apply on the site straight away. A browser may keep a copy of a photo it has already loaded for up to five minutes.
Storing these details for you is separate from showing them to others: if you switch sharing off, or make your profile private, other riders do not see your city, age or gender.

Shown to other logged-in riders unless you switch it off (legitimate interest)

Home city, age, gender and ride numbers (how many rides you have organised and joined) shown in the small card that opens when someone hovers over your name on a ride. This is on by default for new accounts. Only riders who are logged in see it, never visitors without an account. It only shows what you have added to your profile; you decide whether to add a city, a date of birth or a gender.
Purpose: so that people can get to know who they will ride with, which is part of what Grooop is for. Our legitimate interest is a safe, friendly group ride; you can object at any time by switching it off under Settings, Privacy, and it applies on the site straight away. It is also switched off whenever your profile is private.
The same setting decides whether your profile photo is shown to the riders on the same upcoming ride.

Feature requests and votes (legitimate interest)

If you suggest an idea or vote on one, we store the text, the time and who sent or voted for it. Other riders see the idea and the number of votes, not your name.
Purpose: to collect and rank ideas for improving Grooop, to stop one person voting twice, and to tell you when an idea you backed has been built (a notification, and an email unless you turned ride emails off). Our legitimate interest is improving the service; it is your choice to take part, and you can withdraw a vote at any time. They are deleted with your account.

Keeping the service safe (legitimate interest)

Short-lived counters tied to your IP address or account, such as how many sign-in attempts or uploads happened recently, to stop abuse.
The country of your connection: Cloudflare tells our server which country each visit comes from, based on the IP address, so that the service can be blocked in Russia and North Korea. The country is not stored.
Reports you send or that are made about you (including the reported chat message), and messages through the contact form. A contact message is stored with a scrambled (hashed) version of your IP address to limit spam. A hashed IP address is still personal data and we treat it that way.
Bug reports and feedback sent with the “Bug or feedback” button: the message, the page you were on, your browser type (the user agent text your browser sends), your email address if you typed one, and your account if you were logged in. We do not store your IP address for this, only a scrambled counter to stop abuse.
Requests for a beta invite, made on the beta page without an account: your email address, the optional note you wrote, whether you ticked the box for launch news, and the time. We use them only to answer you and, if you ticked the box, to tell you when Grooop opens. No account is created and no email is sent to you until an administrator invites you.
Suspension notes and a list of blocked email addresses, if we have to remove an account for breaking the guidelines.
Messages from an administrator to you about your account or how you use Grooop, for example a warning. They show under the bell for 60 days and may also be sent to you by email, even if you turned off ride emails. You can reply to them. We keep a record of what was sent (the text, the date and who sent it) in case it is needed later, for 12 months or until you delete your account.
Requests you make to our servers are recorded in technical logs by our hosting provider, for security and operation.
Error reports: when something breaks on our server, a short report is sent to our error monitoring service so that we can fix it. It contains the type and text of the error, technical details of where it happened, the kind of page (for example a ride page) and the name of the site. It does not contain your name, email address, IP address, cookies or what you typed. Email addresses and long codes that appear inside an error message are masked before it is sent.

What we do not do

We do not sell your data. We do not add advertising or analytics tools to the site. We do not make automated decisions that have legal or similarly significant effects on you. Showing you rides near your home city is the only personalisation. Our emails do not use open or click tracking.

Who can see what

Information	Visitors who are not logged in	Logged-in riders	Riders on the ride and its organisers
Public rides: title, description, date, place, route, average speed	Yes	Yes	Yes
Exact meeting point and the start and end of the route	Only if the organiser chose to show them	Only if the organiser chose to show them	Yes, once you have joined (for rides by request, once approved)
Name of the organiser	Yes	Yes	Yes
Names of the riders who joined	No, only the number of riders	Yes	Yes
City, age, gender, ride numbers	No	Only if the rider has not switched sharing off and the profile is not private	Only if the rider has not switched sharing off and the profile is not private
Profile photo	No	No	Yes, but only to riders on the same upcoming ride, and only if your profile is not private and you have not switched sharing off
Profile page (bio, bikes, upcoming rides)	No	Yes, unless private	Yes, unless private
Ride chat	No	No	Yes
Routes suggested for a ride (without names)	No	No	Yes
Hidden rides	Only with the invite link	Only with the invite link	Yes
Email address, date of birth (if you added it)	No	No	No

Joining a ride that hides its meeting point shows you the exact place. Think about this before you join with people you do not know. See Before you ride.
Private profile means only your name shows on rides, nobody can open your profile page, your photo is never shown to anyone, and you cannot see or join rides limited to riders with an open profile (people without an account cannot see those rides either). The same goes for your photo if you have not switched sharing on: a photo is shown only when your profile is not private and sharing is on.
Moderators: Grooop administrators have a small pink check mark next to their name on rides and in chats, and are marked “Grooop moderator” on their profile, so you can see who they are. They can open every ride, including hidden ones, and read the chat and the list of riders without being on the ride, to be able to moderate. They can also write in the chat to answer concerns, and their messages carry the same check mark.
Chat access: only the organisers and the riders currently on the ride can read or write in the chat. If you leave, are removed, are declined or are still waiting for approval, you have no access. Messages you wrote stay visible to the riders still on the ride until the ride is deleted. You can remove your own messages while you are on the ride, and you can ask us to remove them afterwards. Deleting your account removes them too.
Past rides stay visible on their ride page until they are deleted (see below). The numbers of rides you attended and organised count only rides that still exist.
Search engines may index public ride pages. Hidden rides are marked so that search engines should not index them, and profile pages cannot be opened without logging in. We cannot control copies a search engine already made.
Administrators of Grooop can see, in the admin pages, all accounts with their name and email address, all rides including hidden ones, ride chats, reports, contact messages, bug reports and feedback, invite requests, and feature requests, and profile pages and photos regardless of your privacy settings, including your age if you gave a date of birth. The date of birth itself, consent records and the other fields listed in this policy are in the database, which an administrator can open directly, and technical logs are in the Cloudflare and Resend dashboards. We use this only to handle reports and requests, keep the service safe, fix problems and answer your rights requests.

Who else handles your data

Cloudflare hosts the site and database and delivers pages to you. For this, Cloudflare processes data on our behalf (processor). See its privacy policy and data processing agreement. It also logs requests, including IP addresses, for security.
Cloudflare Turnstile is the bot check on sign-up, login and password reset. It receives signals from your browser, such as IP address, browser type and a TLS fingerprint. Cloudflare acts as processor for providing the check to us, and as an independent controller when it uses those signals to improve its bot detection. See the Turnstile privacy addendum.
Resend sends our emails (processor). It receives your email address, your name and the content of each email. Resend does most of its processing in the United States. See its privacy policy and data processing agreement.
Sentry (Functional Software, Inc., United States) receives the error reports described above and keeps them for us (processor). We use its EU data region and have switched off storing IP addresses. See its privacy policy and data processing addendum.
OpenFreeMap supplies the map pictures (the map data itself comes from OpenStreetMap). Your browser asks its tile servers directly for the map area you look at, so the service sees your IP address, browser type and the area, as any website does. It is run by Hyperknot Software Kft. in Hungary. Its policy says it sets no cookies, keeps access logs without IP addresses, and records IP addresses only in error logs (deleted after 7 days) or temporarily if it detects an attack (at most 30 days). It may use Cloudflare as a content delivery network. See the OpenFreeMap privacy policy.
Photon (komoot GmbH, Germany) suggests places and addresses. Our server sends it the text you type in a place search, not your IP address, name or account. Anything you type is sent, so do not type your full home address. See komoot’s privacy policy, which does not describe the Photon service separately.
Open-Meteo (OpenMeteo GmbH, Switzerland) gives weather forecasts and city search (its city data comes from GeoNames, which we do not contact). Our server sends it a rounded position (about 10 km) or the city name you type, not your IP address or account details. Open-Meteo says in its terms that it deletes its server logs after 90 days.

Transfers outside the EU/EEA. This is where your data goes and what protects it:

Sentry (United States, EU data region): its data processing terms rely on the EU–US Data Privacy Framework, with the Standard Contractual Clauses as a fallback. Its terms allow data to be handled in the United States and other countries, even when the EU region is selected.
Cloudflare and Resend (United States): their data processing terms rely on the EU Standard Contractual Clauses, and both state that they are certified under the EU–US Data Privacy Framework. You can ask us for details at the contact address above.
Open-Meteo (Switzerland): Switzerland is recognised by the European Commission as providing an adequate level of data protection, so no further safeguard is needed.
Photon (Germany): inside the EU.
OpenFreeMap (Hungary): inside the EU. Its policy says it may use Cloudflare as a content delivery network, but it does not say in which countries data is then handled, and it names no transfer mechanism. If that happens, your IP address could be handled outside the EU/EEA under Cloudflare’s own terms.
Share buttons (X, Facebook, WhatsApp) and the profile links riders can add (Strava and social media) are plain links. Nothing is sent to those services by us, and when you click one you are on their site under their own policy.

We may also share information if the law requires it.

Cookies and similar technologies

We set only the cookies below. We do not use advertising or tracking cookies, and we do not store anything else on your device ourselves. Your browser keeps its normal cache of pages and pictures.

Sign-in cookie (set by Grooop, name starts with better-auth). Keeps you logged in. Lasts up to 30 days or until you log out.
Welcome page cookie (set by Grooop, grooop_welcome). If you are not logged in, it remembers that you have seen our welcome page, so we show it once per visit. It holds no personal data and disappears when you close the browser.
Invite code cookies (set by Grooop, grooop_gate and grooop_seen). While Grooop is an invite-only beta, the first one remembers which invite code you entered, so you do not have to type it again. It lasts 90 days. The second one stops us counting the same invite link twice on the same day and lasts one day. They contain a code reference, not your name or email.
Bot check (Cloudflare Turnstile, loaded from challenges.cloudflare.com on the sign-up, login and password reset pages). It may read or store information on your device to tell people from bots. See Cloudflare’s addendum above.

Under Norwegian law (ekomloven § 3-15) cookies that are strictly necessary to deliver a service you asked for do not need consent. The sign-in cookie is needed for you to use the site, the welcome page cookie only keeps us from showing you the same page again, the invite code cookies are needed to let you into the beta you were invited to, and the bot check protects the sign-up, login and password reset you asked for. If we add anything else, we will ask first.

How long we keep it

Rides, sign-ups and chat: deleted 6 months after the ride date. Every ride has a date. Cancelled rides stay on the site marked as cancelled and are deleted on the same schedule. Repeating rides lose their old dates the same way.
Your account (name, email, profile, photo, bikes, votes, feature requests): until you delete it, or until it has been inactive for 12 months. After 12 months without activity we email you; if you do not log in within 30 days, the account and everything tied to it is deleted. Accounts that organise a coming ride are not treated as inactive.
Date of birth (only if you added it in Settings): until you clear it or delete your account. Records of your consent and age check (the time we confirmed you are 18 or older, when you accepted the terms and this policy, and when you last changed the sharing setting): as long as your account exists. When you join a ride, the time of your sign-up is the record of that consent, and it is deleted with the ride.
Sign-in sessions and email confirmation or reset links: removed when they expire.
Notifications: 60 days. Abuse counters: about a day.
Records of messages from administrators: 12 months, or until you delete your account.
Your saved routes: until you remove them or delete your account (at most 100 are kept; the ones used longest ago go first).
Ride alerts: until you remove them or delete your account.
Suggested routes: until the organiser chooses one (the others are then deleted), dismisses it or you withdraw it (the route is deleted at once), or the ride is deleted. After a dismissal or withdrawal only a small marker without any route stays, until the ride is deleted, so the limit of two per rider per ride still works.
Reports: 6 months after they are resolved, and in any case 12 months after they were made. If the person reported deletes their account while a report is still open, a short record is kept until 12 months after the report was made (see Deleting your account).
Contact messages, bug reports, feedback and invite requests: 6 months after we have dealt with them, and in any case 12 months after they were sent.
Blocked email addresses and suspension notes: kept for as long as the block is needed to stop repeated abuse, and reviewed at least once a year.
Hosting logs: we have not switched on request logging or analytics of our own. Cloudflare keeps technical logs of requests, including IP addresses, for security and operation, for periods it sets itself and that we cannot change.
Error reports: kept by Sentry for up to 90 days (30 days on its free plan), and we can delete them earlier.
Emails the site sends: Resend keeps a log of the emails it sends for 30 days on our plan, according to its pricing page.
Emails you send to our contact addresses (privacy@ and hello@): kept in a mailbox hosted by Resend, and deleted 12 months after the conversation ends.
Backups: the database keeps recoverable copies for 30 days. Deleted data is gone from backups after that.

Deleting your account

You can delete your account any time in Settings. It happens at once on the live site. This deletes your profile, photo, bikes, sign-in sessions, ride sign-ups, ride alerts, suggested routes, chat messages and likes, votes, feature requests, notifications, reports you sent, contact messages, bug reports and invite requests sent from your email address or your account.

Rides you organise are deleted with your account, together with their sign-ups and chat. Other riders lose that chat history. If you want a ride to carry on, hand it over to a co-organiser first.
Exception for open reports: reports about you that nobody has dealt with yet are not erased with your account. We keep a short record (your name and email, what was reported and when, and the reported chat message or ride title) only so that a safety investigation or a legal claim does not fall away because an account was deleted. Only administrators can see it, we delete it 12 months after the report was made, and we do not keep who reported you. Reports we had already resolved are deleted with your account. This is based on our legitimate interest in keeping riders safe and in establishing or defending legal claims. If we blocked your email address because of abuse, the block stays.
Copies in database backups disappear within 30 days.
We cannot recall emails already sent, and we cannot delete copies other riders hold, such as route files they downloaded, screenshots, or messages they remember.

Your rights

Access and portability: under Settings you can open a readable copy of your data (which you can print or save as a PDF) and download it as a machine-readable JSON file.
Correction: change your name, profile and other details in Settings. To change your email address, write to us.
Deletion: delete your account in Settings, or ask us.
Withdrawing consent: switch off sharing of your details, make your profile private, or remove what you added, at any time. This does not affect what happened before.
Restriction and objection: you can ask us to restrict how we use your data, and object to processing we do for security reasons.
Complaint: to the Norwegian Data Protection Authority (Datatilsynet), or the authority in your own country.

To use these rights without logging in, write to privacy [at] grooop [dot] cc. We answer within a month. Giving us your name, email and password, and confirming that you are 18 or older, is necessary to have an account. Other profile fields are optional.

Adults only

Grooop is for adults. You must be 18 or older to have an account, and we ask for your date of birth when you sign up to check this. We keep only the time we confirmed you are an adult, not the date. We cannot verify a date you type in, so the check relies on your honesty.

Anyone can still open the public pages of the site, and the technical logs kept by our hosting provider record every visit, whatever the visitor’s age. We do not target or knowingly collect information from children.
If you are under 18, please do not create an account or send us personal details.
If we find that an account belongs to someone under 18, including because the date of birth was not true, we delete the account and everything tied to it permanently and without notice. We may block the email address so the same person cannot sign up again.
If someone under 18 contacts us through the contact form or by email, we delete the message and the contact details once we have dealt with it, and we do not keep it.
Parents and guardians can tell us about an account at privacy [at] grooop [dot] cc.

Security

Passwords are hashed, traffic is encrypted, and access to the admin tools is limited to administrators. No online service is perfectly secure. If something goes wrong that affects your data, we will tell you and the authorities as the law requires.

Changes

If we change this page in a way that matters, we will tell you on the site or by email.

Last updated: 8 November 2026.