Privacy policy

1. Who we are

MTBud is made by Axelo, a digital product studio in Brabant, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 42121831. Axelo is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Reach us at hello@axelo.nl for anything in this policy.

2. What we collect

You sign in with Apple or Google. Their sign-in carries more than we need; we keep only an identifier that links the account to you, your name the first time you sign in, and with Google, your Google profile photo if you have one. We do not store your email address.

• Profile: name, riding level, home park, bike and “about” text if you add them, and your photo — one you upload, or your Google photo until you replace or remove it.
• Rides: the rides you host (park, day, time, levels, spots, who can join, your note), the rides you request or join, and the message you add to a request.
• Chats: messages you send in ride chats, and how far you have read.
• Safety: riders you block, and reports you make — a reason from a fixed list and where you reported from, never free text.
• Activity: updates about your rides (requests, joins, changes) shown in the Activity tab.
• Device: a sign-in token (we store only a one-way hash of it) and, if you allow notifications, a push token and the Firebase installation ID that comes with it.

Photos you upload are cropped on your phone and stripped of all metadata, including location, on our server. The app asks for access to your photos only when you pick one; it never uses your camera or location.

We do not use analytics, advertising or crash-reporting tools, in the app or on this site, and the site sets no cookies.

3. Why we use it

• To run MTBud for you — show rides, let hosts handle requests, deliver ride chats, send the reminders and notifications you asked for. This is necessary to provide the service you signed up for (GDPR art. 6(1)(b)).
• To keep MTBud safe and working — review reports, enforce blocks and our Terms, limit abuse and protect our systems. This is our legitimate interest (art. 6(1)(f)).
• Push notifications only with your permission, which you can withdraw at any time in the app or in your phone’s settings (art. 6(1)(a)).

4. Who can see what

• Other riders see your name, photo, level, home park, bike and “about”, the rides you host with their note, and — on a ride’s screen — that you have joined it.
• A host sees your join request and its message.
• A ride’s chat is visible to the riders currently in that ride, including the earlier messages to those who join later. Leave a ride and you lose access to its chat.
• Block a rider and they no longer see the rides you host that they aren’t already in, nor you theirs; requests between you are dropped and neither of you gets notifications about the other. They are not told.
• Nobody sees your email — we don’t have it — or who you have reported.

Notifications show what they are about on your lock screen — for example a rider’s name, or the start of a chat message — and pass through Apple’s or Google’s push service on the way to your phone.

5. Where it is kept and who processes it

Our servers, database and photos are with Google Cloud in the Netherlands; queued background work runs in Belgium. Technical logs, this website and push delivery run on Google’s and Apple’s global infrastructure. We use these providers:

• Google Cloud — servers, database, photo storage, logs and this website, under Google’s data processing terms.
• Firebase Cloud Messaging (Google) and Apple Push Notification service — delivering notifications.
• Apple and Google — signing you in, under their own privacy policies.
• Google — if you use your Google photo, riders’ phones load it straight from Google.

Apple and Google may process some data outside the EU. Where they do, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

6. How long we keep it

• Your profile: until you delete your account.
• Rides you host or joined and your chat messages: for as long as MTBud runs, also after you delete your account, as described below — they are part of other riders’ history.
• Reports: for as long as they are needed to keep riders safe.
• Activity updates: 30 days.
• Sign-in sessions: you stay signed in while you use the app; a session unused for 90 days ends. Signing out or deleting your account removes its push token at once, and an ended session is deleted 30 days later.
• Technical logs kept by our hosting provider, which can include IP addresses: up to 30 days. We use IP addresses only briefly, in memory, to limit abuse.
• Database backups: 7 days, so deleted data can linger in a backup for up to a week.

7. Deleting your account

Profile → Delete account. You confirm with Apple or Google, and then, right away: your name, photo, level, home park, bike and “about” are erased; the link to your Apple or Google account is cut; your join requests and their messages, your blocks and your Activity are deleted; you leave every upcoming ride you joined that is still on, and you are signed out everywhere. Uploaded photos are deleted from storage within minutes — at most a few days if our systems are down.

What stays, so other riders keep their history: messages you sent in ride chats, rides you hosted and the record that you took part in past rides, shown as “Deleted user” without your name or photo. What you wrote in them stays as written. Reports stay for safety. Signing in again with the same Apple or Google account starts a new, empty account.

8. Your rights

You can see and correct your profile in the app at any time, and delete your account there. You also have the right to ask us for a copy of your data, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable format. Write to hello@axelo.nl with your name in the app and a ride you were in, so we can find your account — we may ask you to confirm the request from the app. We answer within a month.

If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

9. Age

MTBud is for riders aged 16 and over. We don’t knowingly keep data of anyone younger; if you think we do, tell us and we will delete it.

10. Changes

When we change this policy we update the date above and post a notice on this site. Also see our Terms & Conditions.