Your route deserves care.

The short version

Bikepacking Live has no advertising, no sale of personal data, and no cross-company tracking. Precise location is recorded only during a stage you explicitly start. Followers receive only the delayed and privacy-filtered route you choose to share.

Who is responsible

The controller responsible for Bikepacking Live is:

Information we process

• Account and authentication data: email address, one-time-code records, sessions, devices, app version, and operating-system version.
• Trip content: journey and stage titles, descriptions, dates, notes, privacy zones, sharing settings, and calculated statistics.
• Location during recording: precise timestamped location, altitude, speed, heading, accuracy, and recorder state while you explicitly record a stage. The app may keep an app-protected local queue until synchronization succeeds.
• Subscription data: product identifiers, entitlement, renewal and transaction status, and provider customer identifiers. Bikepacking Live does not receive full payment-card details.
• Security and reliability records: pseudonymous IP-derived rate-limit values, request identifiers, webhook records, diagnostic events, and audience-capacity records.
• Viewer notes: the display name and message a follower chooses, plus a pseudonymous viewer identifier used for rate limiting and self-removal.

Why we process it

Account, trip, location, sharing, and subscription information is processed to provide the service and membership under Article 6(1)(b) GDPR. Limited security, abuse-prevention, reliability, and diagnostic information is processed under our legitimate interest in operating a safe and dependable service under Article 6(1)(f) GDPR. Where the law requires records or a response to authorities, Article 6(1)(c) GDPR applies.

Bikepacking Live does not use automated decision-making that produces legal or similarly significant effects.

Live sharing and follower notes

Followers do not need an account. When you activate a private trip link, anyone holding that link, and the passcode if you enabled one, can see the delayed and privacy-transformed route you chose to publish. Original points hidden by a privacy zone are not sent to followers.

On Unlimited journeys, followers may post notes that are visible to other people with the trip link. The cyclist can disable notes, remove them, stop sharing, or rotate the link. Treat a trip link as sensitive and replace it if it reaches people you did not intend to invite.

Service providers and international processing

• Hetzner hosts the application and PostgreSQL database in Germany.
• Amazon Web Services Simple Email Service delivers authentication and service email.
• RevenueCat, Apple, Google, and RevenueCat's payment provider where web billing is used process subscriptions and purchase status.
• Map tiles, glyphs, and sprites are served by the operator-controlled map.ahmed.wtf service.

Some providers may process information outside the European Economic Area. Where required, transfers rely on an adequacy decision or provider contractual safeguards. The providers' privacy notices also apply to the payment and account relationships they control.

Retention and deletion

• Authentication codes and short-lived rate-limit records are removed after two days.
• Expired or revoked account sessions are removed after their operational retention period. Follower access sessions are removed sooner.
• Trips and precise routes remain while your account is active so you can view and export them. You can delete individual trips at any time.
• Viewer notes remain with the shared trip until removed by their author or the cyclist, or until the trip, share link, or cyclist account is deleted.
• Audience audit records are kept for up to 13 months. Billing and security audit records are kept for up to 24 months.
• Account deletion immediately stops sharing and signs devices out. Primary account, trip, and location data is deleted within 30 days. Encrypted backups expire within 90 days and are not restored for ordinary product use.

Apple, Google, RevenueCat, payment providers, and legally required financial records may have separate retention obligations. Cancel an active membership before deleting your account.

Your controls and rights

You can pause or finish recording, stop or rotate sharing, configure a location delay and privacy zones, export GPX and account data, delete trips, and request account deletion in the app. The same account-deletion process is available on the public deletion page.

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may also complain to a competent data-protection authority, including the Berlin Commissioner for Data Protection and Freedom of Information. Contact contact@ahmedkhelifi.com.

Security, children, and changes

Transport is encrypted with HTTPS, sensitive identifiers are hashed, account email is encrypted in the database, and application logs are designed to redact precise coordinates and credentials. No internet service can guarantee absolute security.

Bikepacking Live is not directed to children. Do not publish another person's precise location without their informed permission. Material changes to this policy will be posted here with a new effective date.