Skip to main content

Privacy Policy

Last updated: September 26, 2026

This policy explains how RideDat collects, uses, stores and protects your data. RideDat requires sign-in. Cloud sync for bike and ride data is optional.

Data We Collect

RideDat uses Firebase (Google) for sign-in, crash reporting (Crashlytics) and app integrity checks (App Check). Sign-in is required. Enabling cloud sync sends bike and ride or charge history to our servers. Account, diagnostics, crash reporting and optional feedback processing are separate from cloud sync. We do not use advertising and we do not sell your data.

Depending on the features you use, we may collect:

  • Account: your email address, display name and profile picture from your sign-in provider.
  • Bikes: Bluetooth MAC address, frame number, model, firmware version and the nickname you choose; the last known battery level, odometer and range; when the bike was last connected; and which accounts it is shared with.
  • Bike password backup: stored in reversible, obfuscated form so it can be restored to your account on your devices. It is not end-to-end encrypted.
  • Ride and charge history: start and end times, battery level (SOC), energy used and regenerated (Wh), battery cycle counts, distance, odometer, maximum speed, charging voltage and maximum charging power, and coarse samples taken during each session (distance and energy for rides; elapsed time, battery level and voltage for charges).
  • Sync records: device and install identifiers, timestamps and change records used to keep your devices in sync.
  • Leaderboards (opt-in only): your public alias and ride statistics per bike model (distance, number of trips, energy efficiency).
  • Bug reports you send: your description, app version, device details, bike model, firmware and frame number, and app logs if you choose to attach them.
  • Beta diagnostics (alpha and beta test builds only, after you accept the in-app notice): an install reference, phone make, model, build and security patch level, Android version, app build and release channel, a hashed bike reference, bike model and firmware, and an ordered record of feature use, Bluetooth connection steps and failures. Diagnostics never include passwords, credentials, typed text or location.
  • Crash reports (Firebase Crashlytics): device model, operating system and app version, and technical details of the crash.

Location: the current app does not record your location. If a trip synced by an earlier app version includes start coordinates, they are stored with that trip and deleted with it. If a future version records location, trip start coordinates will be sent only when cloud sync is enabled.

We do not collect sensitive personal data such as health, biometric or political information.

Data Storage

Your bike password, preferences and ride data are stored on your phone. When cloud sync is enabled, bike details and ride or charge history sync to our servers. When cloud sync is enabled, a bike-password backup is stored in reversible, obfuscated form so it can be restored to your signed-in devices; this is not end-to-end encryption. You can turn off cloud sync in Settings. Local data can be cleared separately from account deletion.

Data Retention

We keep personal data only as long as needed for the purposes in this policy. Account data (email, display name, profile picture) and bike password backups are kept until you delete your account. Bug reports on our servers are kept until you delete your account; copies already posted to our private Discord channel are not removed automatically and are deleted on request. Beta diagnostics are kept for 14 days and then deleted automatically. Crash reports are kept by Firebase Crashlytics for up to 90 days. The app confirms when in-app deletion is complete and shows a pending state if sign-in removal needs another attempt. Deletion requests sent to us are completed within 30 days, except where the law requires us to keep data.

Cross-Border Data Transfer

When you use an account, your personal data is transferred to and stored on servers outside Vietnam. Our service providers include: Railway (backend hosting and database, Singapore), Firebase/Google (sign-in, crash reporting and app integrity checks, United States) and Discord (delivery of the bug reports you send to a private RideDat team channel, United States). By enabling cloud sync, you explicitly consent to this cross-border transfer of your data to Singapore and the United States. All data in transit is protected with HTTPS, and our providers encrypt stored data at rest. You may withdraw consent at any time by disabling cloud sync in Settings, which stops future syncing of your bike and ride data to our backend. Crash reports and app integrity checks (Firebase) are sent independently of cloud sync, and bug reports reach Discord only when you choose to send one. Previously synced data can be removed by deleting your account.

Bike Telemetry

When connected to your bike, RideDat receives real-time telemetry over Bluetooth, including battery status, cell voltages, temperatures and diagnostics. This data is shown in the app. If you are signed in with cloud sync enabled, ride and charge summaries and the coarse samples described above may sync to our servers. Raw Bluetooth telemetry stays on your device.

App Permissions

  • Bluetooth: Required to connect to your DatBike via BLE
  • Location: Android may require location permission for Bluetooth scanning. RideDat does not record, store or send your location.
  • Storage: Optional, only used if you choose to export ride logs

Cloud Services

When signed in, RideDat connects to our backend hosted on Railway (api.ridedat.com) with a PostgreSQL database. The data sent is listed under Data We Collect. All connections use HTTPS. Your account data can be deleted in the app or as described on our account deletion page.

Third-Party Services

RideDat uses: Firebase (Google, United States) for sign-in, crash reporting and app integrity checks; Railway (Singapore) for our backend API and database; Discord (United States) to deliver the bug reports you send to a private channel read by the RideDat team; and Google Analytics (Google, United States) on this website only, which uses cookies to measure visits, such as pages viewed, device and browser type, and approximate location derived from your IP address. Google Analytics is not used in the app. These providers process data on our behalf. We do not use advertising services. Leaderboards are opt-in and share only your alias and ride statistics. Google Analytics stays off until you choose “Allow analytics”. You can refuse or withdraw permission through Cookie settings in the website footer. Withdrawing stops future Google Analytics collection and removes this site’s Google Analytics cookies; it does not automatically erase previously collected reports. Separately, Cloudflare Web Analytics measures page visits and website performance without cookies. Cookie settings controls Google Analytics, not this cookie-free performance measurement.

Your Rights

Depending on the applicable data protection law and your circumstances, your rights regarding personal data may include the following:

  • 1.Right to Know: You may request information about what personal data we collect and how it is processed.
  • 2.Right to Consent: We will obtain your consent before collecting or processing your personal data, except where permitted by law.
  • 3.Right to Access: You may request a copy of your personal data that we hold.
  • 4.Right to Withdraw Consent: You may withdraw your consent at any time by disabling cloud sync or deleting your account.
  • 5.Right to Delete: You may request deletion of your personal data. We will comply within 30 days.
  • 6.Right to Restrict Processing: You may request that we limit how we use your data.
  • 7.Right to Data Portability: You may request your data in a structured, commonly used format.
  • 8.Right to Object: You may object to certain types of data processing.
  • 9.Right to Complain: You may file a complaint with Vietnam's Ministry of Public Security, Department of Cybersecurity and Hi-tech Crime Prevention, or other competent authorities.
  • 10.Right to Compensation: You may claim compensation if you suffer damages due to violations of data protection regulations.
  • 11.Right to Self-Defense: You may take lawful measures to protect your personal data rights.

To exercise any of these rights, use Delete Account in the app, follow the steps on our account deletion page, email us at [email protected], or contact us on Discord. We will respond within 30 days. For complaints to Vietnamese authorities, contact the Department of Cybersecurity and Hi-tech Crime Prevention under the Ministry of Public Security.

Feedback & Bug Reports

When you send a bug report from the app, we receive your description, app version and build, device details, bike model, firmware and frame number, and app logs if you choose to attach them. The report is stored on our servers, and a copy is posted to a private Discord channel so the RideDat team can respond. Bug reports are used only to investigate and fix problems.

Children's Privacy

RideDat is not directed at children under 13. We do not knowingly collect any information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us to request deletion.

Legal Basis for Processing

We process your personal data based on: (1) Your explicit consent when enabling cloud sync or creating an account; (2) Performance of our service contract with you; (3) Our legitimate interests in improving our services and preventing fraud, provided these do not override your data protection rights. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected on this page with an updated date. Significant changes will be announced in the app and may require renewed consent. We encourage you to review this policy periodically.

Vietnam-Specific Provisions

Vietnam's personal data protection framework includes Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP. Caullen Omdahl, based in Beaverton, Oregon, United States, operates RideDat and is responsible for processing your personal data as its data controller. We have implemented appropriate technical and organizational measures to protect your data. For Vietnamese citizens, cross-border transfer of your data requires your explicit consent, which you provide when enabling cloud sync. You may withdraw this consent at any time.

Contact Us

If you have questions about this privacy policy, want to exercise your data protection rights, need help beyond Delete Account in the app, or have concerns about RideDat's privacy practices, email us at [email protected] or use one of the other channels below. For complaints regarding personal data protection in Vietnam, you may also contact the Department of Cybersecurity and Hi-tech Crime Prevention under the Ministry of Public Security.

How to delete your account and data