Privacy Policy

If you create an account, we keep your email address and, when you sign in with Google or Apple, the name and profile picture that service shares. We also keep which sign-in method you used and a session record so you stay signed in. There are no passwords: you sign in with Google, Apple or a one-time link we email you (sent through Resend).

You can delete your account at any time from your account page. That removes the account, its sessions and everything tied to it from our database: your ride stories and notes, connected devices and their imports, your rider profile, who you follow, and your ride plans with everyone's answers to them.

We use Google Analytics and PostHog to count visits and see which maps and pages people use, for example how often a map is opened from a city page. They set cookies or similar storage in your browser. They never receive your ride files, your rides or data from a connected device. We don't sell this data or use it for advertising.

To leave your browser out, open any page with ?notrack=1 added to the address (for example safestreetsmap.com/?notrack=1). Open a page with ?notrack=0 to undo it.

When you let a map use your location, it stays in your browser to centre the map and to measure what's near you. When you plan a route, the start and end points are sent to Mapbox, our map provider, to work out the route. On the places-to-work page, your start point is also sent to Mapbox to work out how far you can get and the travel times, and to the U.S. Geological Survey's elevation service to find its height; a spot's point goes to the National Weather Service for its forecast. None of it is stored. Ride files you check on the ride-check page are read in your browser and are never uploaded or stored.

A GPX or FIT file you open on the ride-story page is read in your browser. To build the story, your browser asks Open-Meteo for the weather and air quality at the ride's middle point and time, loads map tiles along the route from OpenFreeMap and Mapbox, and asks OpenStreetMap's Overpass servers and Wikipedia about the area the ride covers. Nothing is stored unless you share the story, and the file itself is never uploaded.

When you share a story, we store only what it needs: the route line with a random 500 m to 1 km cut from each end and snapped to mapped roads, so a start or end point doesn't show where you live; one sample every 100 m with the measures worked out from the ride (speed, height, heart rate, estimated power, weather); and the summary numbers. You choose who sees it: public (listed on the site), unlisted (anyone with its link) or private (only you). You can change that or delete the story at any time.

Notes you pin to a ride, and their photos, are reviewed before anyone else sees them. Photos are resized and re-encoded, which removes their location and other metadata. Public rides that follow the same loop share a route page, and the stretches of road they share become segments; those outlines belong to every ride on them, so they stay when one ride is deleted, while your ride, numbers and notes go with it.

If you enter your weight, age and highest heart rate on your account page, we keep them to estimate power and heart-rate zones for rides imported from a connected device. Who you follow is kept to build your feed; following someone gives no access to their unlisted or private rides.

If you connect a Garmin or Wahoo account, we keep that service's ID for your account and the access tokens it gives us, and nothing else from your profile there. When you finish a ride, the service tells us; we fetch that activity's file once, analyse it on our server and save it as an unlisted ride story, stored as described above. The file is not kept. We keep a short record of each import (when it arrived and whether it worked) so you can see it on your account page and no activity is imported twice. We only read completed activities: we don't ask for your daily health data, such as sleep or stress, and we don't post anything to your account.

Imported rides are handled by our hosting (Vercel) and database (Neon). The analysis sends Open-Meteo the ride's middle point and time for the weather and air quality, and loads map tiles along the route from OpenFreeMap to read road surfaces. No AI or machine-learning service receives your rides, and we don't sell them, share them for marketing or use them for advertising.

You can disconnect at any time from your account page: we delete the tokens and stop importing. Stories already made stay until you delete them. You can also remove our access in Garmin Connect's or Wahoo's settings.

If you post a ride plan, we keep it with its times, meeting spots, routes and cover photo (resized and re-encoded, which removes its metadata). People answering a plan don't sign in: they give a name and are recognised by a random code in a cookie for that plan, which we store only in scrambled form. They can comment and, for updates, leave an email address, sent through Resend and deleted a week after the ride. The plan's owner can remove a person or hide a comment. A route imported from RideWithGPS uses an access token kept for 30 minutes in a cookie in your browser, never in our database.

If you email us or submit something for review, such as a group ride, we keep what you send so we can act on it.

Questions or requests about your data: contact@safestreetsmap.com. If this policy changes, the new version will be on this page with a new date.