Your ride data,
handled clearly.

Who we are and what this covers

Alex Dragomir is the developer and data controller for VeloForth, Android package com.veloforth.app. This means Alex Dragomir determines why and how personal data is handled through VeloForth and is responsible for that processing under applicable data protection law. “VeloForth”, “we”, and “us” in this policy refer to Alex Dragomir as the app developer and controller.

You can contact the controller directly at contact@veloforth.com. This policy covers information handled by the Android app. It does not replace the privacy terms of services you choose to use through Android’s sharing interface.

VeloForth does not provide user accounts, operate an app backend, or maintain a cloud copy of your ride library. No advertising SDK or developer-operated analytics service is included in the app.

Why we use data and our lawful bases

Under the UK GDPR, each use of personal data must have a lawful basis. The basis depends on the feature and purpose, as set out below. Android permissions and in-app controls let you manage access to features, but an operating-system permission is not by itself our legal basis for processing.

If a purpose changes materially, we will identify and document an appropriate basis before using personal data for that new purpose and update this policy where required.

Data the app accesses and stores

How location is used

Location is core to VeloForth. The app requests Android location permission when you use a feature that needs it. Precise location is required for reliable ride recording and turn-by-turn map positioning.

Current location or route coordinates may be sent to Mapbox when you use online maps, search, routing, navigation or downloads. A ride-card map backdrop may request an image centred on the ride area. Open‑Meteo receives coordinates when ride-preparation weather is requested. Location is not used by VeloForth for advertising.

Online services and recipients

International data transfers

VeloForth does not upload your local ride library to a developer server. When you use an online feature, however, Mapbox, Open‑Meteo, Google or their service providers may process the request outside the United Kingdom, including in the United States or Switzerland.

Where VeloForth is responsible for a restricted transfer, we use an applicable UK adequacy regulation or an appropriate safeguard under Article 46 of the UK GDPR. Depending on the recipient, this may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, and any required transfer-risk assessment and supplementary protections.

• Mapbox: Mapbox states that it relies on the UK Extension to the EU–US Data Privacy Framework and, where required, standard contractual clauses or another approved transfer mechanism.
• Google: Google states that it relies on UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework and standard contractual clauses where required.
• Open‑Meteo: Open‑Meteo is operated from Switzerland. Transfers are covered by applicable UK adequacy rules where available; if processing moves to a destination without adequacy, an Article 46 safeguard must be used.

To ask for more information about the safeguard relevant to a particular transfer, or for a copy where available, email contact@veloforth.com. We may redact confidential commercial information from a copy.

Sharing, sale and advertising

VeloForth does not sell personal or sensitive user data. It does not include advertising, use an advertising identifier, or share ride data with advertisers or data brokers. Data is transmitted to Mapbox, Open‑Meteo and Google Play only for the app functions described above. Those providers process information under their own policies.

If you export a route or ride as GPX, or share a ride, weekly-goal or annual-progress image card, Android sends the file to the app, service or person you select. That transfer is initiated and controlled by you, and the recipient’s privacy practices apply after the file leaves VeloForth.

Retention and deletion

Local information remains on your device until you delete an item in the app, clear VeloForth’s storage in Android settings, or uninstall the app. Temporary GPX exports and PNG share cards are stored in the app’s temporary directory and may remain until Android or the app clears that cache.

Deleting a saved ride does not delete its free-ride usage event or restore a free ride credit. It removes the ride’s check-ins, manually entered summary, derived analysis and Road Memory traversal contribution; private feedback marked to be kept can remain until you delete it or clear Road Memory. A separately saved or planned My Routes copy also remains until you delete that route or plan. Cancelling a plan cancels its scheduled reminders but retains the cancelled plan until you delete it. Because there is no VeloForth account or backend, clearing all app data can reset device-local free usage. An active Google Play subscription can be restored from the Play account even when local app data has been removed.

Because VeloForth has no account or developer backend, there is no server-side VeloForth account data to request for deletion. Android backups and information held by Mapbox or Open‑Meteo are governed by those providers and your platform settings.

How data is protected

VeloForth stores its local record in Android’s app-private documents area, protected by the Android application sandbox. Protection at rest also depends on your device’s security, encryption and backup settings. Online requests to Mapbox and Open‑Meteo use HTTPS. No security measure can guarantee absolute protection, so keep your device updated and protected with a screen lock.

Your choices and controls

• Location: change VeloForth’s location permission at any time in Android settings. Recording, live positioning, local weather and some routing features will not work without it.
• Notifications: optional trial, insight, record, weekly, goal, recovery, maintenance, planned-ride, and long-ride hydration and nutrition alerts can be enabled in VeloForth and controlled in Android settings. Planned-ride notifications request permission only when you opt in while saving a plan; the plan remains saved if permission is denied. VeloForth asks about the trial reminder only after a monthly trial is confirmed. Android may still show the notice required for an active recording service.
• Subscriptions: restore a Play purchase in VeloForth or open Google Play subscription management to review renewal, payment, cancellation and expiry information. VeloForth does not provide a local cancellation control.
• Local analysis: choose a riding focus, switch insight categories on or off, disable saved ride weather, edit a post-ride check-in or manually entered summary, manage Road Memory collection and feedback, or clear Road Memory from its screen.
• Local data: delete individual rides, saved routes, planned rides, Road Memory feedback, places, bikes, components or offline regions where available, or clear all app storage through Android settings.
• Sharing: do not use GPX export or image-card sharing if you do not want a file transferred to another app or person.
• Online services: use downloaded maps and routes when offline; online search, fresh route requests, map content and weather require the third-party services described above.

Your data protection rights

Depending on the circumstances and the lawful basis, UK data protection law gives you the following rights. These rights are not all absolute, and an exemption may apply in a particular case.

• Be informed: receive clear information about how your personal data is used.
• Access: ask whether we process your personal data and request a copy of data we hold.
• Rectification: ask us to correct inaccurate data or complete incomplete data.
• Erasure: ask us to delete personal data in circumstances where the right applies.
• Restriction: ask us to limit the use of personal data in certain circumstances.
• Data portability: receive eligible data you provided in a structured, commonly used and machine-readable form, or ask for it to be sent to another controller where technically feasible.
• Object: object to processing based on legitimate interests. VeloForth does not use personal data for direct marketing.
• Withdraw consent: withdraw consent at any time where consent is the basis, without affecting the lawfulness of earlier processing.

VeloForth’s local coaching, classifications and insights do not make decisions that produce legal or similarly significant effects about you. There is no solely automated decision-making of that kind.

Most ride information exists only on your device, so the fastest way to access, correct, export or erase it is normally through the app and Android controls described above. Because VeloForth has no account or developer backend, we may not hold a server copy that can be retrieved. This does not prevent you from making a rights request, and we will explain what we do and do not hold. Requests about data held independently by Mapbox, Open‑Meteo or Google should also be directed to that provider.

Changes to this policy

We may update this policy when VeloForth’s features, data practices, providers or legal obligations change. The “Last updated” date at the top identifies the current version. Material changes should be reflected in the app and its Google Play Data safety information before the changed practice is used.

Privacy complaints and contact

Contact the controller, Alex Dragomir, at contact@veloforth.comwith any privacy question, rights request or complaint. Please put “Privacy” in the subject line and do not send a ride track or other sensitive location information unless it is necessary to resolve your request.

We will acknowledge a data-protection complaint within 30 days, keep you informed of its progress and provide an outcome without unjustifiable or excessive delay. If you are dissatisfied, you have the right to complain to the UK Information Commissioner’s Office. We would welcome the chance to address the issue first, but you do not have to contact us before approaching the ICO.

If you are outside the UK, you may also be entitled to complain to the data-protection authority where you live or work, or where you believe an infringement occurred. Your right to complain does not affect any other administrative or judicial remedy available to you.