Privacy Policy

The short version

In plain terms

You can browse trails without an account and without signing in. If you create an account, we store your profile and the rides and reviews you choose to save. If you record a ride, we store the GPS track of that ride. Your profile is public by default, and you can change that at any time. We use Google Analytics to understand traffic. We don't sell your personal information.

What we collect

Information you give us

• Account information. When you sign up with email, we store your email address and an authentication record. If you sign in with Google (including Google One Tap), Google shares your name, email address, and profile picture with us.
• Profile information. Your username, display name, avatar, home city, daily mileage goal, and profile visibility setting.
• Content you post. Trail reviews and ratings, and any city or trail information you submit for inclusion.
• Ride and activity data. Rides you log or record, including distance, elevation gain, elapsed and moving time, average and maximum speed, start and end times, and the trail the ride is associated with.

Information collected automatically

• Analytics. We use Google Analytics 4 to measure traffic. It collects pages viewed, referring site, device and browser type, and an approximate location derived from your IP address. This runs in production only.
• Server and hosting logs. Our host records standard request data, including IP address and user agent, for security and reliability.
• Map tiles.Trail maps are drawn from OpenStreetMap data and served as image tiles by CARTO. Your browser requests those tiles directly, so CARTO's servers can see your IP address and which map areas you look at.

Read this one

Location and GPS ride recording

GoalRival can record a ride using your device's location. This is the most sensitive data the site handles, so it's worth being explicit about it.

• Location access is opt-in. Your browser asks permission, and recording only happens on the ride recording screen when you start a ride. We do not track your location in the background or while you browse.
• When you record a ride, we store the route itself — a series of GPS coordinates (waypoints) tracing where you rode — along with the speed, distance, elevation, and timing figures derived from it.
• A ride in progress is also kept in your browser's local storage so an accidental refresh or closed tab doesn't lose it. It stays on your device and is cleared when the ride is saved or discarded.
• You can revoke location permission at any time in your browser or device settings, and you can delete saved rides from your account.

Because a GPS track can reveal where you live, work, and ride regularly, consider that before making ride data visible to others.

Visibility

What is public by default

GoalRival is partly a social product — leaderboards and rival matching only work if riders can see each other. So some things are public unless you change them:

• Your profile is public by default. That includes your username, avatar, home city, and aggregate stats such as total miles and current streak. You can set your profile to private in your profile settings.
• Reviews are public and displayed on the trail page along with the username that wrote them.
• Leaderboards and rival standings show usernames and the compared totals for riders taking part.

Why we have it

How we use your information

• To create and maintain your account and sign you in.
• To show your rides, stats, streaks, and progress toward your goals.
• To match you with a rival near your skill level and keep shared leaderboards.
• To publish the reviews and contributions you choose to post.
• To measure traffic and understand which parts of the site get used.
• To keep the site secure, debug problems, and prevent abuse.

We do not sell your personal information for money, and we never use your ride or location data for advertising. One caveat worth stating plainly: because we use Google Analytics, some analytics identifiers and browsing activity are shared with Google, and certain state privacy laws define that kind of sharing broadly enough to cover it. You can opt out using the link in the cookies section below.

Who else touches it

Service providers

We keep the list of third parties short. Each of these processes data on our behalf or as an independent service you interact with:

• Supabase — database, authentication, and storage.
• Vercel — application hosting and delivery.
• Google — sign-in (OAuth and One Tap) and Google Analytics.
• CARTO — delivers the map tiles your browser loads, and therefore receives your IP address.
• OpenStreetMap — the source of our map and trail data. We query it from our servers, not your browser, so it does not receive your IP address.

We may also disclose information if we are legally required to, or where it is necessary to protect the rights and safety of our users.

Cookies and local storage

• Authentication cookies keep you signed in. Without them the site cannot maintain a session.
• Analytics cookies are set by Google Analytics to distinguish visitors and sessions.
• Local storage holds an in-progress ride so it can be recovered if your browser reloads.

To be transparent about a current limitation: GoalRival does not yet show a cookie consent banner, so analytics runs for all visitors by default. If you are in a region that requires prior consent for analytics cookies, we recommend using the opt-out below until we ship consent controls.

You can block or clear cookies in your browser settings, though signing in won't work without the authentication cookies. To opt out of Google Analytics across all sites, Google offers a browser opt-out add-on.

Your choices

Your rights and controls

We want to be straight about how these work today. GoalRival is a small, actively developed site, and several of these controls are handled by us manually rather than by a button in the interface. They are honored either way — email support@goalrival.com and we will action the request.

• Location — self-serve. You can decline or revoke location permission at any time in your browser or device settings, without losing access to the rest of the site.
• Analytics — self-serve. You can opt out of Google Analytics with the browser add-on linked in the cookies section below.
• Access and correction — by request. The site does not yet offer profile editing after initial setup. Email us and we will send you a copy of your data or correct anything that is wrong.
• Profile visibility — by request. There is no self-serve public/private toggle yet. Profiles are public by default; email us and we will set yours to private.
• Deletion — by request. The site does not yet offer self-serve deletion of rides, reviews, or accounts. Email us and we will delete your account and its associated data, including your ride history.

Depending on where you live, you may have additional rights over your personal data — such as requesting a portable copy, asking us to delete it, objecting to certain processing, or withdrawing consent. We will not discriminate against you for exercising any of them.

Legal bases for processing

If you are in the European Economic Area or the United Kingdom, we process your personal data on these bases:

• Contract — to provide the account, rides, reviews, and rival features you sign up for.
• Consent — for location access during ride recording, and for analytics where consent is required. You can withdraw consent at any time.
• Legitimate interests — to keep the site secure, prevent abuse, and understand how it is used, balanced against your rights.
• Legal obligation — where we must retain or disclose data by law.

We are based in the United States, so your data is processed there. You have the right to lodge a complaint with your local supervisory authority if you believe we have handled your data improperly.

US state privacy laws

Sensitive data and health-adjacent data

Precise geolocation is treated as sensitive personal information under California law. We use your GPS data only to record, display, and calculate statistics for the rides you choose to record. We do not use or disclose it to infer characteristics about you, and we do not use it for advertising.

Washington's My Health My Data Act and similar state laws treat some fitness and location information as consumer health data. Ride recording is opt-in, and by starting a recording you consent to our collecting and storing that ride's route and metrics for the purposes described in this policy. You can withdraw that consent by revoking location permission, and you can ask us to delete recorded rides at any time. We do not sell this data.

Do Not Track

Some browsers can send a “Do Not Track” signal. There is no common industry standard for interpreting it, and GoalRival does not currently respond to these signals. We disclose this because California law requires us to say so plainly.

If there is a data breach

If we discover a breach affecting your personal information, we will notify affected users and any required regulators as the law directs — under Florida's Information Protection Act, generally no later than 30 days after determining a breach occurred — and tell you what happened and what to do about it.

Data retention

• Account and profile data — kept while your account is open, and deleted within 30 days of an account deletion request.
• Rides, GPS routes, reviews, and activity history — kept until you ask us to delete them or delete your account.
• Analytics data— retained per Google Analytics' own retention settings.
• Backups — deleted records may persist in routine backups for up to 30 days before being overwritten.

We may keep limited records longer where we are required to by law or need them to resolve a dispute.

Security

Access to user data is enforced at the database level with row-level security policies, and traffic is served over HTTPS. No system is perfectly secure, though, so we can't guarantee absolute security — please use a strong, unique password.

Children

GoalRival accounts are for adults — you must be at least 18 to sign up — and the site isn't intended for children under 13 at all. We don't knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us and we'll remove it.

Changes to this policy

We'll update this page when our practices change and revise the “last updated” date above. If a change is significant, we'll make a clearer effort to let you know.

Get in touch

Who we are, and how to reach us

GoalRival is operated from Florida, United States, and is the data controller for the information described in this policy.

Questions about this policy, or want to exercise any of the rights above? Email support@goalrival.com. We aim to respond within 30 days. You may also want to read our Terms of Service.