What we collect, and why.

Last updated 15 September 2026

Who is responsible

The data controller is BikeCoders (bikecoders.life), based in the Netherlands, which stewards the Cycling Commons today. As set out in our governance, the Commons is committed to spinning out to an independent Dutch foundation; the controller will transfer accordingly, and this page will be updated.

Questions about your data: info@cyclingcommons.org (or use the Contact). You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

We have not appointed a Data Protection Officer (DPO), and the law does not require one of us: we are a small operation, we do not monitor people on a large scale, and special-category data is not part of what we do (GDPR Art. 37). Data protection questions and requests go to the same address as everything else, info@cyclingcommons.org (or use the Contact), and a person reads them. If that ever changes and we do appoint one, this page will name them.

What we collect

We ask for the minimum needed to run an open, accountable map. We never ask for your real name.

When you create an account

• Your email address — to sign you in, secure the account, and send essential service messages.
• A password, which we store only as a salted hash — we never see or keep the plain text.
• A display name you choose. It can be a pseudonym, and we never ask for your real name. Your profile is off by default: while it is off, what you contribute carries no name at all. Turn it on and your display name, your country, the month you joined and your contribution counts become public.
• If you enable two-factor authentication (2FA), we store the TOTP secret encrypted at rest, and your backup codes only as hashes.
• An optional base location — a town-level point (~1 km precision) and riding radius, if you set one. Used only to scope your own map view; never shown to other riders, and never part of the Commons dataset.

When you contribute

• Everything you write into the Commons. A place, a climb, a route, a correction, a vote, an on-the-spot check, a region description, a translation, a report, a message to a curator: if you typed it and sent it, we have it. Each one records that an account made it, which is what lets a curator write back and lets other riders see the map is kept by people. While your profile is off, none of it carries your name.
• Any photos you upload. A photo can carry hidden data (EXIF), such as where it was taken: we strip that out and re-encode the file, so what we publish carries none of it. We then write one thing back in: a stamp saying the picture is licensed CC BY-SA 4.0, and a link to its page here. Your name is never written into the file. The link is how somebody reusing the photo finds who to credit, and that page names you only while your profile is public.
• Optional public-profile details you fill in (bio, links, which contributions to show). Profiles are opt-in and off by default.

Automatically, when you use the site

• Technical data — IP address, browser type, and timestamps in our server logs, kept to operate and secure the service.
• Rate-limit counters — when you use a tool without an account, such as the ride check, we count your uses against a salted one-way hash of your IP address rather than the address itself. That lets us apply a fair daily limit without keeping a list of who visited. Hashing is not anonymisation: the counter is still personal data and everything on this page applies to it.

Why we use it (legal bases)

• To provide your account and the service: performance of a contract (GDPR Art. 6(1)(b)).
• Showing your name. A public profile, and being credited by name on what you contributed, rests on your consent (GDPR Art. 6(1)(a)). Withdraw it any time in settings and your name comes off those pages. On our side that happens at once. A map file that somebody's browser already downloaded can be up to an hour old, and a copy of a page that somebody else saved is beyond our reach entirely.
• Publishing what you contribute. A photo or an edit you give to the Commons is published under the licence you agreed to when you sent it, which is part of our agreement with you (Art. 6(1)(b)). That licence is irrevocable by its own terms, so withdrawing consent takes your name off the page but does not un-publish the contribution itself. One exception matters: if a photo shows you, that is your personal data, and a copyright licence does not sign away data-protection rights. Every photo page carries a link to ask for it to come down.
• Telling you when a release ships. Only if you asked: the toggle in your settings is your consent (GDPR Art. 6(1)(a)), and turning it off withdraws it. Every message also carries a one-click unsubscribe that needs no sign-in. Release notes only, never marketing, and the list is never shared or sold.
• Security, abuse prevention, and aggregate analytics: our legitimate interests in keeping the Commons honest and working (Art. 6(1)(f)).
• Meeting legal obligations: where the law requires it (Art. 6(1)(c)).

Cookies & analytics

We keep this light. We set two cookies, both of them strictly necessary, and both listed in full below. For usage statistics we run self-hosted analytics on our own infrastructure: it receives the page URL, referrer, screen size and browser type, and it receives your IP address, which is personal data, but does not store it. The address is used only to work out an approximate location (country, region and city) and to derive a one-way session identifier, and is then discarded. No analytics cookies are set, no visitor is given a persistent identifier or tied to an account, and there is no cross-site or cross-device tracking. Analytics data stays on our own infrastructure and is never shared with, or sold to, third parties.

The cookies we set

That is the whole list. We set no advertising cookie, no analytics cookie and no cross-site tracking cookie, on any page. Both cookies above are strictly necessary to deliver something you asked for, so the law needs no consent for them, and that is why there is no cookie banner here. If we ever added something that did need one, we would ask you first rather than assume.

The map also keeps a few of your own settings in your browser's local storage: the light or dark map theme, the area you last looked at, and which filters you had switched on. That is not a cookie, it is never sent to our server, and clearing your browser data removes it. No other website can read it. A browser keeps each site's local storage sealed off from every other site, so what we store here is readable by this site alone.

Who we share it with

First, what is not in these lists. We run as much of this ourselves as we can: the map data, the route planning, the elevation model behind the climb gradients, the photo storage and even the usage statistics all sit on our own machines. Two services we used to call out to, for routing and for elevation, were brought in-house in 2026 for exactly this reason. It is slower to build that way and it costs more. It is also why your browser talks to five outside services instead of twenty, and why the tables below are as short as they are: every name in them is one we could not reasonably run ourselves.

• The companies that run our infrastructure. Hosting, backups, account email, and the map services your browser fetches directly. Every one of them is named in the two tables below, with what it does and what it can see.
• OpenStreetMap — contributions you choose to give back become part of the open map under the ODbL. That is public, open data, not personal data about you.
• No one else. We don't sell personal data and we don't run third-party ad tracking.

The companies that handle data for us

Three companies hold or handle your data on our instructions. They are our processors: they may only do what we tell them to, under a written contract, and they may not use your data for anything of their own.

Services your browser contacts directly

The map is assembled in your browser, so a few pieces are fetched straight from the people who publish them rather than passing through us. We never hand them your account, your display name or your email address. They do see the network address your request comes from, because every request on the internet carries one. Nothing in this list loads until you open a page that uses it.

Two of these sit outside the European Economic Area (EEA): Esri and the Wikimedia Foundation, both in the United States. If you never open the satellite layer and never look at a page carrying a Commons photo, your browser never contacts either. See International transfers below.

International transfers

Some infrastructure providers may process data outside the European Economic Area. Where they do, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep it

• Account data. Until you delete your account, and then it is gone. Deletion is immediate: you ask, we email you a code, you confirm, and the account is removed from the live database in that moment. The email address, the password hash, the two-factor secret and the backup codes go with it. There is no waiting period and nothing is held back in case you change your mind. Two things are worth stating plainly. Our nightly backups still hold the old record until they rotate out, which takes at most 90 days; those backups are encrypted and are opened only to recover from a disaster. And we do not currently delete an account just because nobody has signed into it for years. If we ever start, we will write to you first and give you time to keep it.
• Server logs. Kept for at most 90 days, then deleted automatically. Some entries record a full IP address. Full addresses are held only briefly, for security and abuse handling.
• Rate-limit counters. One day.
• Contributions. Facts you give back to the open map persist as part of the Commons (with provenance), even after you leave; they are not personal data about you.
• Licence consents. When you licence a photo to the Commons we record that you agreed, the exact wording you agreed to, and when. We keep that record indefinitely, and it survives closing your account: it is our evidence that the licence was granted, which we may need to establish or defend a legal claim (Art. 17(3)(e)). It holds an account reference and nothing else about you, and once the account is gone that reference no longer identifies anyone here.
• Email you send us. We keep a conversation while the matter is open, and delete it within 24 months of it ending. That covers you coming back to us about the same thing a year later, and it covers us if a complaint about how we handled it arrives late. Threads that are part of a legal matter, such as a copyright claim or a takedown, are kept until that matter is finished.
• The release list. Your address stays on it until you take it off, from your settings or from the link in any message. We keep the record that you agreed, and to what wording, the same way we keep a photo licence consent: it is the evidence that we were allowed to write to you.

How we protect it

The law asks us to take measures that fit the risk (Art. 32). In plain words:

• Your password is never stored. We keep only a one-way scramble of it, so nobody here can read your password and a stolen database does not hand anyone yours either.
• Two-factor secrets and backup codes are encrypted where they sit, with the key held outside the database. Somebody who steals only the database still cannot produce a working code.
• Everything travels encrypted, between you and us and again when a backup leaves our servers. Browsers are told to refuse an unencrypted connection to us at all.
• Only the people who need your data can reach it, and every moderator and administrator has to use two-factor sign-in. Repeated failed sign-ins are slowed down and then locked out.

That is the short version. The exact measures, and the reasoning behind each one, are in our public source code, which is the point of building it in the open: you do not have to take a security paragraph on trust.

No system is perfect and we will not pretend ours is. There is no certification behind that paragraph and no penetration test: what there is, is a small system that keeps as little as it can, and code anyone can check.

If data ever leaks

If personal data is lost, exposed, or reached by somebody who should not have it, and that is likely to put people's rights at risk, we report it to the Autoriteit Persoonsgegevens within 72 hours of finding out (Art. 33). If the risk to you personally is high, we also contact you directly and without delay (Art. 34), in plain language: what happened, which of your data was involved, what we have done about it, and what you should do. We keep an internal record of every breach, including the ones we are not obliged to report, so the pattern stays visible to us even when no single one is reportable.

Your rights

Under the GDPR you have the following rights:

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — correct anything inaccurate, or complete anything missing.
• Erasure (Art. 17) — delete your account at any time from your account settings. Your personal data goes with it and does not come back. Two things deliberately survive, and neither identifies you afterwards: the contributions you gave to the open map, and the record that you granted a photo licence. Both are described under How long we keep it above.
• Data portability (Art. 20) — download everything we hold about you as a single ZIP file, any time, from your account settings. It holds your account details, your contributions, your messages, your licence consents, and your photos as files.
• Restriction and objection (Arts. 18–21) — restrict or object to certain processing.
• Withdraw consent at any time (e.g. by turning off your public profile) — this doesn't affect processing already done.
• Not a user? These rights don't depend on having an account. If you are recognisable in a photo on our map, every photo page carries a "this photo shows me" link. Report it there, no account and no ID required, and a curator answers within one month at the latest.

To exercise any of these, email info@cyclingcommons.org (or use the Contact). We answer within one month at the latest, and usually much sooner. The law allows up to three months for a request that is genuinely complicated, but only if we tell you inside the first month that we are taking longer, and why. If you are unhappy with our answer, you can complain to the Autoriteit Persoonsgegevens.

Children

The Commons isn't intended for children under 16. We don't knowingly collect personal data from anyone under that age; if you believe a child has given us data, contact us and we'll delete it.

Automated decisions

We don't make decisions about you by solely automated means, and we don't profile you for advertising.

Changes to this policy

If we change how we handle data, we'll update this page and its date, and — for material changes — let signed-in contributors know.

You can also check that for yourself instead of taking our word for it. The platform is open source, so this page and its wording live in a public repository, and every change to it is recorded with a date and a reason in the page history.