Privacy

What we collect, and why.

Plain language. The Cycling Commons is built to need as little personal data as possible — and to keep what you contribute separate from who you are. Here's what we hold, why, and the control you have over it.

This is a prototype — a first draft of our intentions, not final or binding policy. It sets out how we intend the Cycling Commons to handle personal data, written to align with the GDPR and the Dutch UAVG. It will change before launch.

Last updated 22 June 2026 · draft v0.1

Who is responsible

The data controller is BikeCoders (bikecoders.life), based in the Netherlands, which stewards the Cycling Commons today. As set out in our governance, the Commons is committed to spinning out to an independent Dutch foundation (Stichting); the controller will transfer accordingly, and this page will be updated.

Questions about your data: info@cyclingcommons.org. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

What we collect

We ask for the minimum needed to run an open, accountable map. We never ask for your real name.

When you create an account

  • Your email address — to sign you in, secure the account, and send essential service messages.
  • A password, which we store only as a salted hash — we never see or keep the plain text.
  • A display name you choose — it can be a pseudonym, and it's all anyone else sees.

When you contribute

  • The climbs, places, fixes and votes you submit, and the fact that an account made them (provenance). If your profile is private, contributions stay anonymous.
  • Any photos or video you upload. Media can carry embedded metadata (EXIF) such as a capture location — we strip location metadata from uploaded media on our side.
  • Optional public-profile details you fill in (bio, links, which contributions to show). Profiles are opt-in and off by default.

Automatically, when you use the site

  • Technical data — IP address, browser type, and timestamps in our server logs, kept to operate and secure the service.

Why we use it (legal bases)

  • To provide your account and the service — performance of a contract (GDPR Art. 6(1)(b)).
  • Optional public profile and media display — your consent (Art. 6(1)(a)), which you can withdraw any time in settings.
  • Security, abuse prevention, and aggregate analytics — our legitimate interests in keeping the Commons honest and working (Art. 6(1)(f)).
  • Meeting legal obligations — where the law requires it (Art. 6(1)(c)).

Cookies & analytics

We keep this light. We use a single essential cookie to keep you signed in — no advertising or cross-site tracking cookies. For usage statistics we run self-hosted, cookieless analytics (Umami, on our own infrastructure): we count page views and referrers in aggregate — no analytics cookies, no personal data, and no cross-site or cross-device tracking. Nothing is shared with, or sold to, third-party ad networks or data brokers.

Who we share it with

  • Infrastructure providers that help us run the site (hosting, and for the map: the tile and street-imagery providers such as the map library CDN and Mapillary). These may process your IP address to deliver content. They act as our processors or independent controllers for that delivery.
  • OpenStreetMap — contributions you choose to give back become part of the open map under the ODbL. That is public, open data, not personal data about you.
  • No one else. We don't sell personal data and we don't run third-party ad tracking.

International transfers

Some infrastructure providers may process data outside the European Economic Area. Where they do, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep it

  • Account data — while your account is open, plus a short grace period after you close it.
  • Server logs — kept briefly for security and troubleshooting, then deleted or anonymised.
  • Contributions — facts you give back to the open map persist as part of the Commons (with provenance), even after you leave; they are not personal data about you.

Your rights

Under the GDPR you can ask us to:

  • Access a copy of the personal data we hold about you, and port it elsewhere.
  • Correct anything inaccurate, or complete anything missing.
  • Erase your account and personal data, and restrict or object to certain processing.
  • Withdraw consent at any time (e.g. by turning off your public profile) — this doesn't affect processing already done.

To exercise any of these, email info@cyclingcommons.org. We'll respond within one month. If you're unhappy with our response, you can complain to the Autoriteit Persoonsgegevens.

Children

The Commons isn't intended for children under 16. We don't knowingly collect personal data from anyone under that age; if you believe a child has given us data, contact us and we'll delete it.

Automated decisions

We don't make decisions about you by solely automated means, and we don't profile you for advertising.

Changes to this policy

If we change how we handle data, we'll update this page and its date, and — for material changes — let signed-in contributors know.

See also our Terms of Use and the data, media and code licences.