Privacy policy

What Ridden records about you, why it needs to, and what you can do about it.

Who is responsible

Ridden is a registered trade name of Lars van de Donk, registered with the Dutch Chamber of Commerce (KvK). Questions about your data, or a request to see or delete it, can go to privacy@ridden.club

What we record and why

Each kind of data says which basis we rely on. “Contract” means the part you asked for does not work without it. “Consent” means you actively said yes, and can take that back.

Your accountContract

Your email address and how you sign in (password or Google). Plus a username, and if you fill them in your name, profile picture, home park and favourite park. If you sign in with Google we copy your picture into our own storage, so your profile does not depend on an address at Google.

Your date of birthContract

Optional. We use it to record how old you were at each check-in, so you can look back at what age you first rode something. The date itself is never visible to anyone else.

What you logContract

Your check-ins, park visits, reviews and ratings, your wishlist, who you follow and who follows you, your badges and your credits. This is what Ridden is for: without it there is no logbook.

Your location at a live check-inConsent

Only when you check in at the park itself and your browser asks permission. We then keep the coordinates of that moment to confirm you were really there. Refuse, and the check-in still works, just without that confirmation. We never track your location in the background.

Your photosContract

Photos you add to a ride, with the visibility you choose: public or yours alone. Before we store one we strip the EXIF data — the GPS coordinates, the time and the device your camera writes into it. That never leaves your device. Each photo is also checked automatically by Google Gemini, before it is stored, for content that is not allowed: nudity, sexual images and graphic violence. Google does not use the photos to train its models. When the check is unsure, a moderator looks at the photo, even a private one.

Your review textContract

The text of a review passes through Google Gemini to work out its language, to keep abuse out, and to translate it on request. Criticism is never blocked, only abuse. A translation is kept alongside the review so the same text does not have to be sent again.

The assistantContract

Ask the Ridden assistant something and what you type goes through Google Gemini, which writes the answer. To answer a question about you, such as your credits, the rides you have not ridden yet or where you sat, the assistant looks up your own numbers on Ridden and those pass through Gemini for that answer too. That is limited to your own account: never another rider's name, and never the people you were with or the notes you wrote. Under 16 the assistant looks up your own numbers in the same way, but does not log rides. When you ask it to log rides, nothing is logged until you press the button on the card it shows. A contact card it fills in is sent only when you press send, like the suggestion form. Google does not use this to train its models. How long we keep the conversation is under its own heading below.

Conversations with the assistantLegitimate interest

We keep what you and the assistant wrote to each other, with the page you had open, the tools it used and whether it could answer, for 30 days, and then it is deleted automatically. We use it to see where the assistant goes wrong and to improve its instructions, our help texts and our data, and to test changes before they go live. It is not used to train a model of our own or of Google. E-mail addresses and phone numbers you type are removed before it is stored. It is linked to your account when you are signed in, so deleting your account deletes it, and it is not shown with your name. Only a Ridden admin can read it. We do not keep it when you are under 16, or when you tick "Do not keep this conversation" in the assistant, which is remembered in this browser. We also keep a counter of your questions for 24 hours, per account or, when you are not signed in, per IP address, without what was asked, to keep the assistant free of abuse. Our interest is an assistant that gets better and a record of what it did when something goes wrong.

NewsletterConsent

Only your email address and your language. You first get a mail to confirm it is really you; without that we never send you anything. Every newsletter carries an unsubscribe link that works without signing in.

Invitations by emailLegitimate interest

If you invite someone by email, we send that person one email. We do not keep the address; only a code derived from it that cannot be turned back into the address, to prevent duplicate emails and to remember that someone does not want invitations.

Reports about wrong dataLegitimate interest

If a height or opening year is wrong you can tell us, with or without an account. If you are signed in we link the report to your account so we can come back to you. Our interest is a database that is correct.

SubscriptionsContract

If you take Premium or Creator we keep your plan, its status, a Stripe customer number and the end date of your period, so we know what your account may do. Your payment details live with Stripe, not with us. A memory, photo or video you post as a Premium or Creator member is kept like the rest of your content.

Visitor statisticsLegitimate interest

We count page views and visitors through our hosting provider, without cookies. Per visit we see the page, the country, the device type and where you came from. Your IP address is used to recognise repeat visits within one day and is not kept after that. Nothing is followed across sites and nothing is linked to you as a person. Our interest is knowing whether Ridden is used and where it falters.

Under 16

If you are under 16 you may only create a Ridden account with permission from a parent or guardian. If it turns out that permission was not given, we delete the account and everything attached to it. Parents with a question about this can mail the address at the top of this page.

How long we keep it

For as long as your account exists. Delete your account and your profile, check-ins, park visits, reviews, photos, wishlist, follows and badges go with it immediately — including the image files at our image provider. Two things stay, without your name on them: reports about wrong data and contributions to ride trivia. Those are about the data rather than about you, and removing them would make everyone else's information worse. Your newsletter subscription goes when your account does; if you only unsubscribe, we keep the fact that you unsubscribed, so someone else cannot simply sign you up again.

Who else processes it

Ridden does not run on its own. These are the parties that actually see data of yours, and what for.

  • Supabase — our database and sign-in system. Everything lives here. Hosted in the EU.
  • Vercel — hosts the site and provides the cookieless visitor statistics. Sees your IP address doing so, like any host, and does not keep it.
  • ImageKit — stores and serves the photos, yours included.
  • Google Gemini — sees the text of your reviews for language detection, moderation and translation, and the photos you add, to check them for content that is not allowed. When you use the assistant it also sees what you type there and, for questions about you, the numbers it looks up for the answer. Not your name or your account.
  • Resend — sends the confirmation mail and the newsletter. Gets only your email address.
  • Stripe — processes payments for Premium and Creator. You enter card or bank details on Stripe's own page and they never reach us; we only keep a customer number, your subscription status and the email address you gave at checkout. Stripe is itself responsible for handling VAT.
  • YouTube — serves the preview images of videos creators link to rides, and sees your IP address doing so. We do not play videos on Ridden; you click through to YouTube.
  • OpenStreetMap — serves the maps, and turns a place name into coordinates when you sort by distance.
  • Google Fonts — serves the typefaces, and sees your IP address doing so.

What you can do with your data

You have the right to see your data, to have it corrected, and to have it deleted. At Ridden you do not have to file a request for any of that: your profile has two buttons that download everything in one file or wipe your account for good. Corrections you make yourself in your profile settings. If you get stuck, or want to object to a particular use, mail the address at the top.

What we don't do

We do not sell your data, do not rent it out, and show no advertising. There is no tracking on the site and no third-party cookies; the visitor statistics work without cookies and without personal data. If that changes, it will say so here and on the cookies page before it goes live.

If you are not happy

If we cannot sort it out between us, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would rather you mailed us first — chances are it can simply be fixed.

Changes

If something material changes about what we process, we update this page before that change goes live, not after.

Last updated: 15 October 2026