Privacy policy

What Ridden records about you, why it needs to, and what you can do about it.

Who is responsible

Ridden is a registered trade name of Lars van de Donk, registered with the Dutch Chamber of Commerce (KvK). Questions about your data, or a request to see or delete it, can go to privacy@ridden.club

What we record and why

Each kind of data says which basis we rely on. “Contract” means the part you asked for does not work without it. “Consent” means you actively said yes, and can take that back.

Your accountContract

Your email address and how you sign in (password or Google). Plus a username, and if you fill them in your name, profile picture, home park and favourite park. If you sign in with Google we copy your picture into our own storage, so your profile does not depend on an address at Google.

Your date of birthContract

Optional. We use it to record how old you were at each check-in, so you can look back at what age you first rode something. The date itself is never visible to anyone else.

What you logContract

Your check-ins, park visits, reviews and ratings, your wishlist, who you follow and who follows you, your badges and your credits. This is what Ridden is for: without it there is no logbook.

Your location at a live check-inConsent

Only when you check in at the park itself and your browser asks permission. We then keep the coordinates of that moment to confirm you were really there. Refuse, and the check-in still works, just without that confirmation. We never track your location in the background.

Your photosContract

Photos you add to a ride, with the visibility you choose: public or yours alone. Before we store one we strip the EXIF data — the GPS coordinates, the time and the device your camera writes into it. That never leaves your device.

Your review textContract

The text of a review passes through Google Gemini to work out its language, to keep abuse out, and to translate it on request. Criticism is never blocked, only abuse. A translation is kept alongside the review so the same text does not have to be sent again.

NewsletterConsent

Only your email address and your language. You first get a mail to confirm it is really you; without that we never send you anything. Every newsletter carries an unsubscribe link that works without signing in.

Reports about wrong dataLegitimate interest

If a height or opening year is wrong you can tell us, with or without an account. If you are signed in we link the report to your account so we can come back to you. Our interest is a database that is correct.

SubscriptionsContract

If you take Premium or Creator we keep your plan, its status, a Stripe customer number and the end date of your period, so we know what your account may do. Your payment details live with Stripe, not with us. A memory, photo or video you post as a Premium or Creator member is kept like the rest of your content.

Visitor statisticsLegitimate interest

We count page views and visitors through our hosting provider, without cookies. Per visit we see the page, the country, the device type and where you came from. Your IP address is used to recognise repeat visits within one day and is not kept after that. Nothing is followed across sites and nothing is linked to you as a person. Our interest is knowing whether Ridden is used and where it falters.

Under 16

If you are under 16 you may only create a Ridden account with permission from a parent or guardian. If it turns out that permission was not given, we delete the account and everything attached to it. Parents with a question about this can mail the address at the top of this page.

How long we keep it

For as long as your account exists. Delete your account and your profile, check-ins, park visits, reviews, photos, wishlist, follows and badges go with it immediately — including the image files at our image provider. Two things stay, without your name on them: reports about wrong data and contributions to ride trivia. Those are about the data rather than about you, and removing them would make everyone else's information worse. Your newsletter subscription goes when your account does; if you only unsubscribe, we keep the fact that you unsubscribed, so someone else cannot simply sign you up again.

Who else processes it

Ridden does not run on its own. These are the parties that actually see data of yours, and what for.

  • Supabase — our database and sign-in system. Everything lives here. Hosted in the EU.
  • Vercel — hosts the site and provides the cookieless visitor statistics. Sees your IP address doing so, like any host, and does not keep it.
  • ImageKit — stores and serves the photos, yours included.
  • Google Gemini — sees the text of your reviews for language detection, moderation and translation. Not your name or your account.
  • Resend — sends the confirmation mail and the newsletter. Gets only your email address.
  • Stripe — processes payments for Premium and Creator. You enter card or bank details on Stripe's own page and they never reach us; we only keep a customer number, your subscription status and the email address you gave at checkout. Stripe is itself responsible for handling VAT.
  • YouTube — serves the preview images of videos creators link to rides, and sees your IP address doing so. We do not play videos on Ridden; you click through to YouTube.
  • OpenStreetMap — serves the maps, and turns a place name into coordinates when you sort by distance.
  • Google Fonts — serves the typefaces, and sees your IP address doing so.

What you can do with your data

You have the right to see your data, to have it corrected, and to have it deleted. At Ridden you do not have to file a request for any of that: your profile has two buttons that download everything in one file or wipe your account for good. Corrections you make yourself in your profile settings. If you get stuck, or want to object to a particular use, mail the address at the top.

What we don't do

We do not sell your data, do not rent it out, and show no advertising. There is no tracking on the site and no third-party cookies; the visitor statistics work without cookies and without personal data. If that changes, it will say so here and on the cookies page before it goes live.

If you are not happy

If we cannot sort it out between us, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would rather you mailed us first — chances are it can simply be fixed.

Changes

If something material changes about what we process, we update this page before that change goes live, not after.

Last updated: 16 September 2026