Privacy policy

Who controls your data

MXDuro is the service operator and data controller for information used to provide MXDuro. Privacy questions and rights requests can be sent to info@mxduro.co.uk.

What we collect

• Account information, including your email address and permanent account identifier.
• Profile information you provide, such as rider name, date of birth, age band, chosen town or region, discipline, bike details, biography and social links.
• Activity such as event attendance, connections, messages, reports, ride plans, referrals, rewards and subscription status.
• Media and posts you choose to upload. Profile and feed images are re-encoded and embedded metadata is removed before storage. Avatar source photos are transient and are not published.
• Technical, security and consent records needed to operate the service, prevent abuse and remember your settings.

SMS signup records

For people who previously opted in to MXDuro launch texts, we retain the mobile number, consent wording and version, signup time and source for the communications they agreed to receive. The homepage no longer collects SMS signups. Numbers and consent records are encrypted in private Supabase storage and accessible only to authorised operators. We may export opted-in contacts to our SMS provider when messaging is configured. We do not sell this list. Phone ownership is not verified by this form.

Each text will include an unsubscribe option. You can also withdraw consent or request deletion by emailing info@mxduro.co.uk. Opt-outs are excluded from future exports and are not reversed by repeat form submissions. We retain the signup while this launch list is active, review it at least annually, and keep only the suppression and consent evidence needed to respect opt-outs and resolve disputes. For abuse prevention, we store encrypted rate-limit records identified by a time-limited hash, not raw IP addresses.

Location and public visibility

MXDuro does not store your live map position. Your profile stores only the town or region you choose. Adults can choose to appear in rider discovery and on the map. Map avatars appear only when at least five discoverable adults are grouped together, are scattered synthetically inside the broad area, and shift every ten minutes. They never represent a home, bike or live position. Riders aged 16–17 remain private. Email addresses, dates of birth and precise locations are never included in public rider previews.

Why we use it

We use information to create and recover your account, provide maps and events, operate rider features, protect younger riders, moderate content, prevent fraud and theft risk, deliver essential service messages, honour your settings and meet legal obligations. Optional marketing is based on your consent and can be withdrawn.

Website analytics

We use Vercel Web Analytics to understand website visits and download-button use. Download events record only the platform and button placement, not account details, email addresses or precise location. We do not include support requests, SMS pages or admin pages in website analytics.

Service providers

We use specialist hosting, database, authentication, email, mapping, moderation, analytics and payment providers where configured. They process information only to provide their services to MXDuro. We do not sell personal information.

Retention and deletion

Your account remains available until you delete it. You can start account deletion inside the iOS or Android app, or request deletion by emailing info@mxduro.co.uk from your account address. See our account deletion instructions. Public profile data, private profile details, device subscriptions, connections, profile media, feed posts, message attachments and contribution evidence are removed. Limited pseudonymised safety, moderation, reward and transaction records may be retained where necessary for law, fraud prevention, disputes or rider safety. Apple and Google Play subscriptions must be cancelled separately in the relevant store’s subscription settings.

Your rights

Depending on applicable UK data-protection law, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent. Contact us using the address above. You may also complain to the UK Information Commissioner’s Office.

Security, transfers and changes

We use access controls, private storage, signed sessions and data minimisation. No online service can promise absolute security. Some providers may process data outside the UK using recognised safeguards. Material policy changes will be shown in the service before they take effect.

For practical safety guidance, visit the Safety centre.