Privacy Policy

1. Introduction

Grvly ("we", "us", or "our") operates the Grvly gravel route planning service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

Account Information

When you create an account or join our waitlist, we collect your email address, name, and country. Your password is stored only as a secure hash and is never accessible in plain text.

Route Data

When you create, save, or share routes, we store your route geometry, route names, descriptions, tags, and associated metrics such as distance and surface scores.

Road Quality Feedback

When you submit road quality feedback (golden nuggets), we store the road segment location, your sentiment rating, surface type notes, and the associated geographic coordinates.

Favourite Locations

When you save favourite locations, we store the place name, address, and geographic coordinates.

Usage Data

We automatically collect certain information when you access our service, including analytics data about how you interact with the application. This is collected through Vercel Analytics.

3. How We Use Your Information

• To provide and maintain our route planning service
• To manage your account and authentication sessions
• To enable route sharing and collaboration with other users
• To improve gravel road data quality through aggregated community feedback
• To send you service-related emails such as account verification, password resets, and invitation notifications
• To manage our waitlist and referral system
• To monitor and improve the performance and reliability of our service

4. Third-Party Services

We use the following third-party services that may process your data:

• Google Places API — to provide location search functionality. Search queries you enter may be sent to Google.
• Wahoo — if you choose to connect your Wahoo account, we exchange route data with Wahoo to sync routes to your cycling device.
• Brevo — to send transactional emails such as account verification and password reset messages. Your email address is shared with Brevo for this purpose.
• Sentry — to monitor errors and improve service reliability. Error reports may include technical information about your session.
• Vercel Analytics — to collect anonymous usage analytics about how the service is used.

5. Data Sharing

We do not sell your personal information. Your route data is private by default. When you generate a share link for a route, that route becomes accessible to anyone with the link. Road quality feedback you submit may be used in aggregated form to improve routing for all users.

6. Data Security

We implement appropriate technical measures to protect your information. Passwords are hashed using bcrypt. Sessions are managed with secure, hashed tokens with automatic expiration. All data is transmitted over HTTPS.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal data, routes, and associated content will be permanently removed. Session data expires automatically and is cleaned up periodically.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Update or correct your account information through the settings page
• Delete your account and all associated data
• Disconnect third-party integrations such as Wahoo at any time
• Request a copy of your data by contacting us

9. Cookies

We use essential cookies to manage your authentication session. These cookies are necessary for the service to function and cannot be disabled. We do not use advertising or tracking cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date.

11. Contact

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us through the application.