Privacy Policy

Effective [Effective date]

Rynlo lets you share your live location and activity stats with people you choose, and lets them send you text and voice messages while you're out. That means we handle sensitive information, including where you are. This policy explains what we collect, who can see it, and how to delete it. Rynlo is operated by [Operator / company name] (“we”, “us”).

The short version

Anyone with your share link can see your live location, route, stats and the messages sent to you, including voice notes. Share it only with people you trust.
We don't sell your data, show ads, or use third-party analytics or tracking cookies.
Activities, their routes and messages are deleted automatically 7 days after they end, unless you choose to keep them. Voice recordings are always deleted after 7 days.
You can delete any activity, along with its route, messages and voice recordings, at any time.

What we collect

If you create an account

Account details: your name, email address and password. We store your password only as a one-way hash (bcrypt), never in readable form.
Date of birth: your birth month and year (and the day, only if you turn 16 that month). We use it once, at sign-up, to check you're old enough, and we don't store it.

When you record an activity (iPhone app)

Location: GPS points (latitude, longitude, altitude, speed, accuracy and time) for the whole activity, including while your phone is locked. We only collect location while an activity is being recorded.
Activity details: sport, title, start and end times, distance, duration, moving time, elevation gain, max speed, and your most recent position.
Settings: whether viewers must sign in to message you.

When someone sends a message

Message content: the text, or the voice recording and its length.
Sender: the name the sender types (guests) or their account name (signed-in users).
Delivery details: when the message should play (now, at a distance, or at a time), and the athlete's location, distance and elapsed time when it was sent, delivered and played.

Technical information

IP address: used briefly in server memory to limit sign-in attempts and message spam. It is not saved to our database.
Server logs: request type, path, status and timing, used to keep the service running. Our hosting provider may also keep standard network logs.
On your device: the website stores your sign-in token, your profile and, for guests, the name you last used in your browser's local storage. The iPhone app stores your sign-in token in the iOS Keychain and your preferences on the device. We don't use cookies.

How we use it

To show your live map and stats to people with your link, and to keep your activity history.
To deliver messages to your phone at the right moment. Text is read aloud by your iPhone's built-in voice, which runs on the device.
To sign you in, secure your account and prevent abuse.
To email you a password reset link when you ask for one. We don't send marketing email. Reset links work once and expire after an hour.
To respond when you contact us.

We don't use your data for advertising, profiling, or training machine-learning models.

Who can see your information

People with your share link can see the athlete's name, the activity's title and sport, the full route, the current location, stats, the number of viewers, and every message sent to the activity, including sender names and voice recordings. The link keeps working after the activity finishes until the activity is deleted, either by you or automatically after 7 days if you don't keep it. Anyone you give the link to can pass it on.
You can see your own activities, routes, messages and where each message was heard.
Service providers that run Rynlo for us, under agreements to protect your data:
- Our hosting and database provider ([provider name, region]) stores the data described above.
- Resend delivers password reset emails, so it receives your email address, name and the reset link. See Resend's Privacy Policy.
- Apple Maps (MapKit) draws the maps on the website and in the app. When a map loads, your browser or phone requests map images from Apple, which receives your IP address and the area being viewed. See Apple's Privacy Policy.
Legal reasons: we may disclose information if the law requires it, or to protect someone's safety.

We do not sell or rent personal information.

How long we keep it

Activities, with their routes and messages, are deleted automatically 7 days after the activity ends (or 7 days after its last location update, if it was never finished). If you choose to keep an activity, it stays until you delete it.
Voice recordings are deleted 7 days after they're sent, even on kept activities. The message stays in the history, marked as expired.
You can delete an activity sooner at any time, which permanently removes its route, messages and audio files.
Your account is kept until you delete it. Deleting your account permanently deletes all its activities, routes, messages and voice recordings straight away.
If you sent a message while signed in and later delete your account, that message stays on the athlete's activity under your name, but it is no longer linked to your account.
Backups are overwritten within [30] days.

Your choices and rights

Delete an activity: from its page on the website or from History in the app.
Delete your account: from Account on the website or Settings → Delete account in the app. You'll be asked for your password.
Export your route: download any activity as a GPX file from its page on the website.
Control messages: require viewers to sign in before they can message you.
Location permission: you can turn off location access for Rynlo in iOS Settings at any time. You won't be able to record activities without it.
Access, correction and deletion: email [privacy@yourdomain.com] to get a copy of your data or correct it. We'll respond within 30 days. Depending on where you live (for example, under the New Zealand Privacy Act 2020, the EU or UK GDPR, or California law), you may have further rights, including to object or complain to your local data protection authority.

Security

We hash passwords, use HTTPS for data in transit, keep sign-in tokens in secure storage on iPhone, and limit access to our database. No service is perfectly secure, so please use a unique password and be careful who you share your link with.

Where data is stored

Your data is stored in [country/region]. If you use Rynlo from somewhere else, your information is transferred there, and we protect it as described in this policy.

Children

Rynlo is not for children under 16, and sign-up checks your date of birth. If you believe a child has given us personal information, contact us and we'll delete it.

Changes

If we make material changes to this policy, we'll update the effective date and let account holders know before the changes take effect.

Contact

[Operator / company name]
[Postal address]
[privacy@yourdomain.com]