Legal
Privacy Policy
Last updated: 22 October 2026
RideWind is built to help you plan a ride, not to build a profile of you. This policy explains how route, account, feedback, and waitlist data are handled.
Security at a glance
RideWind uses encrypted HTTPS connections, strict browser security headers, input validation, and rate limiting. No security measure is absolute; do not upload sensitive information in a route name, GPX file, or feedback message.
Data controller and contact
Michael Kaserer is the controller responsible for processing personal data through RideWind. You can contact us about privacy or personal-data requests at hello@ridewind.app.
Michael Kasererc/o Factory Works GmbH
Rheinsberger Str. 76/77
10115 Berlin, Germany
The data we handle
RideWind does not require an account to analyse a route. When you analyse a route, we process the GPX file and the route details it contains, including coordinates, elevation, route name, planned departure time, and riding speed. Route data can reveal sensitive locations; upload only routes you are comfortable processing for this purpose.
The GPX upload is used to read and prepare the route. We do not intentionally retain the original GPX file after processing. Your current route may be kept in your browser’s session storage so it remains available while that browser tab is open; it is not an account history and can be cleared by closing the session or clearing browser data.
If you sign in and explicitly save a route, we retain its normalized route details and metadata in your RideWind account until you delete that route or delete your account. We do not retain the original GPX upload. Saved routes are private to your account and are not included in a share link unless you separately create one for an analysis.
If you install the RideWind Garmin beta, the data field sends your current coordinates and a random installation identifier to RideWind to request a forecast during a moving, recorded ride. It does not send your route, activity name, heading, speed, Garmin account, or hardware serial number. RideWind sends the centre of a rounded 0.05-degree location cell to Open-Meteo and keeps the forecast in a temporary server cache for five minutes. We do not save a location history or log device query values. The installation identifier stays on your device until its application storage is removed and supports temporary rate limiting; it is not linked to a RideWind account. The device keeps its last forecast in memory only.
A RideWind account contains your email address, a securely hashed password credential, and session records used to keep you signed in. When you request a password reset, we create a short-lived reset record and send a reset link to your account email. We do not store your plaintext RideWind password.
If you choose to connect Komoot, we use the email address and password you enter only to authenticate with Komoot. We retain the resulting Komoot API credential encrypted in our database so your account can list and import planned tours later. We do not retain your Komoot password, original imported GPX files, or a copy of your full Komoot tour library.
If you choose to connect Strava, Strava authorizes RideWind directly and we never receive your Strava password. We retain encrypted OAuth tokens with your RideWind account so we can list your saved routes, including routes you keep private in Strava, and download a route you select. RideWind requests the read_all permission only for this route-listing and route-import feature. Before connecting, RideWind records your consent version and time, explains this route-only access, and explains how to disconnect or request deletion. You can disconnect from the RideWind account or revoke access in your Strava account. When you disconnect, RideWind revokes the connection and confirms in the app that it deleted the credentials it stored. We do not retain original imported GPX files or a copy of your Strava route library. A Strava-imported route is retained only when you explicitly save it, under the same saved-route and share-link retention rules described in this policy.
If you create a share link, the route, trip settings, and forecast snapshot are stored so anyone with that link can view them. Share links are intentionally unlisted, but they are not access-controlled: treat them as public and do not share a route that reveals a location you wish to keep private. Shared snapshots expire after 30 days. When someone opens a future share whose forecast is more than 30 minutes old, RideWind may request a refreshed forecast using the stored route and trip settings.
If you join the race event pages waitlist, we store your email address, signup time, and the version of the consent notice you accepted in our Cloudflare D1 database. We use this information to send the product updates you requested. Joining does not create a RideWind account or subscribe you to unrelated marketing. We retain your entry while the waitlist is active, or until you ask us to remove it. You can withdraw consent and request removal by emailing hello@ridewind.app.
If you use the feedback form, we collect the message, optional email address, page context, and submission time so we can respond and improve the service. We also use limited request information, including IP-derived identifiers, temporarily for rate limiting and service protection. Platform hosting and observability may process technical request data such as IP address, browser details, request time, and error information to operate and secure the service.
Why and how we share data
We use route and trip data only to provide the requested analysis and sharing features. To generate forecasts, route coordinates and requested forecast times are sent to Open-Meteo. When you connect Komoot, we send the encrypted credential only from our server to Komoot to list your planned tours or download a tour you select. When you connect Strava, we use encrypted OAuth tokens only from our server to list your saved routes or download a route you select. The map can request map tiles from its map provider. Those providers may receive technical information such as your IP address under their own privacy practices. We do not sell personal information or use route data for targeted advertising.
We use Cloudflare to host and protect RideWind, operate our D1 database, and send password-reset email. You can read the relevant provider notices at Cloudflare Privacy Policy and Komoot Privacy Policy , as well as Strava Privacy Policy >, and Open-Meteo Terms and OpenFreeMap Terms information.
You can request a current list of RideWind processors and sub-processors, including the service they provide and their processing location where available, by emailing hello@ridewind.app.
Strava may collect and use technical usage data related to RideWind’s access to its API for its own business purposes, including support, compliance, and improvements to the Strava platform. Strava describes this processing in its privacy policy.
Your choices
Do not create a share link if you do not want others to access that ride snapshot. You can close your browser session or clear site data to remove locally stored route data. You can delete saved routes from My routes or permanently delete your account from Account. Account deletion removes your account, sessions, password credential, saved routes, encrypted Komoot connection, and encrypted Strava OAuth connection. To ask about, access, correct, or delete feedback you submitted, email hello@ridewind.app with enough detail to locate it. Where applicable, you may also have rights to object, restrict processing, withdraw consent, or complain to your local data-protection authority.
Security and questions
RideWind applies restrictive content, framing, referrer, and browser-permission policies. Requests are validated and rate-limited, and shared ride records expire automatically. Keep share links private and report a suspected vulnerability through the Feedback form rather than publicly disclosing it. Use hello@ridewind.app for privacy questions or data requests.