Privacy Policy

Account information. When you sign up, we receive:

• Your email address (from Apple Sign In, or directly if you sign up with email and password)
• Your name (you can change this)
• A hashed version of your password if you use email sign-in. We never see or store your password in plain text.

Profile information you choose to add. This includes a profile photo, a short bio, and your typical riding pace or preferred ride type. None of this is required to use Rollout — leave any field blank if you'd rather not share.

Ride data. When you create or join a ride, we store the ride details (route, time, who's in it) and your participation. This is necessary for the app to function.

Location, while you're using the app. When you browse the map for nearby rides, the app asks iOS for your current location and uses it to show what's near you. We don't store your location on our servers and we don't track your location in the background. Your phone only shares your location with Rollout while the app is open. You can turn this off in iOS Settings → Privacy → Location Services → Rollout.

Device tokens for notifications. If you opt in to push notifications, we store an anonymous device token so we can send you alerts about rides you've joined or messages from other riders. You can turn notifications off any time in iOS Settings.

Other Rollout users. When you join a ride, the other riders on that ride can see your name, profile photo, bio, and any messages you send to the ride chat. That's the point of the app.

Service providers. We use a small number of services to make Rollout work:

• Supabase — our database and authentication provider. Your account data is stored on Supabase servers in the EU (eu-west-1, Ireland). supabase.com/privacy
• Expo — our mobile push notification delivery service. They handle device tokens and forward push messages to Apple's notification service. expo.dev/privacy
• Apple — if you use Sign In with Apple, Apple processes that authentication. We only receive your name and email (or a private relay email if you chose to hide it).
• Netlify — hosts our website. They process server logs (IP addresses) for the rollout.bike website, but not the mobile app's data. netlify.com/privacy

We don't share data with anyone else. If that ever changes, this policy will be updated and existing users notified.

We keep your data while your account is active. If you delete your account, we delete your profile, your messages, and your ride history within 30 days. Rides you participated in may still appear in other users' history (e.g. "Alex rode this with you in March 2026") with your name removed.

Some data may be retained longer if we're legally required to (we'll tell you if that ever applies to your situation).

Under UK GDPR, you have the right to:

• Access the data we hold about you
• Correct anything that's wrong
• Delete your account and the data tied to it
• Export your data in a portable format
• Object to how we process your data
• Complain to the UK ICO at ico.org.uk if you think we've messed up

To do any of these, email hello@rollout.bike. We'll respond within 30 days. Account deletion can also be done in-app under Settings → Account.