Privacy Policy

We take the protection of your personal data very seriously. This Privacy Policy explains which data we process when you use SunRide, why we process it, and which rights you have.

1. Controller

• Name: Martin Förstemann
• Address: 9000 St. Gallen, Switzerland
• Email: info@sunride-weather.com
• EU representative (Art. 27 GDPR): We are currently in the process of appointing a representative in the European Union pursuant to Art. 27 GDPR. Until this appointment is complete, please direct any data protection inquiries to the email address above.

2. Categories of Data Processed

• Account data: username, email address, and password.
• Route/GPX data: uploaded GPX files and processed route/analysis values. Optionally, GPX files saved as favorites permanently stored in the application database.
• Rider and performance profile: optional details you provide such as weight, height, age, gender, training metrics (e.g. power threshold, resting/max heart rate, oxygen uptake), self-rated fitness level, and cold sensitivity, used to calculate personalized clothing and nutrition recommendations. If you don't enter a power threshold, we estimate one from your weight and self-rated fitness level instead.
• Wardrobe data: clothing items you enter and their properties (e.g. brand, thermal properties), so we can recommend suitable clothing from your own inventory.
• Nutrition data: food items and nutritional values you enter, used to calculate personalized nutrition recommendations for your ride.
• Weather-related data: weather requests and weather results linked to your route points.
• Location data: optional location (lat/lon) for weather features; alternatively default/IP-based approximation.
• Payment and subscription data: when you purchase a paid plan, our payment provider Stripe processes your payment details (e.g. payment method, billing details). We do not receive your full payment data ourselves — only subscription/transaction identifiers and, to prevent repeated use of free trials, a non-reversible payment-method identifier provided by Stripe.
• Usage and log data: e.g. usage information and security-relevant events.
• Communication data: contact, feedback and password-reset related data.

3. Purposes and Legal Bases

• Performance of contract: providing core app functions (account, GPX processing, weather display, clothing and nutrition recommendations) and processing paid subscriptions and purchases.
• Consent: optional cookies and related features.
• Legitimate interests: IT security, abuse prevention (including preventing repeated use of free trials), error analysis, and system stability.
• Legal obligations: where retention/disclosure is required by law.

4. Cookies and Similar Technologies

• Essential cookies: for operation, security, and sign-in.
• Long-term login: cookie for sign-in across sessions (up to 30 days).
• Consent cookie: cookie storing your choice (up to 365 days).
• Optional Weather/Location cookies: location cookies (up to 365 days), only if selected.
• No tracking or marketing cookies are used.
• You can delete or block cookies at any time via your browser settings.
• You can change your preference at any time in settings; optional location cookies are removed when switching to essential-only.

5. Recipients and Third-Party Services

We do not sell personal data. To provide specific features, we use external services that receive the following data:

• MET Norway (Norway): coordinates (latitude, longitude, altitude) for weather forecasts at route points.
• OpenTopoData: coordinates (latitude, longitude) for elevation data calculation.
• Google reCAPTCHA (Google LLC, USA): IP address, user interactions (clicks, mouse movements) and user-agent for bot detection during registration and login.
• Google Geocoding (Google LLC, USA): coordinates to resolve place and city names from route points.
• Mapbox (USA): map requests (zoom, view, coordinates) and IP address for displaying interactive route maps.
• ipinfo.io: IP address (in browser, not transmitted by us) for fallback location approximation if geolocation is unavailable.
• Stripe (payment provider, Switzerland): payment and subscription data to process paid purchases and to prevent trial abuse.
• SMTP/Email Service Providers: email address for sending verification emails, password reset links, and contact/feedback responses.

6. Server Location and International Data Transfers

Our application is hosted on servers located in Germany (EU). Some of the providers listed above may nonetheless process data outside Switzerland and/or the EEA, in particular in the USA. Where required, such transfers are based on recognized safeguards (e.g., adequacy decisions or Standard Contractual Clauses) under applicable law.

7. Retention and Deletion

• Account data, your rider and performance profile, and your wardrobe and nutrition data are generally stored until your account is deleted.
• On account deletion, account records, your rider and performance profile, wardrobe and nutrition data, saved favorite GPX files, and associated user files are deleted (subject to legal retention obligations).
• An active subscription is cancelled at the end of the current billing period upon account deletion; any residual payment data remains with our payment provider only as long as legally required.
• Weather/intermediate data and temporary GPX data are regularly cleaned/overwritten during operation.
• Log data is retained only as long as required for security, operation, and legal obligations.
• Cookie lifetimes: long-term login up to 30 days; consent and optional location cookies up to 365 days.

8. Your Rights

Under applicable data protection law, you may have rights to access, rectification, deletion, restriction, objection, and data portability. You may withdraw consent at any time with effect for the future.

Where the GDPR applies, you additionally have the right to lodge a complaint with a data protection supervisory authority in an EU member state.

9. Data Security

We implement appropriate technical and organizational safeguards to protect your data against unauthorized access, loss, and misuse.

10. Automated Decision-Making

We do not carry out solely automated decision-making with legal or similarly significant effects under applicable data protection laws. Clothing and nutrition recommendations are non-binding suggestions without legal effect.

11. Changes to this Privacy Policy

We may update this Privacy Policy if features, processing operations, or legal requirements change. The current version published in the app applies.

12. Contact and Complaints

If you have questions about data protection, contact us at info@sunride-weather.com. You also have the right to lodge a complaint with a competent data protection supervisory authority. For Switzerland, this is in particular the Federal Data Protection and Information Commissioner (FDPIC/EDÖB).

Last updated: August 18, 2026