Privacy policy

Who controls your data

MXDuro is the service operator and data controller for information used to provide MXDuro. Privacy questions and rights requests can be sent to info@mxduro.co.uk.

What we collect

• Account information, including your email address and permanent account identifier.
• Profile information you provide, such as rider name, date of birth, age band, chosen town or region, discipline, bike details, biography and social links.
• Activity such as event attendance, connections, messages, reports, ride plans, referrals, rewards and subscription status.
• Media and posts you choose to upload. Profile and feed images are re-encoded and embedded metadata is removed before storage. Avatar source photos are transient and are not published.
• Technical, security and consent records needed to operate the service, prevent abuse and remember your settings.

SMS signup records

For people who previously opted in to MXDuro launch texts, we retain the mobile number, consent wording and version, signup time and source for the communications they agreed to receive. The homepage no longer collects SMS signups. Numbers and consent records are encrypted in private Supabase storage and accessible only to authorised operators. We may export opted-in contacts to our SMS provider when messaging is configured. We do not sell this list. Phone ownership is not verified by this form.

Each text will include an unsubscribe option. You can also withdraw consent or request deletion by emailing info@mxduro.co.uk. Opt-outs are excluded from future exports and are not reversed by repeat form submissions. We retain the signup while this launch list is active, review it at least annually, and keep only the suppression and consent evidence needed to respect opt-outs and resolve disputes. For abuse prevention, we store encrypted rate-limit records identified by a time-limited hash, not raw IP addresses.

Location and public visibility

MXDuro does not store your live map position. Your profile stores only the town or region you choose. Adults can choose to appear in rider discovery and on the map. Map avatars appear only when at least five discoverable adults are grouped together, are scattered synthetically inside the broad area, and shift every ten minutes. They never represent a home, bike or live position. Riders aged 16–17 remain private. Email addresses, dates of birth and precise locations are never included in public rider previews.

Why we use it

We use information to create and recover your account, provide maps and events, operate rider features, protect younger riders, moderate content, prevent fraud and theft risk, deliver essential service messages, honour your settings and meet legal obligations. Optional marketing is based on your consent and can be withdrawn.

Website analytics

With your permission, we use Vercel Web Analytics to understand website visits and download-button use. Download events record only the platform and button placement, not account details, email addresses or precise location. We do not include support requests, SMS pages or admin pages in website analytics.

Optional product analytics

With your permission, we record visits, button actions and outcomes to improve MXDuro. These use random or pseudonymous identifiers. We exclude emails, passwords, codes, message and search text, uploaded media and precise GPS. Session recordings and automatic text capture are disabled. Use Analytics preferences to decline or withdraw at any time. Detailed MXDuro reporting records are kept for up to 90 days; daily aggregates for up to 13 months. PostHog EU reporting is connected, but collection to that provider starts only after its deletion controls are configured and the retention disclosure is updated.

Service providers

We use specialist hosting, database, authentication, email, mapping, moderation, analytics and payment providers where configured. They process information only to provide their services to MXDuro. We do not sell personal information.

Retention and deletion

Your account remains available until you delete it. You can start account deletion inside the iOS or Android app, or request deletion by emailing info@mxduro.co.uk from your account address. See our account deletion instructions. Public profile data, private profile details, device subscriptions, connections, profile media, feed posts, message attachments and contribution evidence are removed. Limited pseudonymised safety, moderation, reward and transaction records may be retained where necessary for law, fraud prevention, disputes or rider safety. Apple and Google Play subscriptions must be cancelled separately in the relevant store’s subscription settings.

Your rights

Depending on applicable UK data-protection law, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent. Contact us using the address above. You may also complain to the UK Information Commissioner’s Office.

Security, transfers and changes

We use access controls, private storage, signed sessions and data minimisation. No online service can promise absolute security. Some providers may process data outside the UK using recognised safeguards. Material policy changes will be shown in the service before they take effect.

For practical safety guidance, visit the Safety centre.

Organiser portal

We use your verified email and account identifier to let you upload and manage your own listings. We store submitted text, metadata-stripped images, earlier submission versions and private action records for source checking, corrections and abuse prevention. Upload checks use our moderation provider. Approved listing details may appear on the public map; your login email is not published. Deleting a listing withdraws its linked event but does not immediately erase its private source history. Contact info@mxduro.co.uk for an account or source-data deletion request; we assess any limited safety, dispute or legal retention separately.

The portal uses essential, secure sign-in cookies to remember this device for up to 90 days, subject to session expiry or revocation. Your browser also remembers the email address you last used so you don’t have to retype it. It does not collect website analytics. Sign out on shared devices.