Privacy
Last updated: 1 November 2026
The short version. No account and no password. On the public map your position is rounded to about 300 metres, and it is deleted when you press Done. Your exact position goes only to the riders you join tonight. We never store your speed and never keep a history of where you rode. There is no analytics or advertising code in the app. The website uses Meta and Google cookies only if you say OK.
1. About this policy
This policy covers the Midnight Ride website, the browser app at /app, and the future iPhone and Android apps. It explains what personal data we process, why, and your rights under the EU General Data Protection Regulation (GDPR).
2. What we collect
2.1 Your rider
There is no sign-up. The app gives you a random anonymous ID. You choose a nickname, bike or car, an optional make and model, and what you're up for. We count how many nights you've gone out (one number, used to make regulars' dots slightly brighter).
2.2 The waitlist
If you join the list we store your email address, iPhone or Android, whether you ride at night, where you joined (website or app) and, if you came from an ad, the campaign parameters in the link (utm_…). We send one email when the app launches. Nothing else.
2.3 Your position — only while you're out
- Public map. When you press I'm out, your position is rounded to a 300-metre grid on your phone before it is sent. Everyone signed in can see that rounded dot, with your nickname, ride, what you're up for, whether you're moving or parked, and open or closed. Nothing is sent before you press I'm out.
- Your group. When you join someone, or say yes to someone, you and that group share exact positions with each other, every few seconds, for tonight only. Leaving the group or pressing Done removes your exact position.
- No speed, no history. Your speed is never stored. Each update replaces the last one; there is no trail.
- Done. Pressing Done deletes your dot. If your phone loses its connection, your dot is marked offline, fades out after 15 minutes, and any leftover is deleted after 3 hours. The map also switches you off 30 minutes after lights-off.
- No-go zones. Dots are kept outside places like hospitals and schools.
2.4 Asking to join
A request records who asked whom, when, and the answer (yes or no). It contains no position and no text.
2.5 Road hazards
A hazard report stores its type, the place, the time and your anonymous ID (to limit one report every two minutes). It expires after 40 minutes unless riders confirm it. Votes record that your ID voted once.
2.6 Safety
Reports (reason only, no text) and blocks are stored so we can act on abuse. Blocked riders can no longer see each other.
2.7 Navigation
When you tap Navigate, the app asks the OpenStreetMap car router run by FOSSGIS e.V. in Germany (routing.openstreetmap.de) for a route from your position to the rider. Each request carries your position and the destination rounded to about 300 m (so a group mate's exact position never leaves the group), and asks again if you leave the route or the rider moves; the last stretch you follow their dot on the map. FOSSGIS keeps its server logs under its own privacy policy. We don't store routes. Navigation runs only when you start it, and ends when you tap End.
2.8 Event nights
Sometimes there is a ride event with a start spot on the map. If you tap I'll be there, your nickname and anonymous ID go on that event's list, which other riders can see until the event ends. Then the list is deleted. Tap Not going to take your name off sooner; Delete everything removes it too.
2.9 Nightly totals
To know whether anyone uses the map, we record that your anonymous ID went out on a given night, and the highest number of riders out at once. These are only ever shown as totals.
3. What we don't collect
No advertising IDs. No analytics, crash-reporting or ad code in the app. No contacts, photos or microphone. The app stores only small settings on your device (for example, that you've joined the list).
4. Website cookies
On the website only, and only after you tap OK on the cookie banner, we load the Meta Pixel and Google Analytics to see which ads bring people here (page views and waitlist sign-ups). If you tap Choose preferences, you can switch each one on or off; with both off, neither loads and you can still join the list. You can change your mind with "Cookie settings" at the bottom of every page.
5. Legal basis (GDPR Art. 6)
| Purpose | Basis |
|---|---|
| Showing you and others on the map, joining, groups | Art. 6(1)(b) — providing the service you asked for |
| Sharing your position when you press I'm out | Art. 6(1)(a) — your consent, withdrawn by pressing Done |
| Road hazards, reports, blocks, abuse limits | Art. 6(1)(f) — legitimate interest in riders' safety |
| The waitlist email | Art. 6(1)(a) — your consent |
| Website cookies (Meta, Google) | Art. 6(1)(a) — your consent via the cookie banner |
6. Who processes data for us
| Service | What it receives | Why |
|---|---|---|
| Google Firebase (Authentication, Firestore, Realtime Database, Hosting) — data stored in Belgium (europe-west1) | Anonymous ID, rider details, rounded and group positions, requests, hazards, waitlist entries | Runs the map |
| OpenFreeMap / OpenStreetMap | Your IP address and the map area you view | Map tiles |
| FOSSGIS e.V. (routing.openstreetmap.de), Germany — only when you navigate | Your IP address, your position and the destination rounded to about 300 m | Working out the route |
| Google Fonts | Your IP address | Typefaces |
| Meta, Google Analytics (website only, after consent) | Page views, waitlist sign-up event, cookie identifiers | Measuring ads |
We do not sell personal data.
7. Transfers outside the EU
Some processors may handle data outside the European Economic Area, including in the United States. These transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
8. How long we keep it
- Your dot: until Done, or at most a few hours as described in 2.3.
- Group positions: until you leave the group, press Done or lose connection.
- Group membership: until you press Done; if you just close the app, the others in your group clear it once your dot is gone.
- Join requests: 10 minutes, then cleared the next time the rider you asked opens the map.
- Hazards: 40 minutes, longer only if riders confirm them.
- Hazard votes: a mark that your anonymous ID voted, kept so nobody votes twice.
- Your rider, reports, blocks and nightly totals: until you delete everything.
- The waitlist: until the app launches and we've sent the one email, or until you ask us to remove you.
9. Age
Midnight Ride is for people aged 18 or over. If you believe someone younger is using it, report them in the app or email us.
10. Your rights
You can access (Art. 15), correct (Art. 16), erase (Art. 17), restrict (Art. 18) and port (Art. 20) your data, object to processing (Art. 21), and withdraw consent at any time. The fastest way to erase: open your rider sheet in the app and tap Delete everything. It removes your rider, dot, group membership, requests to you, blocks, waitlist entries, nightly entries and hazards, then the account itself. For anything else, email us. We reply within one month.
11. Complaints
You may complain to a data protection authority where you live or work. For the controller below, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.
12. Security
Everything is encrypted in transit. Access to stored data is restricted by security rules: riders can only change their own data, exact positions are readable only by members of that group, and the waitlist is readable only by us.
13. Changes
We will update this page when the way we handle data changes, and change the date at the top.
14. Controller and imprint
The controller under GDPR Art. 4(7), and the provider under § 5 DDG, is:
Dovydas Jakstas (sole trader)
Hedwig-Porschütz-Straße 11
10557 Berlin
Germany
Email: see below
15. Contact
For any privacy question, or to use any right above, email us.