Privacy Policy

This Privacy Policy explains how [Legal entity name] ("we", "us"), the operator of Cycle Empire (the "app"), collects and uses your personal data, and the rights you have. We are the data controller. For any privacy question or request, contact privacy@cycleempire.app.

1. Data we collect

We collect only what we need to run the game:

• Account & profile. When you sign in with Google, Apple or Facebook we receive your name, email address, a profile picture (where provided) and a provider account identifier. We only use basic sign-in scopes — we do not request access to your contacts, posts, photos or other provider data.
• Location & rides. To play, we collect precise GPS location and your ride route, including while a ride is recording (in the background). This is what lets your ride claim map tiles and score.
• Optional sensor data. If — and only if — you pair a Bluetooth sensor, we collect heart rate, cadence, speed and power readings during a ride to show live metrics. This is optional.
• Technical & usage data. Device and app identifiers, app settings, and diagnostics/crash data to keep the app working and secure.

2. How we use your data & legal basis

Under the GDPR we rely on the following legal bases:

• To provide the game — create and authenticate your account, record rides, claim and render territory, calculate XP, rankings and KOMs. Basis: performance of our contract with you.
• Location & ride tracking — the core mechanic. Basis: your consent (which you can withdraw) and/or performance of the contract. You can decline or turn off location; parts of the app that don't need it stay available.
• Optional sensor metrics — only when you pair a sensor. Basis: your consent.
• Fair play, security & support — anti-cheat checks, preventing abuse, and fixing problems. Basis: our legitimate interests in a fair, secure service.

We do not make automated decisions with legal effects about you, and we do not use your data for advertising.

3. Google user data

Cycle Empire's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use the Google account data described above solely to create and authenticate your player account. We do not sell or transfer it, use it for advertising, use it to determine credit-worthiness, or use it for any purpose other than the one described here. The same applies to data from Apple and Facebook sign-in.

4. Who we share data with

We do not sell your personal data. We share it only with service providers ("processors") who help us run the app under contract, and who are required to protect it to at least the standard set out in this policy:

• Supabase — authentication and backend database.
• Cloud hosting & infrastructure — running our servers.
• Map provider — rendering the map.
• Sign-in providers (Google, Apple, Facebook) — for the sign-in you choose.

We may also disclose data if required by law or to protect our rights, users or safety.

5. International transfers

Some providers may process data outside the European Economic Area. Where they do, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses to protect your data.

6. How long we keep it

We keep your account and ride data for as long as your account is active. If you delete your account, we delete or irreversibly anonymise your personal data without undue delay, except where we must retain limited information to meet a legal obligation, resolve disputes, or enforce our agreements. Backups are purged on a rolling schedule.

7. Deleting your account & data

You can delete your account at any time from within the app (in your account settings). Deleting your account removes your profile and associated game data — it is a full deletion, not just a deactivation, and also revokes the sign-in tokens tied to your account.

You can also request deletion by emailing privacy@cycleempire.app, or follow the steps on our Data Deletion page. This option is available to all users, wherever you live.

8. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• receive your data in a portable format;
• restrict or object to certain processing;
• withdraw consent at any time (without affecting prior processing).

To exercise any right, contact privacy@cycleempire.app. You also have the right to lodge a complaint with your data-protection authority — in Poland, the President of the Personal Data Protection Office (UODO).

9. Children

Cycle Empire is not directed to children. You must be at least 16 years old (or the age of digital consent in your country, if higher) to use it. We do not knowingly collect data from anyone below that age; if you believe a child has provided us data, contact us and we will delete it.

10. Security

We use technical and organisational measures to protect your data, including encryption in transit, access controls and secure authentication. No method of transmission or storage is completely secure, but we work to protect your data and to address issues promptly.

11. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, notify you in the app or by email where appropriate.

12. Contact

Controller: [Legal entity name], [Registered address].
Privacy contact: privacy@cycleempire.app.