Updated 4 September 2026
This policy explains what RYDR collects, why, who else receives it, and what you can ask us to do about it. It covers rydr.gg (the public site and its waitlist), play.rydr.gg (the RYDR web app, including the phone controller), and the RYDR app for iOS and Android. RYDR is in private beta and invite only, so it is a small service — the list below is short on purpose, and it is meant to be the whole list.
Infinity Technologies SA (company no. 0721.487.879, VAT BE0721.487.879), Avenue des Métallurgistes 8A, 1490 Court-Saint-Étienne, Belgium, is the controller of the personal data described here.
Privacy requests and questions: privacy@rydr.gg. General support: support@rydr.gg.
Supervisory authority: the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels — www.autoriteprotectiondonnees.be. We have not appointed a Data Protection Officer; we are not required to.
This policy applies to rydr.gg (the public site and its waitlist), play.rydr.gg (the RYDR web app, including the phone controller), and the RYDR app for iOS and Android. The games you play inside RYDR are part of RYDR and are covered too.
It does not cover the other companies you deal with around it: your trainer or heart rate monitor's own app, Apple's or Google's stores, or Strava if you choose to connect it. Those have their own policies, and section 6 says what we send them.
Your account. Your email address, and the invite code you joined with. There is no password: signing in means asking us to email you a 6-digit code, so your email address is also how you prove who you are.
We use that address for sign-in codes and for service messages about your account. We email you about what happens in the game only if you ask us to: the switch is off until you turn it on, it is in the app under Settings, Notifications, and turning it off there stops the mail. Even switched on, we send at most one such email every twelve hours. We do not sell it, rent it, or send you marketing on someone else's behalf.
Your profile. A display name, and optionally a photo. Also, because the games need them to turn what you pedal into what happens on screen: your year of birth, gender, height, your weight and your bike's weight, and the difficulty level you ride at. These are figures you enter, they are used for the physics and for age-appropriate access, and none of them are a medical record.
Your photo is public. Profile pictures are stored in a public bucket and served from a URL that anyone holding it can open, which is what lets your avatar appear on a leaderboard. Do not upload anything you would not put on a public page.
Your rides. When you finish a ride we store what the session produced: how long you rode, your average and peak power, cadence, the game you were playing, the difficulty level you had chosen, and when it happened. If a heart rate monitor is connected, its readings are part of that ride data. You can export a ride as a FIT file.
Your records. When a ride sets a personal best or a world record on a leaderboard, that result — with your display name and avatar — is shown to other RYDR riders in the feed and on the leaderboards. This is the point of the feature, so treat your display name as public within RYDR.
Your equipment. The name and identifier of the trainer, heart rate monitor or controller you pair, so we can reconnect to it and so we can tell which devices work badly. The live sensor stream is processed on your own device; what reaches us is the ride summary above.
Playing in real time. Presence in a room and the inputs from a phone used as a controller travel through our real-time service while you play. They are relayed, not kept: what persists afterwards is the ride and any record it set.
Notifications, if you turn them on. A push token issued by Apple or Google, which platform it is for, a short support string describing the device (for example "iPhone17,2 · iOS 26.5"), and the date the app last used it. Nothing is sent to your device until you accept the prompt.
How RYDR is used. Events — screens opened, sign-in steps completed, rides and runs started and finished, hardware connected or failing to connect — recorded against your account with a session identifier and the app version. We use this to find what is broken and what nobody can find, not to build a profile of you, and we make no automated decisions about you from it.
Files you upload. Avatars, and any media or replay data a game saves for you, are stored with our object-storage provider.
Technical records. Our hosting and real-time providers log the ordinary things a server logs — IP address, user agent, timestamps, errors — which we use to keep the service up and to investigate abuse.
The waitlist, on rydr.gg. If you ask to be told when RYDR opens, we store your email address and the IP address the request came from. The IP is there to spot abuse of a public form, nothing else.
Strava, only if you connect it. Linking your Strava account tells us your athlete name and profile picture, and from then on we upload each finished ride to Strava for you. Disconnect at any time on your profile page; the rides already uploaded are yours to delete in Strava.
What you write to us. If you email us, we keep the message and its metadata so we can answer and refer back to it.
Kept on your device. Your signed-in session, your profile cache, the games registry and the analytics session identifier live in your browser's storage on the web, and in the operating system's own app storage (UserDefaults on iOS, SharedPreferences on Android) in the app. They are removed when you clear site data or delete the app. We set no advertising or tracking cookies, and RYDR carries no advertising SDK.
Each purpose below has a legal basis under the GDPR:
Where we rely on legitimate interests you can object — see section 9.
Other riders see your display name, your avatar and the records you set. They do not see your ride history, your email address or your profile figures: rides are readable only by their owner, enforced in the database itself rather than only in the app.
We use these providers, each for one job, each under a data processing agreement:
We do not sell your personal data. We disclose it outside this list only where the law requires it, and we will tell you when we are allowed to.
Your account, profile, rides and records are held in our Supabase project in the European Union (AWS eu-west-1, Ireland), so the core of the service involves no third-country transfer.
Some of the providers in section 6 are established outside the EEA or process data there — notably Apple and Google for push delivery, Google for fonts and speech, and Telegram for staff alerts. Where a transfer needs a safeguard we rely on the EU Standard Contractual Clauses, or on the provider's certification under the EU-US Data Privacy Framework where it holds one, together with encryption in transit and access controls on our side.
Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to a particular use, and to receive it in a portable form. You can withdraw any consent you have given — notifications in your device settings, Strava on your profile page — without affecting what we did before you withdrew it.
Write to privacy@rydr.gg from the address you ride with. We answer within one month, extendable where the law allows. If you write from another address we may ask you to confirm who you are, because handing an account's data to the wrong person is the worse failure. Portable copies are provided as JSON or CSV of your own data; we do not publish internal schemas.
Deletion does not need us at all: Settings → Account → Delete account, in the app, removes the account there and then. Email us instead if you no longer have the app installed — both routes reach the same place.
Either way it removes your profile, your rides and your records, and takes your results off the leaderboards and the feed with them. What survives, and for how long, is set out at https://play.rydr.gg/delete-account.
If you think we have handled this badly, tell us first — most of it is faster to fix that way. You can also complain to the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels — www.autoriteprotectiondonnees.be, or to the authority where you live.
What we do:
None of that makes a service unbreakable. If a breach affects your data we will notify the supervisory authority within 72 hours where the law requires it, and tell you directly where the risk to you is high.
RYDR is not for anyone under 13, and we do not knowingly collect data from children under that age. The profile asks for a year of birth, which is what lets us apply this.
Between 13 and 18 a parent or guardian has to agree to the Terms and permit the account, and we would rather they were around for the riding as well — see the health and safety section of the Terms. A parent can exercise every right in section 9 on their child's behalf.
If you believe a child under 13 has an account, write to privacy@rydr.gg and we will delete it and the data with it.
Minor changes — wording, clarifications, a renamed provider — take effect when we publish them, and the date at the top moves.
Material changes take effect no earlier than 15 days after we tell you, by email or in the app. If you do not accept them you can delete your account before that date.
The current version is always at https://play.rydr.gg/privacy. We keep the previous ones internally.
Privacy: privacy@rydr.gg. Support: support@rydr.gg.
By post: Infinity Technologies SA (company no. 0721.487.879, VAT BE0721.487.879), Avenue des Métallurgistes 8A, 1490 Court-Saint-Étienne, Belgium.