Privacy Policy

Cycling Advocacy (the “Site”) is a directory of cycling advocacy organizations and a registry of ghost bike memorials, available at cyclingadvocacy.bike and through a companion mobile application. This policy explains what information we collect, why we collect it, who we share it with, and how you can access or delete it.

The Site is operated as a public-interest project. We collect only the data we need to run it, and we publish only the data you choose to make public.

Who we are

For privacy questions or requests, contact privacy@cyclingadvocacy.bike.

Information we collect

Account information (when you sign in)

You can authenticate with either Google Sign-In or Sign in with Apple. We store the following in our database:

• A stable, opaque account identifier from the provider
• Your email address (with Apple, this may be Apple’s Private Relay proxy address)
• Your display name — from Google on every sign-in, from Apple only on the first sign-in
• Your profile picture URL (Google only; Apple does not provide one)

We never receive or store your Google or Apple password.

Content you submit

When you contribute to the Site you may submit:

• Ghost bike memorial entries, including name, date, description, street/city/state, and a precise location (latitude/longitude) you choose
• Photos of memorials
• Suggested edits to existing memorials or organizations
• Ownership claims that link your account to an advocacy organization
• Reports flagging content for moderator review, including an optional free-text note

Submitted memorial content is published on the Site and may be forwarded to the OpenStreetMap project, where it becomes part of a public, openly-licensed dataset. Once published to OpenStreetMap, content is outside our control.

Location data

The Site and the mobile app may ask your browser or device for your current location to help you center a map or place a memorial. Location is only requested when you take an action that needs it; we do not track your location in the background. Coordinates you attach to a memorial submission are stored and published as part of that submission.

Camera and photos (mobile app)

The mobile app may request access to your camera (to take a photo of a memorial) and your photo library (to select an existing photo to attach to a submission). We only access them when you initiate a photo action; we don’t browse your library or take photos in the background. Photos you choose to upload are sent to our server and published as part of the memorial. Photos you preview but don’t submit never leave your device.

Donations

On the website, donations are processed by Stripe on Stripe’s hosted checkout pages. Stripe collects your payment details directly; we do not see or store card numbers, billing addresses, or other payment information. We receive only the amount and a Stripe session identifier so we can confirm a donation completed. See the Stripe Privacy Policy for how Stripe handles your payment data.

In the mobile app, donations are processed by Apple (App Store) on iOS and Google (Play Store) on Android. Those purchases are governed by their respective payment terms; we do not see your payment details, only that a contribution was made.

Technical and security data

Our web servers automatically log standard request information — IP address, user-agent string, request URL, response code, and timestamp — in access and application logs. We use this information to operate the Site, diagnose errors, enforce rate limits, and detect abuse. Logs are typically retained for up to 30 days and then rotated.

Cookies, sessions, and tokens

The Site uses a single signed session cookie (ca_session) to keep you signed in for up to 30 days. The cookie carries only your numeric user identifier and does not contain personal information directly.

The mobile app receives a JSON Web Token (JWT) that serves the same purpose; it is stored on your device and sent with each authenticated request. The token expires after 30 days.

We do not use third-party advertising cookies or analytics trackers.

How we use your information

• To authenticate you and keep you signed in
• To attribute your contributions internally so moderators can review and follow up
• To publish the memorial and organization content you submit
• To forward approved memorial data to OpenStreetMap
• To operate, secure, and improve the Site
• To respond to your messages and account requests

We do not sell your personal information. We do not use it for advertising.

Who we share information with

• OpenStreetMap — approved memorial data is published to the public OSM database.
• Google — if you choose Google to sign in, authentication is delegated to Google Identity. Pages with maps load the Google Maps JavaScript API, which may receive your IP address and approximate location from your browser.
• Apple — if you choose Sign in with Apple, authentication is delegated to Apple. Apple may relay an anonymized email address to us in place of your real one.
• Stripe — donation checkout on the website is hosted by Stripe; payment details go directly to Stripe.
• Apple and Google — in-app donations on iOS and Android are processed by the App Store and Play Store, respectively, under their payment terms.
• Hosting provider — the Site runs on a server whose provider may have access to log files in the normal course of operating the infrastructure.

We may also disclose information if required by law, to protect the safety of users, or to enforce our terms.

Public attribution

When your submission or edit is approved and shown on the Site, your display name may appear next to it (for example, “Edited by Alice”). Your email address and profile picture are never displayed publicly.

Account deletion

You can delete your account at any time:

• In the mobile app, open the Profile tab and choose “Delete account.” You will be asked to confirm twice.
• On the Site, contact privacy@cyclingadvocacy.bike and we will process the deletion.

When you delete your account we permanently remove your user record — your name, email, profile picture, and Google identifier — and revoke your active sessions. Permissions and any pending ownership claims tied to your account are removed.

Memorial content, photos, suggested edits, and other contributions you made to the public record are retained, but with your name detached. This is because memorials are a public-interest record honoring people who died on bicycles, and we do not remove them when a contributor leaves. If you want a specific memorial entry, photo, or edit removed in addition to your account, please use the in-app “Flag” feature or contact us before deleting your account.

Memorial data that has already been forwarded to OpenStreetMap is part of the public OSM dataset and cannot be recalled by us; you may request changes there directly via OSM’s tools.

Data retention

• Account data: kept until you delete your account.
• Server logs: typically up to 30 days, then rotated.
• Submitted public content: retained indefinitely as part of the public record.
• Donation records: retained as required by tax and accounting rules; payment detail retention is governed by Stripe.

Your rights

Depending on where you live, you may have rights under laws such as the EU General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), including the right to access, correct, delete, or export your personal data, and to object to certain processing. You can exercise most of these rights by signing in and using the built-in tools, or by contacting privacy@cyclingadvocacy.bike.

Children

The Site is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

Security

We use HTTPS for all connections to the Site, store passwords nowhere (authentication is delegated to Google), and limit access to the database to operational staff. No online service is perfectly secure; if you become aware of a vulnerability, please report it to privacy@cyclingadvocacy.bike.

International transfers

The Site is hosted in the United States. If you access it from elsewhere, your information will be transferred to and processed in the United States.

Changes to this policy

We may update this policy from time to time. The effective date at the top of the page will reflect the latest revision. Material changes will be announced on the Site.

Contact

Questions, complaints, or data requests: privacy@cyclingadvocacy.bike.