Privacy Policy

This policy describes what data Ride Forecast collects, how we use it, and the choices you have.

1. Data We Collect

• Account identity — name, email address, and a unique identifier from our authentication provider (Clerk).
• Preferences — commute mode, timezone, and the thresholds you set on the settings page.
• Calendar data — events from calendar accounts you connect (Google or CalDAV). We store event titles, start and end times, and a provider-issued identifier.
• Calendar credentials — OAuth tokens or CalDAV credentials you provide. These are encrypted at rest with AES-256-GCM before being stored.
• Audit events — records of significant account actions (sign-up, setup completion, calendar connect/disconnect, access denials) for security investigation.
• Operational logs — server-side error logs that may incidentally include user identifiers for correlation.

2. How We Use It

• To generate commute and weather recommendations you ask for.
• To keep your calendar data in sync with the Service.
• To secure the Service and investigate abuse.
• To contact you about your account or material changes.

We do not sell your data. We do not use it to train machine learning models outside of the Service you are paying for.

3. Subprocessors

We rely on a small set of vendors to operate the Service: Clerk (authentication), a managed Postgres provider (data storage), Vercel (hosting), Google (optional calendar integration), and Stripe (billing, when activated). Each handles data under their own privacy terms.

4. Calendar Scopes

When you connect Google Calendar, we request the calendar.readonly scope — enough to read events and calendar metadata, and nothing else. You can disconnect the integration at any time from the settings page.

5. Data Retention

Account data is retained while your account is active. When you delete your account, we remove your profile, preferences, calendar credentials, cached events, and audit history from the primary database within a short operational window. Backups are purged on the provider's rolling schedule (typically 30 days).

6. Your Rights

You can export or delete your account data at any time from the settings page. If you are a resident of the EU, UK, or California, you also have the right to request access, correction, or portability of your personal data by emailing support@ride-forecast.app.

7. Security

Calendar credentials are encrypted at rest. All connections are served over TLS. We enforce tenant isolation at the application layer and review access logs for anomalies. Report suspected vulnerabilities to support@ride-forecast.app.

8. Cookies

We use session cookies issued by our authentication provider to keep you signed in. We do not run third-party advertising trackers.

9. Children

The Service is not directed to children under 13 (or the local equivalent), and we do not knowingly collect data from them.

10. Changes

We will announce material changes to this policy in-app or by email at least 14 days before they take effect for existing users.

11. Contact

Email support@ride-forecast.app with any questions about this policy.