Privacy Policy

1. Introduction

Rydr ("we", "us", "our") operates the rydrspot.com platform. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal information. Our servers are located in Germany (EU), and we comply with the General Data Protection Regulation (GDPR).

2. Data We Collect

Account Information

• Email address (for login and verification)
• Username and display name
• Password (stored as a secure hash -we never store plain-text passwords)
• Profile photo and cover image (if uploaded)
• Bio text (if provided)

Content You Create

• Spot locations (GPS coordinates, name, description, country)
• Photos and videos you upload
• Instagram post URLs you embed
• Comments and likes

Automatically Collected Data

• IP address (used for rate limiting and security)
• Browser type and operating system (via standard HTTP headers)
• Pages visited and actions taken (error tracking via Sentry)

3. Legal Basis for Processing (GDPR)

We process your data under the following legal bases:

• Contractual necessity: Processing required to provide the Service (account creation, content hosting, authentication).
• Legitimate interest: Security measures (rate limiting, abuse detection), error tracking, and service improvement.
• Consent: Third-party embeds (Instagram) that may set cookies in your browser.
• Legal obligation: Responding to lawful requests from authorities.

4. How We Use Your Data

• Provide the Service: display your profile, spots, media, and social interactions.
• Authentication: verify your identity and keep your account secure.
• Email communication: send verification emails and password reset links.
• Security: detect abuse, rate-limit requests, and prevent unauthorized access.
• Error tracking: diagnose and fix technical issues.

We do not sell your personal data to third parties. We do not use your data for advertising or profiling.

5. Cookies

We use cookies strictly for authentication. See our Cookie Policy for full details.

• access_token: httpOnly cookie for session authentication.
• refresh_token: httpOnly cookie for refreshing your session.

Both cookies are httpOnly (not accessible to JavaScript), use SameSite=Lax, and are marked Secure in production. We do not use tracking cookies or analytics cookies. Page views are counted with Cloudflare Web Analytics, which sets no cookies and does not follow you across sites.

6. Third-Party Services

We share data with the following third-party services to operate the platform:

7. Data Storage & Security

• All data is stored on servers in Germany (EU).
• Passwords are hashed using bcrypt -we never store or transmit plain-text passwords.
• Authentication tokens are stored in httpOnly cookies, not accessible to JavaScript.
• All connections use HTTPS/TLS encryption in transit.
• Uploaded media is stripped of EXIF metadata (GPS, camera info) before storage.
• Database backups are encrypted and rotated regularly.

8. Data Retention

• Account data is retained as long as your account is active.
• When you delete your account, everything you posted (spots, photos, videos, comments) is hidden from everyone at once. Thirty days later your photos and videos, comments, likes, follows, notifications and personal details (email, username, profile) are permanently deleted. You may contact us to request immediate permanent deletion.
• Uploaded media files are deleted from storage when you delete them, or 30 days after you delete your account.
• If an account is suspended for breaking the rules, its content is hidden for as long as the suspension lasts.
• Notifications are deleted after 90 days; expired sign-in tokens after 30 days.
• Server logs containing IP addresses are retained for up to 30 days.
• Password reset and email verification tokens expire automatically and are deleted once used or expired.

9. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Access: You can request a copy of all personal data we hold about you.
• Rectification: You can update your profile information at any time from settings.
• Deletion: You can delete your account from profile settings, which removes your personal data.
• Portability: You can request your data in a machine-readable format.
• Objection: You can object to certain data processing activities.
• Restriction: You can request that we limit how we process your data.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Children's Privacy

Rydr is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top. Continued use of the Service after changes constitutes acceptance.

12. Contact

For privacy-related questions or to exercise your rights, contact us at: [email protected]