Privacy policy
Last updated: 26 August 2026
This policy explains what personal data is processed when you use the website secu-cycle.fr and the mobile app Sécu'Cycle, for what purpose, on what legal basis, for how long, and what your rights are. It is written in accordance with the General Data Protection Regulation (GDPR, articles 12 to 14) and the French Data Protection Act.
1. Data controllers
Your data is processed under the joint responsibility of Alexis Gaudray Bouju and Matheline Chevalier, publishers of the Sécu'Cycle student project (ENSEIRB-MATMECA). No data protection officer (DPO) has been appointed, as the project is not required to have one.
For any question, or to exercise your rights: contact@secu-cycle.fr. Full identification details are given in the legal notice.
2. Data we process
2.1. Account data
When you create an account and use the service, we process:
- Email address and password (the password is stored securely as an Argon2 hash, never in clear text);
- First name, last name and date of birth;
- Declared fitness level;
- Home and work addresses (if you provide them);
- Your bikes (name, type, electric assistance).
2.2. Location and route data
- Start and end points when a route is planned;
- The geometry of the routes planned and their history;
- The precise position (GPS coordinates) attached to the hazard reports you create;
- During guided navigation, your position is sent to the server in real time to keep the guidance on track.
Important: the position sent live during navigation is not retained. It is processed on the fly, in memory, to guide you, and is not written to our database. Only the geometry of planned routes and the hazard report positions are retained.
2.3. Usage data (audience measurement)
We measure our audience using privacy-respecting tools:
- Website: Umami, self-hosted on our servers, with no cookies or trackers and collecting no data that could identify you. No consent banner is therefore required.
- Mobile app: Aptabase (European Union hosting region), which records anonymous usage events (screen opened, navigation started, and so on) with no email, no name and no GPS coordinates.
The website only uses browser local storage for technical purposes (remembering the light/dark theme and your session), never for advertising tracking.
3. Permissions requested by the mobile app
The app only requests the permissions strictly necessary for it to work. Each one is requested by your phone and can be refused or revoked at any time in the system settings.
| Permission | Purpose |
|---|---|
| Location — foreground (precise) | Locating you and providing real-time bike guidance while the app is open. |
| Location — background (precise) | Continuing guidance when the screen is off or the phone is in your pocket. Used for navigation only, never for advertising or analytics. |
| Notifications | Showing the persistent “Navigation in progress” notification indicating that guidance is still running in the background. |
| Microphone (iOS) | Required for speech synthesis of navigation instructions. No audio is recorded or transmitted. |
| Vibration / haptic feedback | Tactile interface feedback (action confirmations). |
| Internet access | Communicating with our server, loading maps and sending anonymous analytics. |
Background location is at the heart of Sécu'Cycle's navigation feature. It is only active during guidance, with your explicit consent, and is never used for advertising or tracking.
4. Purposes and legal bases
- Managing your account and providing the service
- Legal basis: performance of a contract (our terms of use).
- Route planning and location-based navigation
- Legal basis: performance of a contract and your consent, given through the location permission granted to your operating system.
- Hazard reports
- Legal basis: legitimate interest (improving cyclist safety).
- Anonymous audience measurement
- Legal basis: legitimate interest (tools without cookies or trackers, with no identifying data).
- Periodic summary of your activity
- Legal basis: legitimate interest (returning your own usage statistics to you). You may object at any time, in one click from the email itself or from your account settings, without affecting the emails required for the service to function.
- Service security and technical logs
- Legal basis: legitimate interest and compliance with our legal obligations.
5. Recipients and processors
Your data is never sold, rented or used for advertising. No advertising identifier is collected. We use the following providers, strictly to operate the service:
- IONOS (European Union) — hosting for the website and API;
- MapTiler — base map tiles (the map display coordinates pass through this service);
- Base Adresse Nationale (adresse.data.gouv.fr, a French public service) — autocomplete for the addresses you type;
- Aptabase (European Union region) — anonymous app analytics;
- Umami — anonymous website analytics, self-hosted by us.
- Resend — delivery of our emails (account verification, password reset, activity summaries); your email address is passed to this provider for that sole purpose.
6. Transfers outside the European Union
Hosting and analytics take place within the European Union. The mapping service MapTiler is established in Switzerland, a country recognised as providing an adequate level of protection by decision of the European Commission. No other transfer of data outside the European Economic Area takes place.
7. Retention periods
- Account and associated data: kept for as long as your account is active, then deleted when you delete your account;
- History and routes: kept until you delete them, or until you delete your account;
- Summary delivery log: the record of the summaries sent to you is kept for as long as your account exists, and deleted along with it.
- Hazard reports: kept for cyclist safety, unlinked from your account if you delete it;
- Technical logs: 12 months maximum;
- Audience analytics: aggregated and anonymous.
8. Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to withdraw your consent at any time (in particular by revoking the location permission in your phone settings).
You can delete your account yourself, without contacting us, from the mobile app as well as from this website: the steps and the details of what is erased are on the Delete my account page. Your ride history can also be deleted on its own, from your profile.
For other rights, or if you no longer have access to your account, write to us at contact@secu-cycle.fr.
If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the CNIL: Commission Nationale de l'Informatique et des Libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
9. Minors
The service is restricted to people aged 15 or over, the age of digital consent in France. Younger users must obtain their legal guardians' consent before using it.
10. Automated decision-making
Route planning relies on algorithms, but does not constitute automated decision-making producing legal effects or similarly significantly affecting you within the meaning of article 22 of the GDPR. No profiling for advertising purposes takes place.
11. Security
Passwords are hashed (Argon2), exchanges with the server are encrypted (HTTPS) and authentication tokens are stored in your phone's secure operating system keystore.
12. Changes to this policy
This policy may be updated to reflect changes to the service or to regulations. The date it was last updated is shown at the top of the page.