Privacy Policy

Last updated: 20 October 2026

VirtualRide processes the data needed to run accounts, subscriptions, and Street View rides. This page lists what we store, why, how long, and how you can delete it.

Who we are

Operator: VirtualRide. Contact: hello@virtualride.app or Support.

What we collect and store

On our servers (Cloudflare D1) we may store:

• Account: email address, password hash (not the password), email verification time, account created time.
• Sessions: HttpOnly session cookie vr, and on the iOS app a session token in on-device storage so you stay signed in.
• Email tokens: hashed one-time links used to confirm an email address. They expire.
• Web billing: Stripe customer id, Stripe subscription id, subscription status.
• App Store billing: RevenueCat / Apple app user id (rc_app_user_id) and subscription status.
• Funnel events: email plus Stripe checkout or subscription ids when you start checkout or complete a web purchase (events email_submit and purchase).
• Referral attributions: if you arrived with an affiliate link, we may store the referral code, Stripe invoice and subscription ids, and the customer email so we can credit the referrer.
• Strava connection: if you connect Strava, your Strava athlete id, the OAuth access token, refresh token, token expiry time, granted permission (scope), and when you connected. See Strava.
• Strava uploads: for each ride you send to Strava, a random ride id, the Strava upload id and activity id, and the upload status, so the same ride is not sent twice.

On your device we may store:

• A short-lived signup draft in session storage (email, and sometimes the password you just typed, only until signup finishes).
• Demo ride time in local storage so a free web preview can stop after the demo limit.
• Optional ride display flags in local storage (fade, prefetch count, drift, custom routes). These are settings, not Street View imagery.
• A referral cookie vr_ref (HttpOnly) if you used an affiliate link.
• A finished ride file in session storage if you connect Strava from the ride summary, so the ride can still be uploaded when you come back. It is removed the next time the Ride screen opens, or when you close the tab.

What we do not store

We do not store a recording of your ride, trainer power, cadence, speed, heart rate, or a GPS track on our servers. Bluetooth trainer data is read on your device and used to pace Street View. While you ride, the app keeps a ride log in memory on your device so you can download it as a FIT file when the ride ends. It is only sent anywhere if you upload it to Strava, and then it passes through our server to Strava without being saved. Street View and map requests go from your browser or the iOS app to Google; we do not host or keep Street View imagery. In-memory prefetch of upcoming panoramas exists only while you ride and is not written to disk.

Strava

Connecting Strava is optional. When you connect, VirtualRide asks Strava only for permission to upload activities (activity:write). If that permission is not granted, we do not keep any tokens.

What we send to Strava, only when you upload a ride or turn on automatic upload:

• An activity file (FIT) for that ride: time, distance, speed, power, cadence, heart rate if your trainer recorded it, and the GPS track of the route you rode.
• An activity name such as "Virtual Ride: Alpe d'Huez" and a random ride id so Strava can spot duplicates.

What we store from Strava:

• The OAuth access token and refresh token, and when the access token expires. They stay on our server and are never sent to your browser or app.
• Your Strava athlete id.

We do not read your Strava activities or your Strava profile. Strava includes basic profile details with the tokens at authorization; we keep only the athlete id. Disconnect Strava in the Ride lobby at any time: we revoke VirtualRide's access at Strava and delete the stored tokens. If Strava cannot be reached at that moment, we still delete the tokens, and you can also remove VirtualRide under My Apps in your Strava settings. Deleting your VirtualRide account does the same. Activities you already uploaded stay on Strava until you delete them there. Strava handles your data under the Strava Privacy Policy.

Why we use the data

Email, password hash, and session tokens authenticate you. Stripe and Apple / RevenueCat identifiers take payment and enforce the paywall. Email tokens confirm the address. Funnel events and referral rows help us understand checkout and pay affiliates. Strava tokens and upload records let us upload the rides you choose and avoid sending one twice. Legal basis for accounts and paid access is contract performance (GDPR Art. 6(1)(b)). Funnel and referral records are legitimate interests in operating the service (Art. 6(1)(f)).

Who else sees data

Stripe processes web payments. Apple processes iOS in-app purchases. RevenueCat receives a purchaser identifier so we can unlock the ride after an App Store purchase. Google receives map and Street View requests from your browser or app (including IP address) under Google’s privacy policy. Strava receives the activity files you choose to upload. Hosting and the database run on Cloudflare. We do not sell personal data.

Cookies and similar

vr is an HttpOnly session cookie. vr_ref remembers an affiliate code. vr_strava_state is a short-lived HttpOnly cookie that protects the Strava connect step and expires after 10 minutes. They are not used for advertising. The iOS app may also keep a session token on device. You can end a session with Log out.

Retention

Account rows stay while the account exists. Sessions expire after 30 days of idle time or when you log out. Email tokens expire after 24 hours. Funnel and referral rows stay for accounting and abuse prevention until you delete the account or ask us to erase them. After you delete the account we remove the user row, sessions, email tokens, funnel events, and referral rows tied to that email. Strava tokens stay until you disconnect Strava or delete the account. Strava upload records stay until you delete the account.

Your rights and deletion

You can delete the account from the logged-in Ride screen (Delete account). You must confirm your password. That erases the personal data listed above from our database. If Strava is connected, we also revoke VirtualRide's access at Strava and delete the Strava tokens and upload records.

Deleting the account does not cancel an App Store subscription. Cancel that in Settings → Apple ID → Subscriptions or you may still be charged. A web (Stripe) subscription is set to stop renewing when you delete the account.

If you are in the EEA/UK you may also access or correct your data, object to legitimate interests processing, and complain to a supervisory authority (in Finland: the Office of the Data Protection Ombudsman). Email hello@virtualride.app if you cannot use the in-app delete flow.

Children

VirtualRide is for people 18 or older. We do not knowingly create accounts for children.

Contact

Support or hello@virtualride.app.