Last updated: 29 October 2026
This policy covers the RiderMates website and the RiderMates apps for Android and iPhone. RiderMates is run from Aotearoa New Zealand by [LEGAL BUSINESS NAME: owner to supply] ("RiderMates", "we", "us"). We follow the New Zealand Privacy Act 2020, including its 13 Information Privacy Principles.
1. What we collect and why
We collect only what the site needs to work. Much of it is optional, and you choose what to share.
| What | Details | Why we use it |
|---|---|---|
| Your account | Email address, username, display name and a password (stored only as a salted hash, never as text). If you use Continue with Google we receive your Google account's stable id, email address and name. | To create your account, sign you in, send you account emails and show who posted what. |
| Your profile (optional) | Profile and cover pictures, region and city, bikes you ride, gender and date of birth. Only you can see your gender and date of birth. | To show a rider profile to other riders, and to help riders find each other. |
| Listings and contact details | Bikes, gear and parts you list, with their photos, videos, price, location and the phone number you choose to add. Signed-in riders can see a seller's contact details. | To run the marketplace and let buyers reach you. Listings are public. |
| Routes | Routes you share, including GPX files, descriptions, photos and ratings. | To run the route directory. Routes are public. |
| Group rides, groups and Cafe Stop | Rides you organise or join (meeting point, time, who is in), groups you create or join and their posts, and Cafe Stop discussions, replies, votes and photos. | To run these features. Public posts are visible to anyone; private groups and rides are visible to their members. |
| Connections and chat | Who you are connected to, and chat messages, emojis, GIFs, photos and videos you send to a connection or group, and messages you send to the RiderMates admins. | To deliver your messages. They are visible to the people in that chat and to RiderMates admins when needed for support or safety. |
| Location | If you tap Use my location on the weather page, your browser or phone shares your position so we can show local weather. We pass those coordinates to the weather service. We do not keep a history of your position. Photos are re-saved without their GPS and camera data. | To show local weather. You can refuse, and the site still works. |
| Route generator requests | The trip you ask for (start, time available, riding style). It is sent to Claude, an AI service from Anthropic, to suggest stops. It does not include your name or email. | To plan a route for you. |
| Push notification tokens | If you allow notifications in the app, a device token from Apple or Google, your device type, and the notifications we send (for example a new chat message or a ride reminder). | To send notifications you asked for. You can switch them off in the app or your phone settings. |
| Sign-in sessions | A session cookie on the website, or an app token on your phone. App tokens are stored only as a hash, with a device label and the last time they were used. | To keep you signed in and to sign you out everywhere if needed. |
| Usage and analytics | Our own page-view statistics record the page, the type of device, the referring site, roughly which town a visit came from, and a daily visitor code made from a hash of the IP address and browser that changes every day. We do not store IP addresses. We also use Google Tag Manager (see "Cookies" below). | To see which features are used and to keep the site working and safe. |
| Emails | Your email address and the content of the emails we send: welcome, password reset, chat and ride messages, and notices you asked for. | To run your account. We do not give your email address to anyone for their own marketing. |
We collect information directly from you, from your use of the site and apps, and from Google if you choose Continue with Google. We do not buy personal information, and we do not sell it.
2. Who we share it with
We share personal information only with people who help us run RiderMates, and only what they need. They may use it only to provide their service to us.
| Service | What it does | What it receives |
|---|---|---|
| [HOSTING PROVIDER AND REGION: owner to supply] | Runs the site and stores the database and uploaded files. | Everything described above. |
| Brevo (email delivery) | Sends our emails. | Your email address, name and the email's content. |
| Google (Sign-In, Firebase Cloud Messaging, Tag Manager, Fonts) | Sign-in with Google; delivery of push notifications to Android and, through Apple, to iPhone; analytics tags; fonts. | For sign-in, your Google profile details; for notifications, the device token and the notification text; for Tag Manager and Fonts, your IP address and browser details. |
| Apple Push Notification service | Delivers notifications to iPhones. | The device token and the notification text. |
| Anthropic (Claude) | Suggests stops for the route generator. | The trip details you enter. No name or email. |
| Open-Meteo | Weather forecasts. | The town or coordinates you ask about. |
| Photon (OpenStreetMap data) | Address search for meeting points. | The text you type into the address search. |
| Map tile providers (LINZ, OpenStreetMap) | Show map images. | Your IP address and the map area you view, like any website you load images from. |
| jsDelivr | Delivers a small script the site uses. | Your IP address and browser details. |
We may also disclose information if the law requires it, to protect someone's safety, or to investigate unlawful activity. If RiderMates is ever sold, personal information may move to the new owner, who must honour this policy.
Things you post publicly (routes, listings, Cafe Stop posts, your public profile) can be seen by anyone, including search engines.
3. Storage and disclosure overseas
Several of the services above are based outside New Zealand, so your information can be stored or processed in other countries, including Australia, the United States and Europe. Under Information Privacy Principle 12 we only send personal information overseas where the provider is subject to privacy laws comparable to New Zealand's, or is bound by agreement to protect it in a similar way, or where you have been told and agree. Our database is hosted at [HOSTING LOCATION: owner to supply].
4. How long we keep it
- Your account and everything you made with it stays until you delete your account.
- When you delete your account we permanently delete your profile, listings, routes, posts, chat messages, connections, push tokens, sign-in sessions and uploaded files. This cannot be undone. Copies in our backups are overwritten when the backups expire, [BACKUP PERIOD: owner to confirm].
- Password reset links expire after one hour. Sign-in sessions end after 30 minutes without a visit, or 30 days if you chose Remember me.
- We may keep limited information if the law requires it, or to resolve a dispute or protect against abuse.
5. Deleting your account
In the RiderMates app, go to Profile and choose Delete my account. Enter your password (or confirm, if you joined with Google and have no password) and your account is deleted straight away. You can also email us at [PRIVACY CONTACT EMAIL: owner to supply] from the email address on your account and we will delete it for you. Admin accounts cannot delete themselves and need to ask the site owner.
6. Your rights: access and correction
Under the Privacy Act 2020 you can ask us for the personal information we hold about you, and ask us to correct it. You can see and change most of it yourself on your Profile page. For anything else, email our privacy officer (see below). We will respond within 20 working days. We may need to check it is really you first, and we may refuse a request only for reasons the Act allows, and we will tell you why.
7. Security
We protect your information with HTTPS, hashed passwords, hashed sign-in and password reset tokens, limits on password reset requests, restricted admin access and regular software updates. No online service is perfectly secure, so please choose a strong, unique password.
If a privacy breach happens that is likely to cause you serious harm, we will tell you and the Office of the Privacy Commissioner as soon as practicable, as the Privacy Act 2020 requires.
8. Children
RiderMates is for motorcycle riders and enthusiasts and is not directed at children. You must be at least [MINIMUM AGE: owner to confirm] to create an account. If we learn we hold an account for someone younger, we will delete it. If you think a child has given us their information, please contact us.
9. Cookies and similar technology
- Essential cookies. A
SESSIONcookie keeps you signed in, and a security token protects forms from forgery. Without them the site cannot work. - Our own analytics use no cookies and do not store IP addresses.
- Google Tag Manager. The website loads Google Tag Manager, which can set cookies or collect usage information depending on the tags set up in it: [TAGS RUNNING IN GOOGLE TAG MANAGER, for example Google Analytics: owner to confirm]. You can block or delete cookies in your browser settings; the site still works.
- The apps do not use advertising identifiers and do not track you across other companies' apps or websites.
10. Changes to this policy
We will update this page when what we do changes, and change the date at the top. If a change is significant we will also tell you in the app or by email.
11. Contact and complaints
Privacy officer, [LEGAL BUSINESS NAME: owner to supply]
Email: [PRIVACY CONTACT EMAIL: owner to supply]
If you are not happy with how we handled a privacy matter, please contact us first. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909.