Privacy Policy
Effective Date: June 3, 2026
This Privacy Policy describes how Kokopelli Labs LLC (“Kokopelli Labs,” “we,” “us,” or “our”) collects, uses, and shares your personal information when you use Biketopia and any related websites, applications, and services (collectively, the “Service”). By using the Service, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
1.1 Information You Provide
Account Information: When you create an account, we collect your name, email address, and any other information you choose to provide during registration. If you provide a phone number — for example, to sign in by text message, receive one-time login codes, accept invitations, or book a service appointment — we collect and store it as well.
Ride and Route Content: When you use the Service, you may provide ride plans, routes, GPS tracks and coordinates, trail or route details, performance data, bike setup information, photos, comments, and other cycling-related content.
Health and Fitness Information: If you choose to connect a fitness account (such as Strava or Garmin) or otherwise record activities, we receive and store fitness-related data associated with your rides, which may include GPS tracks, distance, elevation, pace and speed, heart rate, power output, calories, cadence, and related fitness scores. Some of this information may be considered health or sensitive data. We collect it only when you choose to connect those accounts or provide it, and we use it to power your activity history, performance insights, and coverage features. See “Connected Accounts” below.
Community Content: If the Service includes community features, we collect the content you post, including comments, reviews, messages, and shared ride details.
Communications: When you contact us, respond to surveys, or submit feedback, we collect the content of those communications.
1.2 Information Collected Automatically
Usage Data: We automatically collect information about how you interact with the Service, including pages visited, features used, time spent, and actions taken.
Device Information: We collect information about the device you use to access the Service, including device type, operating system, browser type, app version, and screen resolution.
Location Information: If you enable location services, we may collect precise or approximate location data to support route tracking, mapping, and ride features. You can disable location services through your device settings.
Log Data: Our servers automatically record information including your IP address, access times, referring URLs, and pages viewed.
IP Address: We collect and store your IP address to operate and secure the Service — including fraud and abuse prevention, rate limiting, and verifying one-time login codes. For rate limiting, your IP address may be processed by our rate-limiting provider (Upstash). See “Third-Party Services and Sub-Processors” below.
Push Notifications: If you enable push notifications, we store a browser or device push subscription (an endpoint and the associated encryption keys) along with basic device and browser information so we can deliver notifications to you. You can turn push notifications off at any time in your notification settings or your browser or device settings.
Cookies and Similar Technologies: We use cookies and similar tracking technologies to collect information about your browsing activity. You can control cookies through your browser settings; however, disabling cookies may limit certain features of the Service.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, maintain, and improve the Service.
- Create and manage your account.
- Enable ride tracking, route planning, performance insights, and sharing features.
- Allow you to share ride information with other users when you choose to do so.
- Communicate with you about the Service, including responding to inquiries and sending service-related announcements.
- Analyze usage patterns and trends to improve functionality and user experience.
- Detect, prevent, and address fraud, technical issues, and security threats.
- Comply with legal obligations.
3. How We Share Your Information
We do not sell your personal information.
We may share your information in the following limited circumstances:
With Other Users: If you share rides, routes, or other content publicly or with specific users, those users will be able to view the information you choose to share. You control your privacy and sharing settings within the Service.
Service Providers: We may share information with third-party service providers that perform services on our behalf, such as hosting, cloud storage, analytics, mapping services, payment processing, and email delivery. These providers are contractually required to use your information only as directed by us and to maintain appropriate security measures.
Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect the rights, property, or safety of Kokopelli Labs, our users, or the public.
Business Transfers: In the event of a merger, acquisition, restructuring, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any material change in ownership or control of your personal information.
4. Connected Accounts (Strava and Garmin)
The Service lets you connect third-party fitness accounts, currently Strava and Garmin. Connecting is optional, and we only access these accounts after you authorize the connection.
What we request: When you connect an account, we request read access to your activities and basic profile through the provider’s authorization process. We do not post to these accounts on your behalf.
What we import: We import your activities and the associated data, which may include GPS tracks, distance, elevation, time, pace and speed, heart rate, power, calories, cadence, fitness scores, and gear (bike) information. We use this to build your activity history, performance insights, and coverage map. This information is also described under “Health and Fitness Information” above.
Disconnecting: You can disconnect a connected account at any time from your settings, or by revoking access directly with the provider. Disconnecting stops future syncing. Data already imported is handled as described in “Data Retention” below, and you may request its deletion.
5. Third-Party Services and Sub-Processors
We rely on a limited set of third-party providers to operate the Service. We share only the information needed for each provider to perform its function. Each provider has its own privacy policy governing its handling of data, and we encourage you to review them. Our current providers include:
- Supabase — database and file storage hosting (stores the personal information you and your activities generate).
- Vercel — application hosting and delivery (processes requests, including IP addresses, in server logs).
- Mapbox — maps and points-of-interest lookups (receives map and location coordinates).
- Google Places — nearby bike-shop discovery (receives location coordinates).
- OpenStreetMap / Nominatim — reverse geocoding of place names (receives location coordinates).
- BRouter and OSRM — cycling route generation (receive route waypoint coordinates).
- Open-Meteo — weather for routes and rides (receives location coordinates).
- Strava and Garmin — optional fitness-activity import (see “Connected Accounts” above).
- Anthropic — AI features such as the route builder and in-app assistant (see “Automated Processing and AI Features” below).
- Brevo — email and SMS delivery (receives the recipient address or phone number and message content, such as login codes and notifications).
- Upstash — rate limiting and abuse prevention (receives IP addresses and identifiers such as email addresses).
We may add or change providers as the Service evolves and will update this list accordingly.
6. Automated Processing and AI Features
The Service includes optional AI-powered features, such as the route builder and the in-app assistant. When you use these features, the content you submit — including your messages, the route and map context (for example, coordinates and the area you are viewing), and related ride or gear details — is sent to our AI provider (Anthropic) to generate a response.
We log these prompts and responses to operate, debug, and improve the features and to detect and prevent abuse. Our AI provider processes this content to return a response and does not use it to train its models. We retain AI interaction records as described in “Data Retention” below.
7. Data Retention
We retain your personal information for as long as your account is active or as needed to provide the Service. If you request deletion of your account, we will delete or anonymize your personal information within 30 days, unless retention is required for legal or legitimate business purposes. Certain information may remain in backups for a limited period.
8. Data Security
We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, disclosure, alteration, or destruction. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
9. Your Rights and Choices
Depending on your jurisdiction, you may have certain rights regarding your personal information:
Access: You may request a copy of the personal information we hold about you.
Correction: You may update or correct your account information at any time by logging into your account.
Deletion: You may request that we delete your personal information or delete your account directly within the Service.
Data Portability: You may request a copy of your data in a commonly used, machine-readable format.
Marketing Opt-Out: You may opt out of marketing communications by following the unsubscribe instructions included in those messages.
To exercise these rights, contact us at the email address listed below. We will respond within 45 days.
10. Children's Privacy
The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that such information has been collected, we will take appropriate steps to delete it. If you believe a child under 13 has provided personal information, please contact us.
11. Do Not Track Signals
The Service does not currently respond to “Do Not Track” signals from web browsers. We will update this policy if our practices change.
12. International Users
The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in the United States. By using the Service, you consent to this transfer.
13. Changes to This Privacy Policy
We may update this Privacy Policy periodically. If we make material changes, we will post the updated version within the Service and update the effective date. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.
14. Contact Information
If you have questions about this Privacy Policy or our data practices, contact us at:
Kokopelli Labs LLC
Email: hello@biketopia.com
Website: biketopia.com
© 2026 Biketopia. All rights reserved.