Pelori Privacy Policy
Last updated: 12 May 2026
Pelori ("we", "us") makes a ride-coordination app for cyclists. You use it to plan group rides with friends, RSVP per occurrence, chat with the crew, and find public rides nearby. This policy explains what we collect, how we use it, and the controls you have.
Information we collect
Information you provide
- Account profile — email, first and family name, date of birth (used to verify the 16+ minimum age), country, and an optional profile picture you upload.
- Ride content — ride names, descriptions, schedules, and meeting points you create or are invited to, plus your membership of each ride.
- RSVP responses — per-occurrence "going / not going / maybe" answers. Visible to other members of the same ride.
- Chat messages — text you send in a ride's group chat. Visible to other members of that ride.
- Feedback — text you submit through the in-app feedback form, along with the app version and platform.
Information collected automatically
- Location
- Foreground (when the app is open) — if you grant the permission, your device's coordinates are read at app start and sent with each Discover query so we can sort public rides by distance from you. Coordinates are not persisted server-side. You can deny and Discover still works without the sort.
- Background, during a live-ride session — when you join the live-ride channel for a group ride, your coordinates are streamed to the other riders in that ride so the crew can see who's where on the route. Streaming stops when you leave the ride or end the session. Coordinates are delivered through our voice/realtime provider (LiveKit) and are not persisted on our servers.
- Voice and live position (optional, during a ride) — Pelori uses LiveKit Cloud (livekit.io) to stream voice and live position between riders in the same ride. Audio and coordinates are delivered in real time to the participants of that ride and are not recorded or persisted by us. The session ends when you leave the ride.
- Diagnostic information — anonymised crash and performance reports via Sentry. We do not attach request bodies or user-identifying details to these reports.
- Product analytics — counts of in-app actions (sign-up, sign-in, ride created, RSVP, screen view) via Google Firebase Analytics so we can see which parts of the app are used and which break. Events are tagged with an anonymous Firebase-generated instance ID rather than your account; we do not pass your name, email, or Cognito user ID to Firebase.
Friend connections
Pelori lets you add other users as friends so you can invite them into rides with one tap rather than typing their email each time.
- What another user sees about you. When you appear to someone
else as a friend, a sent or received friend request, a friend
suggestion, or an email-search result, they see your name, your
profile picture if you've uploaded one, and your country (a
two-letter ISO code, e.g.
GB). Your email address, your date of birth, and your location are not exposed on any of these surfaces. - How someone can find you. Two routes only: anyone you share at least one ride membership with may see you as a suggestion in their Add friends tab, and anyone who already knows your exact email address can look you up via email search. Pelori does not read your phone contacts or address book.
- Blocking. You can block another user from a chat-message long-press. Blocking is bidirectional: each user's chat messages and rides become invisible to the other, any existing friendship is removed, neither appears to the other as a friend suggestion, and neither can send the other a friend request. You can see and unblock anyone you've blocked in Profile → Blocked users.
Notifications (optional)
If you grant the system notification permission, Pelori sends two kinds of push reminder per ride: a "did you RSVP?" nudge to anyone who hasn't replied, and a pre-ride "the ride is coming up" reminder to anyone going. Both are configured per-ride by the organiser (disabled by default). Pelori also sends two friend-related pushes: one when another user sends you a friend request, and one when someone accepts a request you sent. (Declining a request does not send a push.) All notifications are delivered via Firebase Cloud Messaging. Your device's push token is stored on our side paired with your account so the scheduler can route to it; it's removed when you sign out, delete your account, or revoke the permission at the OS level.
Calendar (optional, write-only)
When you tap Add to calendar after RSVPing or joining a ride, Pelori requests write-only calendar permission and pre-populates the system add-event sheet with the ride's name, time, and meeting point. We never read your existing calendar contents and never write to your calendar without your explicit confirmation in the system sheet.
Deep links
When you share a ride, Pelori generates a link of the form
pelori://rides/<id> (or https://pelori.fit/rides/<id>). The link
encodes only the ride's unique identifier; recipients still need to
be a member of the ride to open it.
How we use your information
- Operate the service: authenticate you, deliver invitations, render rides, deliver chat messages.
- Enforce the 16+ age requirement.
- Investigate bugs and improve the app via crash reports and feedback.
We do not sell your personal information and we do not use it for third-party advertising.
Where your data is stored
- Amazon Web Services (Ireland region, eu-west-1) — Cognito for authentication, DynamoDB for ride / chat / RSVP data, S3 for profile pictures.
- Google Firebase (Analytics + Cloud Messaging) — anonymised app-usage event counts and device push tokens. Analytics events carry no Cognito user ID, name, or email. Cloud Messaging stores the per-device push token paired with your account so we can send ride reminders; the token is removed when you sign out or delete your account. Hosted by Google in the US/EU; standard Google Cloud terms apply. See firebase.google.com/support/privacy.
- LiveKit Cloud — realtime transport for voice and live position during a ride. Streams pass through their infrastructure but are not recorded or persisted. See livekit.io/legal/privacy-policy.
- Sentry — anonymised crash and performance diagnostics.
Data retention
- Account data — retained while your account is active. Deleting your account removes your profile, every ride you organise, every membership, every chat message you've posted, your RSVPs, and your avatar.
- Feedback messages — retained indefinitely so we can act on them.
- Crash diagnostics — retained per Sentry's default retention (90 days).
Your rights
- Access — request a copy of the data we hold about you by contacting us at the address below.
- Deletion — open Profile → Delete account in the app. Your Cognito user, every ride you organise (and its members), all your memberships, all your chat messages, your RSVPs, and your avatar files are permanently removed. Deletion is immediate and not recoverable. If you can't sign in or no longer have the app installed, see pelori.fit/delete-account for an email-based request flow.
- Correction — edit your profile in the app, or contact us if a field is not directly editable.
- Withdraw consent — revoke calendar, location, microphone, or notification permission in iOS Settings → Pelori at any time, or delete your account.
EU / UK users have the right under the GDPR to lodge a complaint with their local data protection authority. California users may request access, deletion, or correction under the CCPA / CPRA without discrimination.
Children
Pelori is for users aged 16 and older. We do not knowingly collect data from children under 16. If we learn we have, we delete the account.
Security
We use HTTPS for all transport, JWT-authenticated APIs, and least-privilege IAM roles. Profile pictures are stored in private S3 buckets and served via signed URLs. We rotate third-party credentials through AWS Secrets Manager. No system is perfectly secure — use a strong unique password and enable a screen lock on your device.
Changes to this policy
We will update the "Last updated" date when this policy changes. Material changes are surfaced in-app the next time you sign in.
Contact
hello@pelori.fit