How Tracker works with your data

Your group has its own rules and privacy policy covering how they manage your membership. This page covers Tracker itself, the platform we all use. Your group's policy lives over here.

What Tracker does with your stuff

Who runs Tracker

I (Jason) do. Your group runs the membership, who's a member, who's an observer, what counts as a qualification, that sort of thing. This page is only about the platform.

What Tracker stores about you

Stuff you or your group gives us: your name, email, phone numbers, address, date of birth, the bike you ride, any membership numbers (Group, IAM, etc.), a photo if you upload one, emergency-contact notes, and your preferences for what emails you want. Emergency-contact notes are a free-text field, so please avoid including sensitive medical information unless genuinely necessary.

Stuff we record as you use it: your ride and training history, qualifications, payments and direct debits, files uploaded to your record, logs of when people make changes, and a copy of emails and surveys sent using Tracker.

This data is used to manage memberships, rider training, qualifications, communications, events, payments, and the operation and security of Tracker.

Where it lives

Tracker itself runs on a UK-hosted server I look after. Anything you upload (profile photos, library documents, files attached to your record) sits in Amazon Web Services (S3) in Ireland. Email goes out through Mailgun. If your group bills by direct debit, the bank-mandate details flow to GoCardless when you set the mandate up.

Cookies

Three of them, all strictly necessary for sign-in or security: a session cookie, a CSRF token, and a "trusted-browser" cookie that lasts 60 days so you don't get asked for an email code every single time you sign in. No tracking, no analytics, no advertising.

Email

Emails sent using Tracker are logged, the same way you'd have a copy in your sent folder. Only the sender can normally view email contents through Tracker administration screens. We keep a copy for a year, in case anyone needs to prove an email was sent or get a copy of one back.

What happens when you leave

Your group's admins decide. There are three states:

• Deactivated, you can't sign in, but the record is intact.
• Retired, personal contact info gets wiped; the membership record stays.
• Anonymised, your record is anonymised, we scrub things like your name and text about you, and you stop being identifiable in the data.

This is all so your group can continue to track their activity and training history after you leave, but in a way that respects your privacy and right to be forgotten. Partly for their own benefit, and partly for legal and insurance reasons.

Getting your data or asking us to delete it

Start with your group admin, they're the ones who own the relationship. I'll step in if your group can't action a request, but they're the right first stop.

Errors and crashes

When something blows up server-side, I get an email with the traceback. That email can include the URL you were on and any form data you submitted, so it's technically possible something you typed ends up in my inbox while I'm debugging. I'm not reading it for fun.

If you spot something

If you find a bug or think you've found a security issue, please get in touch directly at mail@ridethesystem.com. I'd genuinely rather hear about it from you and fix it than find out later because someone exploited it. No bounty programme or hall of fame, just a sincere thanks, a fix as fast as I can manage, and a pint or dram if you're ever up my way.

Please don't intentionally access other people's data, disrupt the service, or exploit vulnerabilities beyond what's reasonably necessary to demonstrate the issue.

Third parties

• Mailgun, sends every email Tracker sends.
• Amazon Web Services (Ireland), stores anything you upload.
• GoCardless, only used if your group bills by direct debit.
• Google Calendar API, only if your group's switched on calendar sync (off by default).

No analytics tools, no tracking pixels, no advertising.

Using Tracker

The arrangement

Tracker is a platform I run. Your group runs the membership. I'm not going to pretend that reading this page magically makes it a contract you've signed, that's the kind of thing everyone scrolls past for good reason. It's just how the relationship works, written down so we're all on the same page.

What I promise

Best-effort uptime, regular backups, honest disclosure of how it works (this page), and a genuine effort to fix things when they break.

What I don't promise

Bulletproof uptime, instant support, or that nothing will ever go wrong. It's a small operation, not a multi-national with 24/7 support you can call and wait on hold for.

Acceptable use

Common sense: don't try to break Tracker, don't scrape it, don't impersonate other members, don't upload anything illegal or anything that isn't yours to upload. Your group's own rules also apply.

Accounts

Your group decides who gets one and who loses one. If your group offboards you, your access to Tracker goes with it.

Liability

Tracker is provided as-is. If something goes badly wrong, my liability is generally limited to doing what I reasonably can to fix it. There's no money changing hands between you and me directly, so there's nothing to refund.

If Tracker shuts down

If I ever need to wind Tracker down, your group gets at least a year's notice, plus an export of all your group's data and a copy of Tracker's source code, so they can keep the lights on themselves if they want to. I'll communicate that to the groups directly, not just announce it.

Changes to these terms

If these terms change, the date at the top of this page changes too. I won't put a banner up about it, I'll let your group know directly so they can get in touch. If something material changes, I'll email all users.

Jurisdiction

Scotland, that's where I live. If we ever have to argue about something formally, Scottish law applies.

Contact

mail@ridethesystem.com for anything platform-related. Your group admin for anything membership-related.