Privacy policy

Who we are

CycleDutch is operated by Sean Reilly, a sole proprietorship (eenmanszaak) registered in the Netherlands with KvK number 42110285. Our registered address is [YOUR ADDRESS]. You can contact us at dovedaledev@gmail.com.

What personal data we collect

Account data

When you create an account we collect your email address. This is the only piece of personal information you provide directly. We use Supabase to manage authentication. We do not collect your name, phone number, or any other personal details unless you contact us directly.

Usage data

We collect anonymous analytics about how you use CycleDutch - which modules you open, how many questions you answer, and whether you complete modules. This data is anonymised before collection and cannot be traced back to you as an individual. We use PostHog for analytics.

Payment data

If you purchase CycleDutch Premium, your payment is processed by Paddle, our Merchant of Record. We do not store your card number, bank details, or any full payment information. Paddle shares with us only: confirmation that payment was successful, the Paddle customer ID, and the transaction ID. See Paddle's privacy policy at paddle.com/legal/privacy.

Technical data

Our hosting infrastructure (Vercel) may log IP addresses and request metadata for security purposes. These logs are retained for a maximum of 30 days and are not used for profiling or tracking.

Why we use your data

We do not use your data for advertising, profiling, or any purpose not listed above.

Third-party services

CycleDutch uses the following third-party services that may process personal data:

• Supabase (supabase.com) - Authentication and database hosting. Data is stored in the EU. Supabase processes your email address and progress data on our behalf.
• Paddle (paddle.com) - Payment processing as our Merchant of Record. Paddle is an independent data controller for payment and tax data. See Paddle’s privacy policy.
• PostHog (posthog.com) - Product analytics. We use PostHog in anonymised mode. No personally identifiable information is sent to PostHog.
• Vercel (vercel.com) - Hosting infrastructure. Vercel may log request metadata for security purposes.

We have Data Processing Agreements in place with Supabase, PostHog, and Vercel where required under GDPR.

Data retention

We retain your account and progress data for as long as your account is active. If you request account deletion, we will delete your email address and progress data within 30 days. Payment records (Paddle customer ID and payment confirmation) are retained for 7 years for legal and tax purposes.

Account deletion

There is currently no in-app way to delete your account. To have your account and all associated data deleted, email dovedaledev@gmail.com from the email address linked to your account. We will delete your account, progress, and badges within 30 days and confirm by reply. Payment records are retained as described under Data retention.

Your rights under GDPR

As a resident of the European Economic Area you have the following rights:

• Access- request a copy of the personal data we hold about you
• Correction- request correction of inaccurate data
• Deletion- request deletion of your account and associated data
• Portability- request your data in a machine-readable format
• Objection- object to processing based on legitimate interest
• Restriction- request that we restrict processing of your data

To exercise any of these rights, email us at dovedaledev@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.