privacy, in plain english.

who we are.

plus1 is an independent iOS and android app made by moss davis, a sole developer based in the forest of dean, gloucestershire, united kingdom. we're the data controller for everything described on this page. you can reach us any time at hello@plus1app.uk.

what data we collect.

we only collect what we genuinely need to make the app work. nothing about your device fingerprint, ad ID, contacts, or anything you didn't actively give us.

how we use it.

• to show you rides — your feed needs ride data; ride data needs hosts. rides from groups you're in, or whose rides you've come on in the last 12 months, are shown first.
• to send you notifications — a reminder the day before (asking if you're still in) and an hour before a ride you're attending; a ping when someone joins your ride or comments on it, when an organiser posts an update on a ride you're going on, or when the host answers on a ride you've asked about or said maybe to. you can turn these off in your iOS or android settings any time.
• to schedule local reminders — these are scheduled on your device, by your device, and never leave it.
• to keep the app secure — basic abuse prevention (e.g. spotting spam patterns server-side).
• to keep the app working. your app version tells us when you need to update, and android's crash summaries tell us what to fix.

we do not use your data for advertising, profiling, or training machine-learning models.

why we're allowed to use it.

uk data-protection law asks us to name the lawful basis for each thing we do with your data. we rely on four.

"active now" and your location.

"active now" lets you say you're out for a ride so other riders nearby can find you. it is entirely optional — the rest of plus1 works without ever granting location access. here is exactly what happens:

• we ask for coarse location only. the app never requests precise location permission.
• your position is rounded on your phone, before it is sent. we snap it to a grid of roughly one square kilometre and send only the grid square. we never receive, store or log your real coordinates.
• while you're out, even in your pocket. during an active now session your square keeps updating as you ride — on iphone using apple's low-power "significant location change" updates if you allow "always" (with "while using" it updates only while the app is open), on android using a foreground service that shows a notification the whole time, with "i'm done" on it. it's still only the rough square, never your position, and it stops the moment you tap "i'm done" or the session ends (at most four hours). outside a session plus1 never reads your location.
• we watch for impossible jumps. to stop anyone faking their square, the server keeps, for the length of your session, when your square last changed and how many times — no coordinates. a jump too fast to be real quietly pauses near you and been there until it settles. it goes when the session does.
• you choose who sees you. when you go out you pick everyone, mates or just me. everyone: other riders who are out, and your riding mates, can see your rough square, never your exact spot. mates: only your riding mates can see you, whether they're out or not, and riders nearby aren't told. just me: nobody else can see you, nobody is told, and you're not counted, but you still get the places and trail reports near you, and been there still fills in if it's on. this is enforced by our database, not just hidden in the app: if you are not currently out yourself, the server returns nothing, unless you are riding mates with the person who is. riders who haven't gone active see a count of how many people chose everyone nearby, and no identities.
• riders who can see you also see how long. alongside your rough area and what you typed, they see how long you've been out and roughly how long you've got left ("about 40 min left"), so nobody sets off to meet someone who's about to pack up.
• you're shown as an area, never a pin. the map draws a soft circle wider than the grid square. there is no point on it that represents you.
• it ends on its own. you pick 1, 2 or 4 hours; four is the maximum and the server enforces it. tapping "i'm done" deletes the record immediately; an expired session stops being visible to anyone and the record is cleared within about a day.

plus1 does not offer live location sharing between riders, and we have no plans to store precise location. if you want to share exactly where you are with someone you've arranged to meet, use whatsapp or your phone's own location sharing — those are built for it, time-limited, and revocable.

riding mates, messages and blocking.

you can ask another rider to be riding mates. it is mutual and approval-gated: nothing happens until they accept, and either of you can end it at any time. being mates changes exactly two things:

• you can see each other's "active now" status even when you're not out yourself, unless the one who's out chose just me. this is the one exception to the rule above, and you chose the person. your "you're active" card always shows how many mates can currently see you.
• you can message each other any time, not only while you're both out.

your plus1 code. in settings → your plus1 code you can show a code for someone with you to scan with their phone's camera: you become riding mates straight away, with no request to accept, because you chose to show it. a code you show works for 10 minutes. you can also share your link: anyone who opens it sees your first name and initial (and your approved photo, which on the web shows only if you've chosen to show it publicly), and can send you a normal mate request. blocks still apply, and "reset my code" makes old links stop working.

messages between riders are stored so the other person can read them, and either of you can delete your side. a conversation can only be started between two riders who are both out right now, who are already mates, or who are on the same ride: you can ask a ride's host a question before you join (only the host sees it), a host or the group's leaders can message riders going, waiting or a maybe on their ride, a lift driver and the riders going can message from 48 hours before the ride, and two riders going to the same event can message from 7 days before it. there is no way to cold-message someone from the feed. we cap how many new conversations one account can open in an hour.

blocking is available from any conversation or rider. it is immediate and symmetric: neither of you can message, request, or see the other's active status. we do not tell the other person they've been blocked.

reporting is available anywhere you can act on a rider — a conversation, an attendee, a comment author. reporting someone also blocks them, so you're protected the moment you report. the report goes only to us to review; the other person is never told, and no other rider can see it.

when you go out we keep the rough square you started in, and when — only you can read it, it's overwritten each time you go out, and it goes with your account. it's used to nudge you when someone goes out nearby if you turn on "riders near me" in settings (off by default, at most one nudge every two hours, switch it off and the nudges stop), and to tell you about pop-up rides posted near you.

your home square. to send you new rides, group rides and day-before reminders only within the distance you choose (10, 25, 40 or 60 miles, 40 unless you change it), we use your home square: one you set in settings, or else the rough square you last went out from, or else your home riding area. it's rounded to about a square kilometre, only you can see it, it's never shown to anyone, and you can forget a square you set at any time.

near you: places, trail reports and epic trails.

while you're out on active now, the tab also shows what's around your rough square — within about five kilometres: how the trails are riding today, according to riders who were just there; trails other riders have called "epic"; and places — trail centres, cafés, bike shops, bike washes and the like. it only opens up while you're out, and every report is tied to a rider's rough square, or to a pin on the trail itself, never to where the rider is.

• where it comes from. trail reports and epic trails come from riders who are out. places come from riders, from our own research, and from openstreetmap (© openstreetmap contributors, open database licence) — we show that credit wherever their data appears. a moderator checks every suggested place before it's shown.
• how long they last. a trail report lasts 48 hours; a confirmation from another rider nearby adds time, up to four days at most, and it's deleted a week after it expires. a closed trail is different: it stays up for as long as the rider who reported it chose (a week, a month, two months, or until it reopens). for "until it reopens" we ask them each month whether it's still closed, and it ends if there's no answer within another month. any rider out within about 2 km can say it's open again, which ends it. an epic trail lasts four months from the last "still epic", a year at the outside, and is deleted a week after that. places stay until we remove them. a report a moderator hides is kept for 180 days so we can deal with complaints, then deleted.
• who sees who. other riders see the report, its square or pin and how many riders agreed, never who made it. local moderators see the text and the square so they can hide anything abusive; only moss can see the reporter's name. a place you suggest shows your first name to the moderator who reviews it, and never to other riders. your own position is still only ever sent as the rough square.
• unofficial trails. some areas are marked "unofficial trails reported around here". we store and show these only as a rough area — no name, no line, no point — with the reminder that they may not be legal to ride. if you own or manage land and want an area removed, email hello@plus1app.uk and we'll take it down.

been there: your scratch map.

been there colours in the rough squares you've been out in, and rolls them up into "12 of 57 riding areas" and "68% of the forest of dean". it's off until you turn it on, because an active now session is normally deleted the moment you tap "i'm done" — the scratch map is you asking us to keep the square.

• what's kept. for every session while it's on: the rough square you started in and any square you moved into, with the first and last time you were there and how many sessions started there. no route, no track, no times in between. a ride you were on (host or joined, and not marked absent) adds its meeting-point square too.
• who sees it. only you can see your squares. you choose: keep it private; share a card of your totals when you want to; or appear on a leaderboard, where other riders see your first name and your square or area count — never the squares, and never anything from today, so nobody can tell you're out from it.
• turning it off deletes every square immediately. deleting your account does too.

pop-up rides.

plus1 reads each riding area's forecast and shows the slots that look good for a ride. tap keen on one and we record that; other riders see how many are keen, never who. when three riders are keen a pop-up appears on its own, with the keen riders in it; a local moderator can also post one. the forecast comes from open-meteo, which is sent only the riding area's centre — never anything about you.

when a pop-up is posted we may tell riders whose last go-out square was nearby (if they've kept "new rides" notifications on). joining stores that you joined and when; everyone in gets a nudge when it needs a host, when someone hosts it, and if it closes. once a rider hosts it, it's their ride under the normal rules.

• pop-ups near where you are. if you've already let plus1 use your location, each time the feed loads the app sends your position rounded to about a square kilometre, so we can show pop-up rides and riding windows within 50 km of it. the server rounds it again, uses it for that answer and doesn't store it. we never ask for location just for this; without it we use your home area. pop-up notifications still use your home area.
• busy times and places. we keep anonymous counts of when and where riders go out, join rides and say they're keen — riding area, weekday and hour only, no names — to suggest better pop-up times and places. the counts fade week by week and are gone after about seven months. a usual time is only suggested once at least two different hosts have ridden then, and a pop-up only ever meets at a start that three different hosts or five different riders have set off from. so that each rider counts once, the server privately notes that you've been counted — until that ride or window starts, or for a day — then forgets it.

groups.

anyone can start a group — a club, a shop's rides, a guide, a regular crew. a group is run by its leaders, who organise its rides under the group leader terms or, for a group that hosts social rides, the host terms. a group that guides or leads rides looks after the riders on them; on a social ride, everyone rides at their own risk.

• starting, leading or hosting for a group. we keep the group's details, which terms you accepted (group leader terms or host terms), the version and the time, and our approval decision. your acceptance of the host terms is private. every new group is checked by hand before it goes live; the people who approve it see your display name, how long you've been on plus1 and how many rides you've hosted. we may mark a group "verified" once we've checked it's the club, shop or guide it says it is.
• members. who's in a group is visible to its leaders — display names, when you joined, and rides with the group in the last 90 days. the public group page shows only a member count. a group can be open, or ask-to-join, where a leader sees your request and your display name.
• groups that are opening soon. new groups start as opening soon while they're set up. tapping notify me when it opens (or asking to join) holds your request: you're told once that it's getting set up, and again when the group opens and lets you in. its leaders see your request as held, with your display name. a held request is deleted when a leader approves or declines it, or after 90 days.
• who it's for. a group can be for everyone, for women or for men, and a ride can be women only or men only. to join a women's or men's group or ride you tell us once who you're riding as (see "riding as" above). for a group that asks to join, a leader still approves you, seeing your display name, photo and riding record as for any request.
• inviting riders. a group's leaders and members can invite riders they find by name (see "finding riders to invite to a group" above); in a group that asks to join, a leader approves a member's invite before it reaches you. you choose whether to accept. a no isn't pushed to anyone, and the group's leaders see it in their invite list for 30 days.
• ride hosts. a group's leaders can make a member a ride host. a ride host sees who's going and waiting on their own rides and when each rider accepted the waiver, and can export that list; they don't see the group's members, its keep me posted emails, or anyone else's rides. leaders see all of the group's rides.
• members-only rides. a group can make a ride members only. then only its members, and anyone already going, can see it in the app. it never appears on the website, in the group's embed or calendar, or near you for anyone else, and a link to it shows only the group's name.
• installing from a group's link (android). if you get plus1 from google play through a group's page, the link carries the group's short name. the first time the app opens it asks google play for that, once, keeps only the group's name on your phone, and opens that group's page after you've signed up — then forgets it, and never keeps it more than 7 days. nothing about the install is sent to us; if you then join the group, it's counted like any join from a link: a daily total with no names.
• group areas. a group can list the areas it rides in. they're public on its page, to about a kilometre.
• rides, waiting lists and waivers. a ride's organisers (its host, the group's leaders, any co-host, and a sweep the host or a leader chose) see who's going and who's waiting, when each rider joined and accepted a waiver, any no-photos request and who made it, and can download that as one spreadsheet per ride, with the ride's riding area, its label and the number of walk-ups. the host and the group's leaders also see each rider's turned-up record (see "running a ride"), and a group's leaders get the email address of anyone on the list who is a member of the group and said yes to its keep me posted. co-hosts and sweeps never see either, and ride hosts never see emails. once downloaded, the group is responsible for it. we keep your place in a waiting list, the waiver text you accepted and the time.
• attendance history. a group's leaders can download the group's attendance for a period of up to 24 months: one row per rider, by display name, showing for each ride whether they made it, missed it or were going, with walk-ups. a ride host gets the same for the rides they hosted.
• feedback. a group can add a link to its own feedback form, which riders who came see after each ride. the group's leaders see how riders rated each ride and their notes, never with names.
• impact reports. a group's leaders can make a report of the group's totals (how many rides, turnouts, riders new to the group or who came back, connections made and hours ridden) to share with a funder or sponsor. only the group's leaders can make one, and it's made into a pdf on their phone: plus1 doesn't keep it, only a count that one was made. it's numbers only: never your name, your contact details or anything from a ride list. a leader can add one of the group's own update photos.
• charity numbers. if a group adds its charity or cic number, it's shown on the group's page and its reports.
• nudges and "can't make this one". a group's leaders can nudge members who haven't answered about a ride, once per ride. if you tap "can't make this one", the leaders see how many can't make it, never who, and you aren't nudged about that ride.
• leaving a group. when you leave a group, or a leader removes you, we note the date and when you joined, so a group's impact report can count its members honestly. nobody can see it, and it's deleted with your account.
• updates. updates and photos posted to a group, and the group page itself, are public.
• group codes and posters. a group's code is a qr code of its usual page link. scanning it opens the group's page. a leader can print it on a poster, which is made on their phone.
• group websites and calendars. a group's leaders can show the group's upcoming rides on their own website and share a calendar link. these show only what the group's public page already shows (each ride's title, time, place, description, cover photo and whether places are left), never who's going. when the rides are shown on a website we count it, once per day per group, with no names and no cookies; nothing is stored on the visitor's device.
• reading an event page. if you paste a link into quick post, plus1's server fetches that one public page, reads the event's title, date, time, place and summary, and sends them back to your phone to check. we don't keep the page or the link. we keep a count of how many links you've read each day, to stop misuse; it's deleted after a week, or with your account.

running a ride: organisers, check-in and updates.

a ride's organisers are its host and, for a group's ride, the group's leaders. they can also give riders who are going a role on that one ride: co-host, sweep, first-aider or lift driver.

• roles. riders who can see the ride see each role next to the rider's name, and for a lift, the seats and where from. a co-host, or a sweep the host or a leader chose, helps run that ride only: they can check riders in, post updates, and see and download its list of riders. they never see emails, emergency contacts or riders' turned-up records, and have no say in the group. a rider who offers to sweep shows as the sweep, but gets none of this until the host or a leader confirms them. a first-aider with a checked first aid certificate shows as checked. pace groups show how many riders picked each one, not who.
• check-in. from an hour before the ride until six hours after it ends, its organisers can check riders in, or show the ride's code for riders to scan with their own phone camera. scanning it checks you in, and joins you first if you weren't going, under the ride's usual rules (blocks, women's and men's rides, waivers). the code changes every two minutes, so a screenshot sent to someone at home stops working, and the code itself is never stored. riders who turn up without plus1 are counted as a number, nothing more.
• who made it, and your record. after the ride the organisers tick who made it, starting from check-in, and can undo a tick. from that we keep how many of the rides you joined you turned up to. you can see your own record; the organisers of a ride you're going on see it once you've done 3 rides; plus1 can see it. other riders never do, and dropping out before a ride never counts against you.
• ride updates. organisers can post an update that's pinned on the ride's page and pushed to riders going (see "ride updates" above).
• "still in?" the day before a ride you're going on, we ask whether you're still in. the host and the group's leaders see how many have said they're still in, and how many dropped out, not who. your answer is deleted 7 days after the ride.
• first-timers. the host, and for a group's ride its leaders, see which riders going are on their first ride on plus1 or with the group, so they can say hello. nobody else is told who's new.

emergency contact and no photos.

emergency contact. you can add the name and phone number of someone to call if you're hurt on a ride — nothing else, and never medical details. it's optional, unless a group asks for one before you join its rides. only the host of a group ride you're going on, and that group's leaders, can see it, in the app, from 24 hours before the ride starts until 24 hours after it ends. it isn't shown to other riders, isn't in any download or on the web, and we don't use it for anything else. if the host opens it, their phone keeps it with the ride's copy saved for no signal, until 24 hours after the ride ends. we keep a record of who opened it, for which ride and when, for 90 days, and you can see that record in the app. please only add someone who's happy to be contacted, and let them know you've added them. you can change or remove it any time, and it's deleted with your account.

if someone named you as their emergency contact. you didn't give us your details yourself, so here is what happens to them. we hold only your name and phone number, as the rider typed them, and nothing else about you. only the host of a group ride that rider is going on, and that group's leaders, can see them, in the app, from 24 hours before the ride until 24 hours after it, and only to reach you if the rider is hurt, lost or unwell. we keep a record of who opened them and when, for 90 days. we never contact you ourselves and never use your number for anything else. we hold them on the basis of legitimate interests: being able to reach someone if a rider is hurt. they're deleted when the rider changes or removes them, or deletes their account. if you'd rather not be someone's emergency contact, email hello@plus1app.uk with your phone number and, if you know it, the rider's name, and we'll remove your details.

no photos of me. if you turn on "no photos of me, please", the hosts and group leaders of rides you join see it next to your name on their list of riders, and riders adding photos to a finished ride you were on are shown that you asked. it's a request: we can't stop anyone taking a photo.

group emails: keep me posted.

• some groups let you tick "keep me posted" when you join, so they can email you about their rides and news. it's never ticked for you. we record that you said yes, which wording you saw and when, and any email address you gave for that group.
• the group's leaders can then download your display name and email address. they also see your email address in the list of riders for any of the group's rides you're on, and it's in that list's download. once they have it, the group is responsible for it under data-protection law, as its own controller, not plus1.
• you can stop any time on the group's page or in settings → group emails, and leaving the group stops it too. for 90 days afterwards the leaders' list shows that you've stopped, so they can take you off their own list; then we delete the record. if you said yes while asking to join and never became a member, the leaders never see it, and we delete it once you stop or your request ends.
• if a group has already added you to its own mailing list, use the unsubscribe link in its emails. deleting your plus1 account deletes our record, but we can't take back an address a group has already downloaded.
• if you signed in with apple and hid your email, a group's emails may not reach your hidden address. you can give that group a different address when you tick the box. we only give it to that group.

sharing rides.

when a host shares a ride, the app uploads a card image to our storage; it's public at its link so facebook, whatsapp and imessage can show a preview. link previews show the ride's title, time, place and how many are going. they never show riders' names; a card a host shares shows the host's own display name, or the group's name.

a route on a public ride is public too: anyone with the ride's link can see it and download the trimmed gpx file, without signing in. we count how often a ride or group link is opened and the store buttons are tapped, and where the link came from (a share, a poster, a code and so on), as daily totals with no names and no cookies.

secret spots.

as well as naming an epic trail, you can pin a secret spot — an exact point where you're standing, tagged fresh first, loam, brand new trail, running well or must ride. this is the one place plus1 shares an exact location, and only because you choose to: the pin is stored and shown to riders out nearby, or only to your mates if you pick that, with the date to the day. it fades after four months unless riders keep it alive. trail builders and landowners can ask us to take a pin down; that request stores the requester's account and reason.

apple watch.

if you use the watch app, we note whether you went out from the watch or the phone, and store the watch's own push token so notifications can reach it directly. the phone hands the watch its own sign-in; the two never share one. going out from the watch uses the mode you chose on your phone (everyone, mates or just me).

new notifications.

group updates, join requests, a weekly "share your ride" reminder for hosts, and "your group is approved / verified" — each has its own switch in settings, or follows the one for the feature it belongs to.

rides from riders you know. when a mate, someone you've ridden with in the last 12 months, or a host you've chosen to follow posts a ride near you, we can tell you (settings → notifications). the host is never told you follow them. new-ride alerts can also be limited to the days and kinds of ride you pick, including dig days, and to a few a day; those choices are yours alone.

muted rides. your notification settings, including rides you've muted, are yours alone. a mute on a ride is deleted 7 days after it.

inbox → activity lists the last 30 days of comments, updates and group news on the rides and groups you're part of, invites to you, and asks for feedback. it's put together from what's already there each time you open it, so nothing new is stored; muted rides and blocked riders are left out.

the web app.

there's also a web app at rideplus1.netlify.app for riders without the apps. it does the same job with a few different helpers: onesignal delivers browser push notifications if you turn them on (they hold a push subscription for your browser, not your email); openstreetmap and carto serve its map tiles, and openstreetmap's nominatim does its place search — those servers see your ip address and what you look at or search; and the what3words api turns an address into a spot on the map.

the web app also has an sos and companion-ride form. if you use it, your browser reads your exact position once, turns it into a what3words address, and sends that address, your name and what you typed to us so we can act on it. apart from secret spots you choose to pin (below), that is the one place plus1 handles your precise location — only when you press the button, and it's stored no longer than it takes to deal with.

signing in with apple or google.

plus1 supports sign in with apple (on iOS) and sign in with google (on android), alongside plain email and password. when you use one of them:

• apple or google sends us a verified user identifier and your email address (with apple you can choose a private relay address; with google it's your account email). your name is shared the first time only, if you choose to.
• we never receive your apple id or google password, your devices, your purchases, or anything else from your apple or google account.
• if you use apple's "hide my email," messages we send you (e.g. password reset) go through apple's relay and only apple knows your real address. we're fine with that.

where the data lives.

plus1's backend runs on supabase, a managed postgres + auth + storage service. supabase processes data on our behalf in eu-west data centres. they don't use your data for their own purposes.

push notifications are delivered via apple push notification service (apns) on iOS, and google firebase cloud messaging (fcm) on android. we send the relevant service a push token and a short message; they deliver it to your device.

if you tap a what3words address on a ride, the app opens what3words.com in your browser — nothing is sent from the app itself. the web app does use the what3words api (see "the web app" below).

email you send to hello@plus1app.uk goes through improvmx, which forwards it to our support inbox in google's gmail. we keep it there so we can answer you and keep a record of what was asked.

how long we keep it.

we keep your data for as long as your account exists. when you delete your account (which you can do from the in-app profile screen, or by emailing us), we delete:

• your auth record and email
• your name, home riding area, and any other profile fields
• your 18+ confirmation, level, bike and riding as answer, your plus1 code and your app version records
• your push tokens
• rides you posted are anonymised — the ride content stays so attendees who joined still have a record, but it's no longer associated with you.
• your comments are deleted. updates you posted on rides stay on them, shown as "a rider".
• uploaded photos are deleted from storage, and so are routes you added.
• your qualifications and their photos, photos and video links you added to rides, events you said you're going to, your risk checks and spot notes, your bikes and garage history, your scratch-map squares, your trail reports and epic trails, your roll-call marks, kudos and strikes, your check-ins, ride roles and "still in?" answers, the hosts you follow, and any rides you joined or pop-ups you were in are deleted; places you suggested and feedback you sent stay, with your name removed.

if you'd like everything wiped — including any anonymised ride records — email hello@plus1app.uk and we'll do it within 30 days.

"active now" sessions are the shortest-lived data we hold. a session lasts at most four hours, is deleted the moment you tap "i'm done", and an expired one is cleared within about a day. trail reports last up to four days and are deleted a week after they expire; a closed trail lasts as long as its reporter chose, up to two months at a time, and is deleted a week after it ends; epic trails last up to a year and are deleted a week after they expire; a report a moderator hides is kept for 180 days. been there squares are kept until you turn the scratch map off, when they're deleted immediately. your bikes, place suggestions, pop-up joins, roll-call marks, kudos and feedback are kept with your account. messages are kept so the other rider can read them; deleting your account removes every message you sent and every mate link and block that involves you.

groups and rides. your emergency contact, your no-photos setting and your keep me posted choices are kept with your account and deleted with it. who opened your emergency contact is kept for 90 days, and so is a keep me posted choice you've stopped. a note each time a leader downloads their keep me posted list is kept for 12 months, and your daily count of links read for 7 days. a maybe goes when the ride starts, and a removed comment after 90 days. a held request to join a group goes when a leader approves or declines it, or after 90 days. your "still in?" answer goes 7 days after the ride, and so does a mute on that ride. check-ins and who made it are kept with the ride's register. ride updates stay with their ride, and a route stays until it's removed or its ride is deleted.

photos, qualifications and risk checks. a photo taken down from a finished ride is deleted from storage straight away and its record after 90 days; one hidden by a report goes from storage after 30 days unless we put it back. a qualification we couldn't check is deleted 30 days after we looked, and a checked one 90 days after it runs out. risk checks stay while the guide's account does. saying you're going to an event stays until you take it back, the event is removed, or you delete your account.

codes and copies. a ride's code is never stored: it's worked out when it's shown and changes every two minutes. a mate code you show lasts 10 minutes; your own code stays until you reset it or delete your account. inbox → activity stores nothing of its own and only looks back 30 days. copies of rides saved for no signal are deleted from your phone 24 hours after the ride ends.

we also keep a log of moderation actions — what was hidden or approved, by whom and why, and place suggestions — so we can answer complaints. it holds account ids, not names, and no rider can see it.

your rights.

under the uk gdpr you have the right to:

• access — ask us for a copy of everything we hold on you.
• correction — fix anything that's wrong (you can edit most of it yourself in the app).
• deletion — wipe your account, as described above.
• portability — get your data in a machine-readable format.
• object — to any processing you're not happy with.
• complain — to the uk information commissioner's office (ico.org.uk) if you think we've got something wrong.

email hello@plus1app.uk for any of the above. the same rights apply if you're someone's emergency contact.

cookies and tracking.

the app (iOS and android) uses no cookies and no third-party tracking sdks of any kind — on android, google's firebase sdk is used only for push message delivery, not analytics or advertising. the marketing website you came from (plus1app.uk) is a static html page with no analytics or trackers either.

children.

plus1 is for adults. you must be 18 or over to use it — it's in the terms. if you're under 18, please don't sign up. if you're a parent or guardian and discover that your child has, email us and we'll delete the account. everyone confirms they're 18 or over when they sign up, and we keep the date they did. riders can report someone who might be under 18, and we close the account of anyone we learn is under 18.

security.

we take reasonable steps to protect your data:

• all traffic to the backend is over https/tls.
• passwords are hashed with bcrypt by supabase auth — we never see your plaintext password.
• row-level security policies on the database mean users can only read/write their own rows where appropriate.
• the apns/fcm server keys, supabase service-role key, and other secrets live only on the server, never in the app binary.

no system is perfectly secure. if you ever spot something concerning, please email us first — we'd rather hear from you than from the news.

changes to this policy.

if we ever change anything material, we'll update the "last updated" date at the top and — if it actually affects you — let you know in the app. the historical version will stay archived on request.

contact.

any privacy question, request, or complaint:

moss davis
email · hello@plus1app.uk
forest of dean, gloucestershire, united kingdom