Effective Date: February 22, 2026
1. Introduction
Velo Grupetto ("we," "our," or "us") is operated by Mile High Sandbox LLC, a Wyoming limited liability company. This Privacy Policy explains how we collect, use, share, and protect your information when you use the Velo Grupetto mobile application and website at velogrupetto.com (collectively, the "Service").
By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use the Service.
2. Information We Collect
Account Information
When you create an account, we collect your email address, display name, and avatar or profile photo. This information may be provided directly by you or obtained through Google OAuth sign-in.
Profile Preferences
You may optionally provide cycling preferences including your skill level, preferred bike type, average riding speed, and riding style. This information is used to help you find compatible groups and rides.
Location Data
With your explicit permission, we collect your device's GPS coordinates to provide location-based features, including showing nearby cycling groups, rides, road hazards, and other relevant content. Location data is collected only when you grant permission through your device's location services. You can disable location access at any time through your device settings, though this will limit the functionality of the Service.
User-Generated Content
We collect and store content you create through the Service, including:
- Posts (text and photos)
- Chat messages within groups
- Ride descriptions and details
- Group names and descriptions
- Incident reports (road hazards, bike theft reports)
- Comments and other interactions
Emergency/SOS Data
When you use the Emergency SOS feature, we collect your location at the time of the SOS alert, the emergency description you provide, and the timestamp of the alert. This information is shared with members of your cycling group to facilitate assistance.
Device Information
We collect FCM (Firebase Cloud Messaging) device tokens to deliver push notifications to your device. We may also collect basic device information such as device type and operating system version for compatibility and troubleshooting purposes.
Authentication Data
If you sign in with Google, your Google OAuth tokens are managed by Google in accordance with their privacy policy. If you use magic link email authentication, we generate temporary verification tokens that expire after use.
Usage Data
We collect information about how you interact with the Service, including groups you join, rides you RSVP to or attend, features you use, and general app interaction patterns. This data helps us understand how the Service is used and how we can improve it.
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service
- Show you nearby groups, rides, hazards, and other location-based content
- Deliver push notifications about ride updates, group activity, messages, and emergency alerts
- Enforce our community guidelines, Terms of Service, and content moderation policies
- Process and relay Emergency SOS alerts to your group members
- Improve, personalize, and optimize the Service
- Communicate with you about your account, updates, and changes to the Service
- Detect and prevent fraud, abuse, and security incidents
4. Information Sharing
With Other Users
Certain information is shared with other users as part of the Service's core functionality:
- Your profile information (display name, avatar, cycling preferences) is visible to members of groups you join
- Your chat messages are visible to other members of the group where the message was sent
- Your ride RSVPs are visible to other participants of that ride
- Your Emergency SOS alerts (including your location at the time of alert) are shared with members of your group
Third-Party Service Providers
We use the following third-party services to operate the Service:
- Supabase: Database hosting, user authentication, file storage (including chat images), and realtime messaging infrastructure
- Firebase / Google Cloud: Push notification delivery via Firebase Cloud Messaging (FCM)
- Google: OAuth authentication for Google sign-in
- Render: Application hosting and server infrastructure
These providers process your data on our behalf and are bound by their own privacy policies and data protection commitments.
Legal Requirements
We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation, protect and defend our rights or property, prevent fraud, or protect the personal safety of users or the public.
No Sale of Personal Information
We do not sell, rent, or trade your personal information to third parties for their marketing purposes.
5. Data Storage and Security
Your data is stored on Supabase, a cloud-hosted PostgreSQL database platform. We implement multiple layers of security to protect your information:
- Encryption in transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS
- Row-level security: Database-level security policies ensure users can only access data they are authorized to view
- Secure file storage: Chat images and uploaded files are stored in private storage buckets with signed, time-limited access URLs
- Authentication: Industry-standard OAuth 2.0 and magic link token authentication
While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
6. Data Retention
We retain your account information and associated data for as long as your account is active. If you delete your account:
- Your personal data (profile, preferences, device tokens) will be deleted within 30 days
- Chat messages you sent in groups will persist and remain visible to group members, but will be de-associated from your deleted account
- Incident reports and SOS alerts you created may be retained in anonymized form for safety purposes
- Anonymized, aggregated usage data may be retained indefinitely for analytics and service improvement
We may also retain certain data as required by law or for legitimate business purposes such as fraud prevention.
7. Your Rights and Choices
You have the following rights regarding your personal information:
- Access and update: You can view and update your profile information at any time through the app
- Delete your account: You can delete your account and associated personal data through the app
- Push notifications: You can opt out of push notifications through your device settings or manage per-group notification preferences within the app
- Location services: You can disable location access at any time through your device settings
- Data export: You can request a copy of your personal data by emailing contact@velogrupetto.com
8. Children's Privacy
The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at contact@velogrupetto.com.
9. International Users
The Service is operated from the United States. If you are accessing the Service from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to the transfer of your information to the United States, where data protection laws may differ from those in your country of residence.
10. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to know: You can request information about the categories and specific pieces of personal information we have collected about you
- Right to delete: You can request that we delete your personal information, subject to certain exceptions
- Right to opt-out of sale: We do not sell your personal information, so this right does not apply
- Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights
To exercise these rights, please contact us at contact@velogrupetto.com. We will respond to verifiable requests within 45 days.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you through in-app notifications and by updating the effective date at the top of this page. Your continued use of the Service after such changes constitutes your acceptance of the updated Privacy Policy.
12. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:
Email: contact@velogrupetto.com
Mail: Mile High Sandbox LLC
30 N Gould St, Ste N
Sheridan, WY 82801