Privacy Policy

Last updated: September 24, 2026

Introduction

AusBUG ("we", "our", or "us") is operated by Bike Routes PTY LTD. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website.

This policy explains how AusBUG handles personal information. Where permission or consent is required, we request it separately.

Information We Collect

Contact Information

  • Name: We collect your first and last name to display on your profile and leaderboards so other cyclists can recognize you.
  • Email Address: Used for account creation, authentication, password recovery, and important service communications.

Location Data

  • Precise Location: We collect your precise location to provide turn-by-turn navigation, display your position on maps, track route coverage, and enable location-based features like nearby hazards and collectible points of interest.
  • Location also supports your position on the map, nearby features and discovery check-ins. Active navigation may use location while your screen is off or the app is in the background. Discovery check-in itself does not require background location. You can change location permissions in device settings; disabling precise location can prevent GPS check-ins.

Discovery collection

The mobile app checks discovery proximity on your device. When you are signed in, earned animal and location identifiers are stored locally and synced to your AusBUG account so your collection can be restored on another device. These identifiers reveal which discovery locations you have unlocked. The collection-sync record contains the earned identifier, an earned flag and a schema version; it does not contain the GPS fix used to check proximity. Offline awards are queued for syncing. Signing out does not delete your account collection, and collections are kept separate between accounts. Device backups and transfers depend on your operating-system settings. Mapping, navigation and analytics services process information separately as described in this policy.

Support and deletion requests

When you contact us, we store your message and contact details to respond. Account-deletion requests also record the verified account identifier where available, your confirmation, request status, handling notes and verification times. Access to deletion handling records is restricted to authorised staff. We retain these records while handling the request and any necessary follow-up; they are separate from the app profile being deleted. Do not submit passwords or sign-in codes.

User Content

  • Photos or Videos: When you report hazards, you may optionally upload photos to help other cyclists identify the issue.
  • Other User Content: This includes hazard and near-miss reports, comments, report confirmations, no-longer-present feedback, traffic-stress votes, star ratings and route data you provide within the app. Near-miss reports can include your answers about a collision or injury.

Traffic-stress voting

When you submit a Level of Traffic Stress (LTS) vote, we associate your chosen rating and the road or path segment with your signed-in account. Votes are sent to the AusBUG LTS map service and contribute to community ratings and routing updates. Pending votes and remembered selections are stored on your device; pending votes can sync when connectivity returns.

Identifiers

  • User ID: A unique identifier (Firebase UID) is assigned to your account for authentication and linking your data (routes, achievements, etc.).

Usage Data

  • Product Interaction: Firebase analytics records app interactions and usage information to help improve the app. Analytics can include installation and technical identifiers; deleting an account does not automatically anonymise every analytics or diagnostic record.

Connected Cycling Account Data

  • Garmin Connect: If you connect Garmin Connect, we may import cycling activity data you authorize, including route geometry, timestamps, distance, duration, and speed information.
  • Strava: If you connect Strava, we access cycling activity data according to Strava's authorization and privacy policies.

Diagnostics

  • Crash Data: Crash and diagnostic reports help us identify faults and can include installation identifiers and technical information. They should not be assumed to be anonymous.
  • Performance Data: We monitor app performance metrics (load times, network requests) to optimize speed and responsiveness.

How We Use Your Information

We use the collected information for:

  • App Functionality: Providing navigation, route planning, hazard reporting, achievement tracking, and all core features.
  • Analytics: Understanding how users interact with the app to prioritize improvements and new features.
  • Account Management: Creating and maintaining your account, authentication, and profile.
  • Safety: Displaying community-reported hazards to keep cyclists informed of road conditions.
  • Community Features: Showing your progress on leaderboards and enabling social aspects of the app.
  • Technical Support: Debugging issues, responding to support requests, and improving app stability.
  • Connected Cycling Features: Showing private personal ride coverage, importing cycling activity history, improving route-time estimates, and creating aggregated, de-identified cycling insights.

Garmin Connect Data

Garmin Connect is optional. We only collect Garmin Connect data after you choose to connect Garmin Connect to AusBUG and authorize the requested Garmin permissions.

  • Data collected: Authorized cycling activity data, which may include activity identifiers, route geometry/GPS track points, timestamps, distance, duration, speed, elevation, activity type, and related activity metadata made available by Garmin Connect.
  • How we use it: To show your private personal ride coverage, import your cycling activity history, improve route-time estimates, and create aggregated, de-identified cycling insights such as community heatmaps and speed maps.
  • Storage and processing: Garmin Connect data is stored and processed in AusBUG systems using Firebase and Google Cloud services, including Firestore, Cloud Storage, Cloud Functions, authentication, logging, and security monitoring. Access is limited to providing, maintaining, securing, and improving AusBUG cycling features.
  • Third-party processing: Firebase and Google Cloud process Garmin Connect data as infrastructure service providers for AusBUG. We do not provide Garmin Connect activity files or Garmin-derived personal activity records to third-party AI services for processing.
  • Sharing: Your individual Garmin Connect activities are not shown publicly and are not sold. We may share aggregated, de-identified cycling insights with advocacy, council, Bicycle Network, or transport partners only where individual users and individual activities cannot reasonably be identified.
  • Retention and deletion: Garmin Connect data is retained while your AusBUG account and Garmin Connect integration remain active, or as needed to provide AusBUG services. You can disconnect Garmin Connect at any time. Account deletion removes your linked Garmin integration and personal Garmin-derived activity data from active systems.

Data Sharing and Disclosure

We do not sell your personal information. We may share information in the following circumstances:

  • Public Information: Your display name, profile photo, and route coverage appear on public leaderboards. Published community reports may appear in both AusBUG and Near Miss Map (nearmissmap.cc). Public report information can include the reported location, description, category, photos, date, road name, collision or injury answers, feedback counts and reporter identity. Reports marked anonymous hide the reporter identity in the shared public feed, but their text, photos and location can still identify someone. Contact details and demographic fields are excluded from that feed. Comments submitted to public report discussions are visible to other users.
  • Service Providers: We use Firebase (Google) for authentication, database, analytics, and crash reporting. These services operate under their own privacy policies.
  • Strava Integration: If you connect your Strava account, we access your activity data according to Strava's authorization and privacy policies.
  • Garmin Connect Integration: If you connect Garmin Connect, your individual Garmin activities remain private to you. We do not sell Garmin activity data. Aggregated, de-identified cycling insights may be shared with advocacy, council, or transport partners where individual users and individual activities cannot reasonably be identified.
  • Legal Requirements: We may disclose information if required by law or to protect the rights, property, or safety of AusBUG, our users, or others.
  • Bicycle Network Partnership: AusBUG partners with Bicycle Network (BN) to promote cycling infrastructure advocacy. We may share aggregated, anonymized usage statistics with BN (e.g. popular routes, infrastructure gaps). Your individual data is never shared — only combined, de-identified trends.

Third-Party Services

AusBUG uses the following third-party services:

  • Firebase (Google): Authentication, database, analytics, performance monitoring, crash reporting
  • Strava: Optional integration to upload routes to Strava Route Builder
  • Wahoo: Optional integration to upload routes directly to your Wahoo cycling computer
  • Garmin Connect: Optional integration to upload routes as courses to your Garmin device and, with your consent, import cycling activity data for personal coverage and aggregated/de-identified cycling insights
  • MapLibre/Mapbox: Map rendering and display. Map requests can include viewed areas, IP addresses and technical identifiers.
  • GraphHopper: Routing and navigation; requests can include route coordinates and technical information.
  • Bicycle Network: Advocacy partner — receives only aggregated, anonymized usage data

These services have their own privacy policies governing their collection and use of data. When you connect Wahoo, we only upload routes you choose to share. When you connect Garmin Connect or Strava, we only access activity data you authorize for cycling-related AusBUG features.

Data Retention

We retain information while providing the service and handling support, security and account requests. Deletion removes personal account data from active storage through a background cleanup process; it does not immediately purge recovery backups or independent copies held by other services.

  • Firestore daily backups have a 14-day retention period and point-in-time recovery has a seven-day window. Deleted files in the checked Cloud Storage bucket have seven-day soft deletion. These settings were checked on 13 September 2026.
  • Confirmed club-owned routes and routes transferred to another owner remain, with the deleted creator label removed. Content belonging to others is not removed just because it refers to your route or post.
  • Analytics, diagnostic and infrastructure logs have separate provider retention settings. We do not promise automatic anonymisation when an account is deleted.

Your Rights and Choices

You have the following rights regarding your personal information:

  • Access: You can view and edit your profile information in the app settings.
  • Deletion: You can initiate account deletion in the app or request it on our account-deletion page. The deletion and retention details below explain the scope.
  • Location Control: You can disable location access in your device settings, though this will limit navigation and tracking features.
  • Marketing: We do not send marketing emails. All communications are service-related.
  • Strava Disconnect: You can disconnect your Strava integration at any time from app settings.
  • Garmin Disconnect: You can disconnect Garmin Connect at any time. Account deletion removes your linked Garmin integration and personal Garmin-derived activity data from our active systems.

Account Deletion

In AusBUG, open Settings → Profile → Delete Account. You may be asked to sign in again to verify your identity. Your sign-in account is removed first and background cleanup follows. If sign-in verification or account deletion fails, the app explains how to retry.

You can also request account deletion on this website, including if you have uninstalled the app. Signing in verifies which account the request concerns. If you cannot sign in, use the support option on that page; we must establish account ownership before deletion. Receiving a request does not mean deletion has finished.

  • Cleanup removes the profile and associated private account records, saved routes, personal routes and posts, owned shared-route copies, connected-service credentials and personal activities, memberships, personal coverage and collection records, and associated personal uploads and contributions.
  • Club-owned routes and content owned by others remain. We remove the deleted creator label from retained routes. Records whose ownership cannot be established require review rather than automatically deleting another person's content.
  • This does not delete your Apple, Google, Garmin, Strava or Wahoo account, or copies you exported to other services. Apple-linked account deletion includes revoking the Apple sign-in authorisation.
  • Successful in-app deletion clears saved planner routes and collection progress on the device used. A website request cannot remotely clear local app storage on your devices.
  • Deletion is irreversible. Recovery backups and separate support, verification and diagnostic records are subject to the retention details above.

Children's Privacy

AusBUG is a cycling and outdoor exploration service for a general audience. If you believe a child has provided personal information requiring review or removal, please contact us through our support page.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

  • Encrypted data transmission (HTTPS/TLS)
  • Firebase security rules to control data access
  • Secure authentication with industry-standard practices
  • Regular security reviews and updates

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically. Where a change requires your permission or consent, we will request it separately.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us through our website:

Open Source and Transparency

AusBUG is committed to transparency. Our infrastructure data and algorithms are documented publicly. We believe cyclists deserve to know exactly how their data is used and how routing decisions are made.