Cyclaim

Privacy

Last updated:

In short

Cyclaim is a game for ground on the real map. To work at all, it processes recorded bike rides, which means location data over time. Data like that reveals where you live, how you get to work and what your habits are. It is the most sensitive thing stored here, which is why the application takes up most of this text. The public pages in front of it are comparatively undemanding: they set no cookies and load nothing from other people's servers.

Controller

David Brundert
Kottmeierstr. 31
12459 Berlin
Germany

support@cyclaim.cc

No data protection officer has been appointed. Cyclaim is run by a single person, so the thresholds of § 38 BDSG are not met.

The public pages

This page, the home page, the imprint and the rules page are finished HTML pages produced when the application is built. Here is what does not happen while you read them: no cookies are set, nothing is written to browser storage, no content is fetched from other people's servers and no measurement tools are embedded. Typeface, images and map views live on the same server as the page itself. The map images are prepared image files, not tiles fetched from a map service while you read.

When you open the address without a language, your browser's language preference is read in order to send you to /de or /en. It is evaluated at the moment of the request only, and is neither stored nor logged.

Server log files

Every request leaves a log entry on the server. It holds the time, the method, the address requested, the status code of the response and a random identifier that makes a single request findable afterwards.

Your IP address is processed because no answer could reach you without it, and it is held briefly in memory to limit how many requests one sender may make. After a minute it is gone from there. It does not appear in the log entries: the list above is complete, and an IP address is not a field in it.

The logs are capped in size and overwritten as they go: when new entries arrive, the oldest drop out. No fixed number of days follows from that, because how far back they reach depends on the traffic.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure and undisrupted operation of the site.

Account and sign-in

Cyclaim is a closed beta. You need an invite code for an account. Registration stores:

  • Email address. It is the identifier you sign in with. No mailings or advertising are sent; Cyclaim currently sends no email at all.
  • Password, and only as a verifier produced by the argon2id algorithm. The password itself is not stored and cannot be computed back from the verifier.
  • Display name. The name others see. A nickname is fine.
  • Friend code, eight characters, drawn when the account is created. It is the only way anyone can send you a friend request.
  • Time of registration and a reference to the invite code the account was created with.

The legal basis is Art. 6(1)(b) GDPR: without these entries there is no account, and nothing Cyclaim could do for you.

Session cookie

After you sign in, the server sets a cookie named cyclaim.sid. It holds an identifier and nothing else; everything about the session itself stays on the server. The cookie cannot be read by JavaScript in the browser, travels over HTTPS only, is not sent along to other sites, and expires after 30 days without use. Every request restarts that clock.

There is no consent banner for it, and rightly so: the cookie is strictly necessary for a service you explicitly asked for (§ 25(2)(2) TDDDG). Cyclaim sets no other cookies.

What stays on your device

The application remembers in your browser's storage how you have arranged it: the position and size of the windows, your display settings and the language you last chose. None of this leaves your device or reaches the server. Clearing the site data in your browser removes it.

Uploaded rides

The section that matters most. A GPX file is a list of coordinates with timestamps, and it therefore says where you were and when.

The uploaded file itself is not stored. It is read in memory, evaluated and then discarded. What is stored is what Cyclaim derives from it:

  • the line of the route ridden, as geographic geometry,
  • the start and end time of the ride,
  • the distance covered and the number of recorded points,
  • the calendar day the ride counts towards, in the local time of its starting point,
  • the file name the uploaded file carried, as the name of the ride,
  • a checksum over the contents, so the same ride cannot count twice,
  • the area the ride encloses, along with its share of your ground and of the ground on the shared map.

The legal basis is Art. 6(1)(b) GDPR. Uploading is the core of the service; without rides there is no game.

What you upload is your decision. If a route allows conclusions you would rather nobody drew, do not upload it, or trim it first.

For how long

Rides stay stored until you delete them. Each ride can be removed on its own, which also removes the route and the area derived from it, and the ground on the map is recomputed without it. Deleting the account removes everything attached to it.

A ride that was already older than 30 days when uploaded does not count towards ownership on the shared map. It is stored regardless, because it still belongs to your own ground and your own numbers.

What other people see

  • The ground you hold is drawn on the shared map for everyone signed in. That is the point of the game and cannot be switched off. The colour of that ground is stable per person, even when your name is hidden: people can see that the same rider keeps riding there without learning who it is.
  • Your display name, your profile with its totals, and the ability to have the map jump to your ground are each set to "everyone" or "friends only" in the settings. The default is "everyone".
  • The leaderboard shows display names and the ground held.
  • Your individual rides, the lines ridden and their times, are visible to you alone. Even friends see ground in the shared mode, not your routes.
  • There is no people search. Nobody can be found by name or by email address. The only route to a friendship is the friend code, which you hand out yourself and can redraw at any time.

Who else touches the data

  • Hosting: netcup GmbH, Karlsruhe, Germany. The application runs on a virtual server in a data centre in Germany. That server runs the application and holds the database. A data processing agreement under Art. 28 GDPR is in place with netcup.
  • Database and cache run on the same machine as the application. No further service provider gets to see account data or rides.
  • Map tiles from OpenFreeMap: when you use the map inside the application, your browser loads the map images directly from tiles.openfreemap.org. That service thereby learns your IP address and which part of the map you are currently looking at. This does not happen on the public pages. OpenFreeMap is operated by Hyperknot Software Kft. in Hungary, and so within the EU. According to their privacy policy IP addresses are not logged in normal operation; in the event of a security incident logging may be switched on for at most 30 days. The service does not state where its servers stand and reserves the use of Cloudflare as a delivery network, so a processing step outside the EU cannot be ruled out.

Your data is not sold, not evaluated for advertising and not passed to third parties absent from this list.

Backups

The database is backed up once a day, so that a defect or a mistake while rolling out a change does not destroy everything you have ridden. The copies sit on the same server as the database and are passed to nobody. Each copy is deleted automatically once it is older than 14 days.

This has a consequence worth knowing: when you delete a ride or your account, the entry disappears from live operation immediately, but it may sit in one of those copies for up to two more weeks. A copy is only ever restored in an emergency, and such an emergency does not deliberately bring deleted data back.

Your rights

You have the right to access the data held about you (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to receive your data in a portable format (Art. 20) and to object to processing based on a legitimate interest (Art. 21).

You can delete your account yourself, in the settings. Your password is asked for again as confirmation, because the step cannot be undone: the account, all rides, the ground derived from them and your settings all go. Ground you had taken from other people falls back to whoever rode there before you. Individual rides you can remove one at a time regardless. For the backups, the period from the section above applies.

If one of the other rights gets you nowhere, or you would like to see what is held about you, write to the address above.

You may also lodge a complaint with a supervisory authority. The competent one is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

Changes

When something changes in the application that is described here, this text changes with it. The date of the current version is at the top, under the heading.