Moofment Privacy Policy.

1. Introduction

Welcome to Moofment. This Privacy Policy explains how we collect, use, share, and protect your information when you use our mobile application. We are committed to protecting your privacy while providing you with cycling community features.

Key Principles:

• We collect only information necessary to provide our services
• We never sell your personal data to third parties
• You have control over your information and privacy settings
• We prioritize security and data protection

2. Data Controller

Data Controller: Moofment (operated by the individual developer listed in the App Store)

Contact: [email protected]

If you are located in the European Union, Moofment acts as the "data controller" responsible for your personal data under the EU General Data Protection Regulation (GDPR).

3. Information We Collect

3.1 User Identification

• User ID: SHA256 cryptographic hash of your VanMoof account email address
• Country Code: Your country based on device location (e.g., "US", "DE", "NL")
• Rider Type: VanMoof or Cowboy designation

3.2 Location Information

• Country Code: Automatically detected from device location to group you regionally
• Event Coordinates: Exact GPS coordinates (latitude/longitude) for events you create or attend
• MoofMatch Coordinates: Exact GPS coordinates (latitude/longitude) when you enable MoofMatch rider matching
• Marketplace Coordinates: Exact GPS coordinates (latitude/longitude) for bike listings you create

Important: We store exact GPS coordinates for events, MoofMatch, and marketplace listings. Location is only collected when you use these features, not continuously.

On-Device Location Features

The following features use location data that stays entirely on your device:

• CityGuard: Geofence-based speed zones you create. Zone coordinates and boundaries are stored locally on your device only.
• Live Ride Tracking: GPS routes recorded during rides. Route data is stored on your device and never transmitted to our servers.

Important: These features do not send your location to Moofment. Data remains on your device unless you choose to sync via iCloud.

3.3 Delivery Tracking Information

When you use delivery tracking features:

• Order details: Campaign slug, order number, order date, estimated delivery date
• Bike information: Bike model associated with your order
• Delivery status: Current status (pending, delivered, delayed, problem, cancelled)
• Timeline data: Creation timestamps, last checked dates, next check dates

Storage: Delivery tracking data may be anonymized for community analytics. Personal identifiers are removed from delivery analytics.

Retention: Active tracking records are retained while your order is pending. Delivered items are kept for 30 days after delivery, cancelled items are removed from active tracking immediately.

3.4 Marketplace Listings Information

When you create marketplace listings:

Personal Contact Information

• Contact method: Your preferred communication channel

Location Data

• Location string: City/region description
• Region identifier: Country/area code

Privacy Note: Location coordinates are used to display listings on a map. We use city-level precision to protect your privacy.

Listing Details

• Bike information: Frame number, model, series, year, firmware version
• Condition data: Battery condition, accident history, service history, warranty status
• Accessories: Included items and extras
• Pricing: Sale price and currency
• Description: Free-text description of item

Analytics and Moderation

• Report counts: User-flagged content tracking
• Favorites: Stored locally on your device

3.5 Information from Third-Party Services

VanMoof Integration

When you connect your VanMoof account:

• Bike information: Bike models, names, and identifiers associated with your account
• Account linking data: Information necessary to verify and maintain the connection
• Basic usage data: Information needed for bike control and management features
• Authentication credentials: Username/password or tokens (stored locally on device)
• Bike control data: Commands sent to bikes (lock/unlock, lights, etc.)

Note: We only access VanMoof data that you explicitly authorize and that's necessary for app functionality. VanMoof integration requires direct API access to VanMoof servers.

Strava Integration

When you connect your Strava account (for Cowboy bike verification):

• OAuth access token: Temporary authentication token
• Athlete data: Strava username and basic profile information
• Activity data: Ride activities to verify Cowboy bike ownership
• Verification results: Boolean flag indicating successful verification

Purpose Limitation: Strava integration is used exclusively for Cowboy bike ownership verification. We do not access ride statistics, performance data, or social features beyond what's necessary for verification.

Third-Party Privacy: Strava's Privacy Policy governs data processing on their platform. You can revoke Strava access through your Strava account settings.

Cross-Border Transfer: Strava is a US-based service. Connecting your Strava account involves international data transfer subject to Strava's data protection measures.

Apple Services

• CloudKit data: For secure data synchronization across your devices
• iOS integration: For location services, notifications, and system-level features
• App Store data: Installation and update information (handled by Apple)
• WeatherKit: Your approximate location is sent to Apple's weather service to display current conditions. See Apple's privacy policy for details.
• HealthKit: With your permission, we write cycling workouts to Apple Health. We do not read health data beyond checking for duplicate workouts. HealthKit data is never transmitted to Moofment servers.

3.6 MoofMatch-Specific Information

When you use MoofMatch:

• Bike name and bike ID
• City-level location for matching
• Match category (ride, social, networking, etc.)
• Match results and meeting locations
• Matching preferences: Preferred riding times and duration settings
• Safety data: Meeting locations and timing for safety purposes

See our separate MoofMatch Privacy Policy for detailed information about this feature.

3.7 User Scoring and Gamification

Activity tracking for scoring system:

• Point accumulation: Total score, tier level, weekly/monthly scores
• Streak tracking: Consecutive activity days
• Achievement data: Unlocked achievement IDs and associated points
• Activity counters: Events created/attended, MoofMatch successes, marketplace listings, feedback submissions
• Rate limiting data: Timestamps to enforce daily/weekly limits (e.g., max 3 MoofMatch enables per week for points)
• Last activity timestamp: For streak calculation and activity monitoring

Data Usage: Scoring data is used for gamification features, leaderboards, and to encourage community engagement. All leaderboard data is anonymized (no personal identifiers).

3.8 CloudKit Data

• All data synchronized across your devices
• Stored in Apple's secure cloud infrastructure

4. How We Use Your Information

• Event Management: Display events, track attendance
• MoofMatch: Connect you with nearby compatible riders based on city-level location
• Marketplace: Enable peer-to-peer bike and parts sales
• Delivery Tracking: Monitor order status and provide delivery updates
• Bike Integration: Connect to VanMoof bikes for control features
• Ride Tracking: Award points for Strava activities
• Scoring System: Track your activity and tier progression
• Regional Grouping: Assign you to country buckets for relevant content
• Service Improvement: Fix bugs, improve performance
• CityGuard: Monitor your location on-device to trigger speed zone changes
• Live Ride Tracking: Record GPS routes and display ride statistics
• HealthKit: Sync completed rides as workouts to Apple Health
• Weather: Display current conditions based on your location

5. Legal Basis for Processing (GDPR)

We process your personal data under one or more of the following legal bases:

• Consent: When you voluntarily provide information (e.g., connecting accounts, sharing delivery data, enabling MoofMatch)
• Contractual necessity: To provide core app functionality (e.g., authentication, event creation, bike management)
• Legitimate interest: To maintain service security, prevent fraud, improve user experience, and develop new features
• Legal obligation: When we are required to retain or share data by applicable law or regulations

You have the right to withdraw consent at any time by discontinuing use of specific features or requesting account deletion.

6. Information Sharing

6.1 Public Information

The following is visible to other app users:

• Events you create (name, location, date, details)
• Your attendance at events (shown as user ID)
• MoofMatch profile (bike name, city-level location)
• Marketplace listings (bike details, contact method)
• Leaderboard scores (score only)

6.2 Third-Party Services

• CloudKit: All data storage and sync
• VanMoof: Hashed email for authentication, bike control commands
• Strava: Activity data for Cowboy bike verification

6.3 Legal Requirements

We may disclose information when required by law or to protect user safety, enforce terms, prevent fraud, or in business transfers.

7. Data Storage and Security

• CloudKit: Primary storage using Apple's infrastructure
• Device Storage: Authentication tokens stored in iOS Keychain
• Encryption: Data encrypted in transit and at rest
• No Proprietary Servers: We do not operate our own servers

8. Security Limitations

While we use encryption and Apple's secure infrastructure, no digital platform can guarantee absolute security. You use the App and share data at your own risk.

Data Breach Notification: If we become aware of a data breach affecting your personal information, we will notify affected users and/or relevant authorities as required by law.

9. Data Retention

9.1 Active Account Data

• Profile and account information: Retained while your account is active
• Event and community data: Retained to maintain community functionality
• Usage analytics: Typically retained for 2–3 years for service improvement
• Support communications: Retained for reasonable period to provide ongoing support
• Delivery tracking: Active orders retained until delivery + 30 days; cancelled orders removed immediately
• Marketplace listings: Active listings retained until expiration or deletion + 90 days
• User scores: Retained indefinitely while account is active

9.2 Feature-Specific Retention

Delivery Tracking

• Delivered items: 30 days after delivery confirmation
• Cancelled orders: Immediately removed from active tracking

Marketplace Listings

• Deleted listings: Delete with 90-day grace period
• Expired listings: Auto-archived after expiration date
• Reported/flagged listings: Retained for moderation review (30 days)
• Personal contact info: Removed when listing is permanently deleted

User Scoring

• Active scores: Retained indefinitely while account exists
• Upon account deletion: Anonymized and aggregated for historical statistics

9.3 Account Deletion

Contact us at [email protected] to request account deletion. Most personal data will be deleted within 30 days. Some data may be retained for legal or safety reasons (e.g. anonymized analytics).

10. Your Rights

10.1 Access and Control

• Data Requests: Contact us for a copy or deletion of your data
• Corrections: Update information through app or contact us

10.2 Privacy Controls

• Location: iOS Settings → Moofment → Location
• Notifications: iOS Settings → Moofment → Notifications
• VanMoof Connection: Disconnect in app settings
• Strava Connection: Disconnect in app settings
• Delivery Analytics: Hide/show delivery analytics card in profile settings
• HealthKit: iOS Settings → Health → Data Access → Moofment
• CityGuard: Disable in app settings (stops all zone monitoring)
• Ride Tracking: Disable in app settings

10.3 Regional Rights

GDPR (EU)

• Right to access, rectification, erasure, data portability
• Right to object and withdraw consent
• Right to lodge complaints with data protection authorities

CCPA (California)

• Right to know what information is collected
• Right to delete personal information
• We do not sell personal data

11. Children's Privacy

Age Requirement: 13+

The app is for users 13 years and older. We do not knowingly collect information from children under 13.

Additional Restrictions:

• Marketplace: Some jurisdictions may require users to be 18+ for marketplace transactions
• MoofMatch: Recommended for users 18+ due to meeting with strangers

12. International Transfers

Data stored in Apple CloudKit may be located outside your country. Apple complies with applicable data protection laws including EU-US Data Privacy Framework and Standard Contractual Clauses.

12.1 Specific International Transfers

Apple CloudKit (Primary Storage)

• Infrastructure: Apple operates data centers globally (US, EU, Asia-Pacific)
• Automatic replication: Data may be replicated across regions for redundancy
• Apple's compliance: Apple implements appropriate safeguards including Standard Contractual Clauses (SCCs)

Strava Integration (US-Based)

• Strava Inc.: Headquartered in San Francisco, California, USA
• EU-US transfers: Subject to Standard Contractual Clauses and adequacy mechanisms
• User consent: Explicit OAuth consent required before any data sharing

External APIs

• Third-party services: Weather APIs, location services (processed through Apple frameworks)

13. Business Transfers

If Moofment or its assets are acquired, merged, or sold, your information may be transferred as part of that transaction. We will notify you through the App or by email before your data becomes subject to a new privacy policy.

14. Cookies and Tracking

Moofment does not use advertising cookies or third-party tracking tools.

Apple frameworks (such as CloudKit) may automatically collect anonymous diagnostics and analytics in accordance with Apple's Privacy Policy.

15. Changes to Privacy Policy

We may update this policy at any time. Continued use of the App constitutes acceptance of any changes.

16. Contact

Moofment processes only minimal data required to operate the App, such as a hashed version of your VanMoof account email (non-reversible) and optional contact information if you choose to publish a marketplace listing.

If you have questions about your data or wish to request removal of optional information (e.g., a listing contact email), you can contact us at:

Email: [email protected]
Response Time: Usually within 7–14 days

If you are located in the European Union, you may also contact your local data protection authority regarding any privacy-related concerns.