Privacy Policy | CoffeePeaks

Last updated: 29/02/2026

1. WHO WE ARE

Coffee Peaks Cycling SAS ("Coffee Peaks", "we", "us") is a Colombian company, responsible for the processing of personal data collected through:

• The mobile app Cycling Conquest (iOS and Android).
• The website https://coffeepeakscycling.com

Data controller contact: privacy@coffeepeakscycling.com

2. WHAT DATA WE COLLECT

2.1 Account data
• Email address
• Username
• Password (stored encrypted using bcrypt hashing; we never have access to your plain-text password)
• Avatar / profile picture (optional)

2.2 Sports activity data
When you voluntarily upload a GPX file, or when you authorize synchronization with third-party services (Garmin Connect, Strava, Wahoo, etc., if applicable), we process:
• GPS coordinates (latitude, longitude)
• Distance, elevation, duration of the activity
• Date and time of the activity
• Heart rate, power and other metrics if present in the file

2.3 Technical data
• IP address
• Device type and operating system
• App version
• Error and performance logs (no personally identifiable content)

3. HOW WE USE THE DATA

• To compute your "conquered territory" geographic area from your routes.
• To display your progress, levels, badges and rankings within the app.
• To allow you to participate in private clubs and challenges with other users.
• To improve the stability and performance of the app.
• To notify you of important service changes.

We do NOT use your personal data to:
• Train artificial intelligence models.
• Sell information to third parties for advertising.
• Generate training plans or personalized coaching recommendations.

4. LEGAL BASIS FOR PROCESSING

We process your personal data on the following legal bases:
• Your explicit consent when registering and when connecting external services (Art. 9 GDPR / Art. 9 Law 1581 of 2012).
• The performance of the contract formed when using Cycling Conquest (Art. 6.1.b GDPR).
• Our legitimate interest in maintaining the security, stability and improvement of the service (Art. 6.1.f GDPR).

5. WHO WE SHARE DATA WITH

We work with service providers acting as data processors:
• Supabase (database and authentication) — data stored on servers in the United States, subject to GDPR-equivalent standards via standard contractual clauses.
• MapLibre / OpenFreeMap (map tiles) — receives only the coordinates needed to render the map, without identity association.
• Expo / Google Play / Apple App Store — for app distribution.
• Sports services you explicitly authorize (Garmin, Strava, Wahoo, etc.) — only to import your own activities, under OAuth with your consent.

We do not share your personal data with third parties for commercial or advertising purposes.

We do not display activities synchronized from Strava or any other service whose terms forbid it to other users; only you can see them.

6. WHERE AND HOW LONG DATA IS STORED

• Main database: Supabase, us-east-2 region (United States).
• Territory geometries are computed and stored within the same database, encrypted at rest.
• We retain your data while your account is active. If you request deletion, we remove your personal data within a maximum of 30 days, subject to legal retention obligations.

7. YOUR RIGHTS

7.1 Under the General Data Protection Regulation (GDPR — Regulation EU 2016/679):
• Access to your personal data.
• Rectification of inaccurate data.
• Erasure ("right to be forgotten").
• Restriction of processing.
• Data portability.
• Objection to processing.
• Not to be subject to automated decisions with legal effects.
• Withdrawal of consent at any time.
• To lodge a complaint with the competent supervisory authority.

7.2 Under Law 1581 of 2012 (Colombia) and Decree 1377 of 2013:
• To know, update and rectify your personal data.
• To request proof of the authorization granted.
• To be informed about the use of your data.
• To file complaints before the Superintendence of Industry and Commerce (SIC).
• To revoke authorization and request deletion of your data.
• To access your personal data free of charge.

To exercise any of these rights, write to us at privacy@coffeepeakscycling.com indicating which right you wish to exercise. We will respond within a maximum of 15 business days.

8. COOKIES AND SIMILAR TECHNOLOGIES

The website uses cookies strictly necessary for site functionality, and analytics cookies to understand how the page is used. The mobile app does not use cookies; it uses secure local storage from the operating system only to maintain your session.

You can disable cookies from your browser settings.

9. SECURITY

We apply technical and organizational measures to protect your personal data:
• Encrypted connections (TLS 1.2+) for all communications.
• Database encryption at rest.
• Row-Level Security: each user can only read and modify their own data.
• Authentication via JWT and short-lived tokens.
• Periodic security audits.

No system is 100% secure. In the event of a security breach affecting your personal data, we will notify you within 72 hours and report the incident to the competent authorities as appropriate.

10. MINORS

Cycling Conquest is not directed to children under 14. We do not knowingly collect data from minors. If you discover that your child under 14 has created an account, write to us at privacy@coffeepeakscycling.com and we will delete the information immediately.

11. INTERNATIONAL DATA TRANSFERS

Since our servers are located in the United States, by using Cycling Conquest you accept the international transfer of your personal data. These transfers are made under:
• Standard Contractual Clauses approved by the European Commission (GDPR).
• Countries declared by the Colombian Superintendence of Industry and Commerce as having an adequate level of protection (Law 1581).

12. CHANGES TO THIS POLICY

We may update this Policy periodically. Any material change will be notified within the app or by email, at least 15 days in advance. The last-updated date appears at the top of this document.

13. CONTACT

For any inquiry related to this Privacy Policy or the processing of your personal data:

Coffee Peaks Cycling SAS
Email: guillermo.roldan@coffeepeakscycling.com
Website: https://coffeepeakscycling.com

Data protection officer: Guillermo Roldán