Privacy Policy | 2 Wheels in Common

This page covers data practices specific to the 2 Wheels in Common app and website ("2WIC," "the Service"). It supplements the Privacy Policy of Spirit Lake Technology Group LLC, which covers our company-wide practices, your rights, security and general principles that apply here too. Where something below is specific to 2WIC, it controls for 2WIC.

1. Who We Are

2 Wheels in Common is a platform for motorcycle riders who want to meet up, operated from Washington State, United States, by Spirit Lake Technology Group LLC. This page explains how we collect, use and protect information from users in the countries where the Service is offered (at launch, the United States, Canada, the United Kingdom, Ireland, and Australia) in connection with the Service specifically.

2. Information We Collect

We collect only what we need to operate the Service:

Email address: collected when you join the waitlist or create an account
Profile information: your name, region, bike details and riding preferences you choose to provide. Region (your city and country, or state for US users) is required to use the app and is self-selected from a place picker
Photos: if you upload a profile photo or a route cover image, we store that image. If you manage a Claimed Business listing, photos you upload for that listing are stored the same way and go through an admin review before they're shown publicly
Route and ride data: if you record or upload a route, we collect the precise GPS coordinates of that route. We only collect precise GPS location during an active, rider-started recording session. If you background the app mid-recording, collection may briefly continue so your route isn't cut off; a persistent notification ("Recording ride — Your route is being tracked") stays visible the entire time. We do not track your location passively or outside of an active recording session
Nearby search location: some screens let you tap "Use my current location" to search near where you are, for example to pick your Region, find groups, plan a route or choose a meet point. Each tap reads your location once, in the foreground, to run that search. The coordinates are sent to Mapbox to perform the search and are not stored by us. We never read your location in the background except during an active recording or in-app navigation session, as described above
In-app navigation location: Pro subscribers, and riders who have RSVPed to a group ride that is underway, can use in-app, voice-guided turn-by-turn navigation. While an in-app navigation session is active, we collect real-time GPS location in the foreground and, briefly, in the background if you switch apps mid-session, so guidance can continue. This location data is passed directly to the Mapbox Navigation SDK, which generates the turn-by-turn guidance entirely on your device,it is not sent to our backend and we do not store or retain it; Mapbox receives session usage events, not the trace, as described under Sub-Processors below. Background location access stops as soon as the navigation session ends. This is separate from route recording, above, and from the optional ride-status broadcast, below
Ride status: if you use the optional ride-status feature during a group ride, we collect the status you choose to broadcast (for example "fell behind"). Status on its own does not include GPS coordinates and is visible only to other riders on the same ride
Live position during a ride: if you turn on live sharing for a ride, we collect your GPS position about every 30 seconds while sharing is on and show it to the other riders on that ride only. You can turn sharing off at any time. Positions are kept for 7 days after the last update and then deleted
Destination Ride-In interest: if you tap "I'm in" on a Destination Ride-In, we record your interest. If that Ride-In is hosted by a business and you separately choose to share your contact info using the opt-in toggle, we share your name and email with that business so they can follow up with you about it. This only happens for Ride-Ins hosted by a business. Tapping "I'm in" to express interest never shares your contact info on its own; sharing only happens if you also turn on the separate toggle for it. On this website, a business's page may also list its upcoming Destination Ride-Ins. If you fill in the "I'm in" form there, you don't need an account: we collect only the email address you type, and only after you tick the box agreeing to share it, and we pass it to that one business so they can follow up about that one Ride-In. We record which surface the request came from (the app or this website) so the business can tell them apart. The website form is protected by Cloudflare Turnstile, which checks that you are not an automated script; it does not identify you to us. Interest counts shown on this website come only from riders using the app; nothing you submit on the website is displayed publicly
Payment information: if you subscribe to a paid tier, payment is processed by Apple, Google Play or Stripe depending on how you subscribe. We do not receive or store your full payment card details, only limited billing status (e.g. subscription tier and renewal date) needed to manage your access
Invitations you send: if you invite someone to a Group, or a business adds a team member, by typing their email address, we collect that address to send the invitation and to show you whether it was accepted. We use it for nothing else and delete it once the invitation is used or cancelled. Please only invite people who would expect to hear from you
Push notification token: a device-specific identifier used to deliver notifications (e.g. when a ride you're attending changes), if you enable notifications
Usage data: basic logs of how you interact with the Service (pages visited, features used) to help us improve it
Device information: device type, operating system and browser for compatibility purposes

3. How We Use Your Information

To operate and improve the Service
To notify you when the app launches (waitlist only)
To connect you with other riders in your area
To deliver notifications about rides and routes you're following
To process subscription payments and manage access to paid features
To review reports filed about routes or other users
To send product update emails, which are optional: every one has a one-click unsubscribe link, and you can also turn them off in Profile settings
To send the emails your account needs while it exists: sign-in and password emails, notices of changes to the Terms or this policy, and purchase or billing confirmations. Receipts for purchases come from Apple, Google Play or Stripe, whichever processed the payment, not from us
To comply with legal obligations
To let a business follow up with you about a Destination Ride-In, if you opted in to share your contact info for it, whether from the app or from that business's page on this website

This is consistent with the general-use principles in our company Privacy Policy: we do not sell, rent or share this information with advertisers or data brokers. The one exception is the opt-in contact sharing described above under "Destination Ride-In interest," which only happens when you choose it and only with the business hosting that specific Ride-In.

Legal bases (EEA/UK visitors). 2 Wheels in Common is offered in several countries - at launch, the United States, Canada, the United Kingdom, Ireland, and Australia - and our website is reachable more broadly, so data-protection laws beyond the United States apply to us. Where the EU or UK GDPR applies, we rely on: your consent for optional sharing (for example, submitting a Destination Ride-In interest form or choosing to share your contact info with a business) and for marketing; performance of our contract with you to operate your account and the features you request; our legitimate interests in securing and improving the Service; and compliance with legal obligations. You can withdraw consent at any time, and you can exercise the rights described in Section 7 and in our company Privacy Policy. Transfers of your information outside your country, and the safeguards we rely on for them, are described in our company Privacy Policy.

4. Sub-Processors Specific to 2WIC

In addition to the infrastructure described in our company Privacy Policy, 2WIC uses:

Cloudflare: hosts and delivers the Service and may process request metadata (such as IP addresses). Cloudflare Turnstile also screens the forms on this website (business claims, Destination Ride-In "I'm in") for automated abuse. See Cloudflare's Privacy Policy
Supabase: provides authentication, database storage and real-time features (such as ride status updates) for the app
Expo: delivers push notifications to your device (Expo receives your device's push token and the content of each notification) and serves app updates (Expo receives your app version and platform when the app checks for one). See Expo's Privacy Policy
Mapbox: powers location and route search when you search for a place, stop or meet point. Mapbox also provides the Mapbox Navigation SDK used for in-app, voice-guided turn-by-turn navigation, available to Pro subscribers and to riders on a group ride they have RSVPed to. During an active in-app navigation session, your real-time location is sent to the Mapbox Navigation SDK on your device to generate guidance; see "In-app navigation location," above, for what's collected and how long it's kept. Mapbox also receives session usage events for the navigation feature (when guidance starts and ends, reroutes, and feedback you submit) for its own service billing; it does not receive your route trace. The map itself sends no usage telemetry to Mapbox; we turned that off in the app
Anthropic: generates AI-assisted route suggestions for newly-launched regions and, for Pro subscribers, in response to a rider's own route request. Anthropic receives the region or request details needed to generate a route; it does not receive your account, profile or ride history
OpenWeatherMap: provides the weather forecast shown on a ride's detail page. We send only the ride's meeting-point coordinates and start time, never your identity or account details
RevenueCat: manages subscriptions you buy in the app through Apple or Google Play. RevenueCat receives your app account identifier and your purchase and subscription status from the store; it does not receive your payment card details
Apple, Google Play and Stripe: process subscription payments, depending on how you subscribe

We do not use third-party advertising or analytics platforms that track you across other websites.

5. Data Retention (2WIC-Specific)

Waitlist email addresses are retained until you request removal or the app launches and you either create an account or ask to be removed. Account data is retained for as long as your account is active. You can delete your account from inside the app at any time, or ask us to. Deletion removes your profile details, photos (except photos attached to routes and rides, which stay shared), push tokens, ride status and live positions, and any contact details you shared with a business, which also stop being visible in that business's dashboard. Routes and rides you shared with the community stay available with your name removed, as described in the Terms of Service. Reports you filed are kept for moderation, attached to a record that no longer identifies you. Deletion completes within 30 days and in practice at once, consistent with the response commitment in our company Privacy Policy. In-app navigation location data is scoped to the navigation session only: we don't persist it, and Mapbox processes it on-device to generate guidance rather than storing it on our behalf.

Contact details you chose to share with a business for a Destination Ride-In are kept by us, and stay visible to that business, until the earliest of: you delete your account, you ask us to remove them, or 90 days after the date of that Ride-In. If you submitted the form on this website without an account, email us at support@2wheelsincommon.com and we will remove them. When details are removed for any of these reasons, we tell the business that received them to delete its own copy; anything that business has already done with them is governed by that business's own privacy policy, not this one. We never pass them to any other business. A business losing, downgrading or changing its subscription does not by itself delete details already shared with it, and never prevents you from having them removed.

Where a specific feature collects data with its own retention window (for example, live position shared during a ride, which is kept for 7 days after the last update), that window is described where the feature is disclosed. Where no specific window is stated, we keep the data no longer than reasonably necessary for the purpose it was collected.

6. Children's Privacy (2WIC-Specific)

The Service is not directed at anyone under 18, which is a higher age minimum than the general 13+ baseline in our company Privacy Policy, and it controls for 2WIC. We do not knowingly collect information from anyone under 18. If we learn that we have collected information from a minor, we will delete it promptly.

7. Your Rights

Your rights to access, correct or delete your information, and how to exercise them, are described in our company Privacy Policy, including specific provisions for California (CCPA), the EEA/UK (GDPR) and Canada (PIPEDA) residents. To exercise these rights for 2WIC specifically, reach us through the waitlist contact on the homepage.

You can also make a request by emailing support@2wheelsincommon.com. We take reasonable steps to verify your identity before acting on a request, may decline a request we cannot reasonably verify, and will not discriminate against you for exercising your rights. Where the law allows, you may use an authorized agent to submit a request on your behalf.

8. Security

We use the security measures described in our company Privacy Policy, including encrypted connections (HTTPS) and access controls.

If a breach affects your personal data, we will notify you and any applicable regulator as required by applicable law.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version with an updated date. Significant changes will be communicated to users via email where possible.

10. Contact

To exercise your privacy rights or ask questions about this policy, email us at support@2wheelsincommon.com, or see our company Privacy Policy for our general contact address. We will respond within 30 days.