DRAFT

Privacy

Your rides are yours.

Last updated July 23, 2026

DRAFT lets a supporter follow a rider live at a cycling event, and gives every rider a private history of their own rides. Here is exactly what the app collects, where it goes, how long we keep it, and how to delete all of it — in plain language, no fine print.

• We only collect what a ride needs — your location while you're recording, your elevation, and (if you turn them on) your pedal cadence and your heart rate from an Apple Watch.
• You're private by default. At an event, no one can watch you unless you choose to be public, join a team, or send someone your personal link.
• Nothing is sold or advertised against. Your ride data is used to show you your rides.
• You can delete everything from inside the app, in one tap — and it's really gone.

What DRAFT collects

To record and map a ride, the app reads a few sensors on your phone:

• Location (GPS). While you are recording a ride, DRAFT reads your position so it can draw your route and, at an event, show your supporters where you are. This includes background location — the ride keeps recording when your screen is off or you switch apps, because your phone is in your jersey pocket. Location is only read while a ride is active; it stops when you finish.
• Elevation. The phone's barometric altimeter, so your climbs and grade are accurate.
• Cadence (optional). If you turn on cadence, the app uses the phone's motion sensor (accelerometer) to estimate your pedal rate. This is off unless you enable it.
• Heart rate (optional, Apple Watch). If you install DRAFT on your Apple Watch and allow it, the Watch reads your heart rate during a ride (through a workout session) and sends it to the phone, where it is stored with that ride. Your heart rate is shown only to you — it never appears on a shared ride link, to event supporters, or on any live map. If you don't wear a watch, nothing heart-related is collected.
• Apple Health (optional, off by default). If you turn on "Save rides to Apple Health", finished rides are written to Health on your phone as cycling workouts with their route. DRAFT never reads anything back from Health.
• Email (optional). Only if you choose to sign in with Apple or Google, so your training history can follow you to a new phone. You can use DRAFT without signing in at all — your rides then live only on your device and our backend, tied to a random ID, not your name.

DRAFT does not collect your contacts, photos, microphone, browsing history, or advertising identifiers, and it does not track you across other apps or websites.

Where your data goes, and who can see it

Rides are stored on DRAFT's backend (hosted on Supabase) so they can be mapped and saved for you. We don't sell your data or share it with advertisers.

Sharing anything is always your choice, and works through a private link — whoever you send the link to can see that ride or your live position, and no one else. There is no public directory of riders.

At an event, you choose who can watch you live

• Private (the default) — no one can find or follow you. You can still share your own personal link with family.
• Team — teammates who have your team's link can see you on the team page.
• Public — supporters can find you by name or bib number for that event.

You can tighten your visibility at any time, and your live-tracking link can be regenerated, which instantly cuts off anyone who had the old one.

How long we keep it

Your ride history is kept so you can look back and see whether you're getting faster over a season — that's the point of the app. Very long rides are stored at a sensible resolution (we thin the raw GPS points on big rides), and old raw sensor data is pruned automatically on a schedule. Your ride summaries — distance, time, climb, speed — stay so your history stays intact.

Deleting your data

You are always in control:

• Delete one ride — swipe it away in your training library. (It's recoverable for a while, then removed.)
• Delete your whole account — Settings › Account › Delete. This permanently erases all of your training rides and, if you signed in, your linked sign-in identity. There is no recovery — it is a real deletion, not a hide.

Event bib records (that you took part in an event) are kept as part of that event's record, separately from your training account.

Website analytics

The DRAFT website uses Cloudflare's privacy-friendly Web Analytics to count page visits. It is cookieless — it does not use cookies, does not identify you, and does not track you across other sites.

Riders under 18

Younger riders take part in events like Pelotonia too. If you are setting DRAFT up for a minor, a parent or guardian should configure it and hold the account. The same protections apply — private by default, and one-tap deletion of everything.

Changes to this policy

If we change what we collect or how we use it, we'll update this page and the "last updated" date above. Meaningful changes will be called out in the app.

Contact

Questions about your privacy, or want your data removed and don't have the app handy? Email lukepenca@gmail.com.