This Privacy Policy explains how RideAheadWeather handles information when you use our free cycling weather forecast service. RideAheadWeather is built to be lightweight and privacy-respecting: we do not require an account, and we do not collect or store any information that identifies you personally, such as your name, email address, or account credentials. We do make limited, transient use of your IP address to keep the service reliable, to understand aggregate traffic, and to power an optional feature — described in Sections 3 and 7 below.
RideAheadWeather does not ask for your name, email address, or account credentials to use the service, and we do not build user profiles. GPX route files you upload, and the forecasts generated from them, are not kept on our servers beyond a temporary cache of about two hours (see Section 4), unless you choose to create a shared link (see Section 5).
Your IP address is used in one limited, transient way in the app itself: we use it to apply a per-IP rate limit that keeps the service available and prevents abuse of our forecast requests — this creates a short-lived counter, associated with your IP address, that is automatically deleted after 24 hours. We rely on legitimate interest (GDPR Article 6(1)(f)) as the legal basis for this: keeping the service available and preventing abuse of our forecast requests is a real interest of ours, and the counter is limited to what that purpose requires and nothing more. Your IP address is not linked to your GPX routes or forecast history, since no IP address is stored with either the temporary forecast cache or a shared link (see Sections 4 and 5).
When you upload a GPX file, your route is processed in real time to calculate ride timing and generate weather forecasts along the route. After the forecast is generated, a temporary copy is cached on our servers for about two hours so that you can create a shared link from it afterwards (see Section 5). The cached copy contains your full route (including the start and end, which are only trimmed when a link is actually shared), the forecast, the speed and start time you chose, and how the route was provided; it contains no IP address, account, or other information identifying you, and it is only reachable through a random identifier. It is deleted automatically after about two hours, and may be removed earlier if our cache runs low on memory. If you paste a Komoot link instead of uploading a file, our server fetches the public route from Komoot on your behalf. Your browser does not contact Komoot, so Komoot does not see your IP address. The imported route (its name and points) is cached on our servers for about 6 hours so repeat imports are fast; this cache holds no IP address or other information identifying you. If the link is a private one with a share token, the token is used only to fetch the route and is never stored. The number of imports per IP address is counted briefly for rate limiting (see Section 3). Apart from these temporary copies and shared links, your route and forecast are not stored, logged, or shared. Separately, weather data for points along routes is cached to reduce calls to the weather provider; this cache holds only weather at coordinates and times, without any link to you.
If you choose to create a shared link for a ride, we store that ride on our servers so the link keeps working. This is the only case in which route data is kept beyond the temporary cache described in Section 4, and it happens only when you choose Share route and confirm with Create link. Nothing is stored before that. What is stored: the route with up to 500 m removed at each end, less on short routes; routes under 1 km can't be shared (so your start and end points, which are often your home, are not kept), a snapshot of the forecast for that route (the weather at each point along it), the average speed and start time you chose, and your browser's time zone. What is not stored: no account, name, email address, or IP address is linked to a shared link. We count how many times a link is viewed (link previews from apps and search engines aren't counted) and when it was last viewed, and nothing else about the viewer. Shared links are unlisted: they use a random 10-character identifier, are marked so search engines do not index them, and are not listed in our sitemap. However, anyone who has the link can view the shared ride, so only send it to people you want to see it. Shared links are kept indefinitely. If a route was imported from Komoot, the original Komoot link is also recorded for attribution. To have a shared link deleted, use the Feedback link in the top bar (see Section 12) and include the shared link or its id (the last part of the link); we will delete it on request.
Weather forecasts shown in RideAheadWeather are sourced from a third-party weather data provider, the Google Weather API. Requests to this provider include only the location and time information needed to produce a forecast (e.g. coordinates along your route) — not any personal information about you. Please refer to Google's own privacy documentation for details on how they handle data sent to their APIs.
RideAheadWeather does not use cookies, local storage, or any client-side script to measure traffic. Instead, we run a cookieless visitor counter entirely on our server. When you load a page, we momentarily combine your IP address and browser User-Agent string with a secret value that changes every day, then run the result through a one-way cryptographic hash. Only that hash is recorded — never your IP address or User-Agent themselves — and because the secret rotates daily, the same visitor produces a different, unrelated hash each day; the same person can never be linked across days, and the hash cannot be reversed back into an IP address. For an approximate region (country-level only), we read the CF-IPCountry header that our content delivery network (Cloudflare) already attaches to your request at the network edge — this is a header on the request we already receive, not a separate lookup or a third-party geolocation query. We rely on legitimate interest (GDPR Article 6(1)(f)) as the legal basis for this: understanding aggregate traffic and regional usage helps us keep the service running and understand how it's used, and the processing is designed to have minimal privacy impact, since nothing is read from or written to your device and the result cannot identify you.
Two uses described above — the per-IP rate limit in Section 3 and the visitor & region counter in Section 7 — are based on our legitimate interest, not on your consent. Under GDPR Article 21, you have the right to object, at any time, to processing based on legitimate interest. If you object, we will stop that specific processing for your traffic unless we have compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise, or defend a legal claim. To exercise this right, use the Feedback link in the app's top bar — the same contact channel described in Section 12 — to let us know.
We do not keep personal information. The temporary forecast cache described in Section 4, which holds your full route and forecast, is deleted automatically after about two hours (or earlier if our cache runs low on memory). A route imported from a Komoot link (name and points) is cached for about 6 hours, and the short-lived count of imports per IP address used for rate limiting expires within minutes; a Komoot share token is never stored. The only route data kept longer is shared ride links, which are kept indefinitely until you ask us to delete them (see Section 5). The per-IP rate-limit counter described in Section 3 is automatically deleted after 24 hours. The hashed visitor and region data described in Section 7 is retained, in aggregate form, by New Relic, our infrastructure-monitoring provider, according to their own data retention practices; because the underlying hash rotates daily and cannot be reversed, it cannot be used to reconstruct your identity or your activity.
RideAheadWeather is not directed at children and we do not knowingly collect information from children. Since the service does not collect personal information from any user, no age-specific data collection takes place.
We may update this Privacy Policy from time to time as the service evolves. Changes will be reflected on this page along with an updated "Last updated" date below. Continued use of RideAheadWeather after changes are posted constitutes acceptance of the revised policy.
If you have questions, concerns, or requests regarding this Privacy Policy or how your information is handled, please use the Feedback link in the app's top bar to get in touch with us.
This is a generic Privacy Policy template drafted to describe RideAheadWeather's current, minimal data practices in plain language. It is provided as a starting point and is pending review by qualified legal counsel — it is not final legal copy and should not be relied upon as a substitute for professional legal advice.
Last updated: October 22, 2026