Privacy Policy

Last updated: 7 September 2026

Dirtanian is the app for off-road sport — recording rides, entering events, following your people and seeing how you're progressing. To do that well we handle some personal information, including a few sensitive kinds like location and health data. This page explains what we collect, why, who sees it and how you stay in control. We've kept it in plain English on purpose: nothing hidden, nothing buried.

Who we are
What we collect, and why
Location, health and other sensitive data
What other riders can see
Who we share data with
Advertising
Your rights and choices
How long we keep data
Deleting your account
Children and dependents
Security and where data lives
Changes and contact

1.Who we are

In short: Dirtanian, based in Pretoria, South Africa, is the "responsible party" for your data. Email us any time at letsride@dirtanian.com.

Dirtanian is operated by DIRTANIAN (registration number 2026/755674/07), a company registered in South Africa ("we", "us"). We run the Dirtanian app, the website and the developer API. We are the responsible party under South Africa's Protection of Personal Information Act (POPIA) and, where it applies, the controller under the EU and UK General Data Protection Regulation (GDPR).

Our Information Officer, Tiaan de Bruin, can be reached at letsride@dirtanian.com, on +27 61 503 6596, or at 141 Lynnwood Road, The Willows, Pretoria, Gauteng 0081, South Africa.

2.What we collect, and why

In short: We collect what the features need — your account, your profile, your rides, your entries and purchases — and we use it to run Dirtanian for you. Most of it is optional and you decide what to add.

What	Why we use it
Account — name, surname, email, phone, password (handled by Firebase Authentication), or Google / Apple sign-in.	To create and secure your account, sign you in and reach you about your entries and account.
Profile — photo, about, date of birth, gender, weight (all optional), address, race number, club, interests, your bikes and vehicles, licences.	To show your profile, place you in the right class and age group, and complete event entries and payouts.
Medical information and emergency contacts (optional).	Only for the SOS feature and to help organisers and medics look after you at an event. See section 3.
Dependents — details of under-18 riders you manage as their guardian.	So you can enter and manage them for events. See section 10.
Rides and location — precise GPS while you record, including in the background; live tracking you choose to share.	To record your activity, calculate distance, speed, segments, KOMs and rankings, and show your live position to the audience you pick. See section 3.
Nearby riders — Bluetooth proximity and NFC tags.	To let you "bump" and connect with a rider next to you. Used only while you use the feature.
Health and fitness data from Apple Health or Health Connect, with your permission.	To show your own stats alongside your rides. See section 3.
Contacts — your contacts’ email addresses, only when you tap "Find contacts on Dirtanian". Phone numbers are read on your device only and are never sent to us.	Your contacts’ email addresses are sent to our server and compared once against Dirtanian accounts, so we can show you which of your contacts are already riding and let you invite the rest. They are used for that comparison only — we do not store your contact list or those addresses, and we never message your contacts. Phone numbers stay on your phone; we use them there purely to show which contacts you can invite.
Camera, photos and microphone.	For your profile picture, posts, and event photos — only when you choose to add them.
Your content — posts, comments, chat messages, polls, reviews.	To show them to the riders you share them with and keep the community healthy.
Purchases and payment metadata — event entries, venue bookings, club memberships, event photos, advert credits.	To fulfil what you bought, issue receipts and refunds, and keep our books. Card details go straight to Peach Payments and never touch our servers. The Shop is sold and shipped via Shopify.
Organiser and photographer payout details — ID number and bank account.	To verify you and pay you out. Stored server-side only and never shown in the app to anyone else.
Device, diagnostics and usage — push tokens, crash reports (Firebase Crashlytics), analytics (Firebase Analytics).	To send you notifications you've asked for, fix crashes and understand which features help riders most.

Under POPIA and GDPR our legal bases are: performing our contract with you (running the app you signed up for), your consent (location, health, contacts, camera, marketing), our legitimate interest in keeping Dirtanian safe and working, and our legal duties (tax and accounting records).

3.Location, health and other sensitive data

In short: Location runs only while you record or share live. Health data is yours alone — never sold, never used for ads, never handed to third parties. You can switch either off at any time.

Location

When you start recording a ride, Dirtanian uses your precise location, including while the app is in the background or your screen is off, so your whole track is captured. Recording stops when you stop it. Live tracking during an event or outride shows your position only to the audience you select, and only while you keep it on. Ride tracks are stored losslessly so results and segments are fair.

Health and fitness data

With your explicit permission we read the categories you grant from Apple Health or Health Connect — such as heart rate, workouts, steps, calories, distance, weight, height and sleep — and the Apple Watch companion may write a workout back. We use this data for one thing: showing your own stats to you. We never sell it, never use it for advertising or marketing, never share it with third parties except the cloud provider that stores it for you, and never use it to make decisions about you. You can revoke access in your phone's health settings at any time.

Medical information

Medical notes and emergency contacts are optional. They are shared only with your emergency contact when you trigger SOS, and with the organiser and medical team of an event you enter, so they can look after you.

4.What other riders can see

In short: Dirtanian is a community, so your name, photo, posted rides and results are visible to other signed-in riders. You control your ride visibility and live-tracking audience.

Your profile name and photo, the rides you post, event results, leaderboards, segment times, badges and your comments are visible to other signed-in Dirtanian riders. Your email, phone number, address, date of birth, medical details and payout details are never shown to other riders. Each ride has a visibility setting, and live tracking is off unless you turn it on. Our public developer API exposes only the same public profile projection — never email, phone or address.

5.Who we share data with

In short: Only the providers we need to run the app, plus the organisers of events you enter. We never sell your personal information.

Google Firebase and Google Cloud — hosting, database, storage, sign-in, analytics, crash reporting and BigQuery reporting.
Peach Payments — card payments and payouts. Shopify — the Shop checkout, shipping and returns.
SendGrid — transactional emails. Cloudflare R2 — photo storage and delivery.
Mapbox and Protomaps — the maps you see.
Apple and Google — sign-in, push notifications, HealthKit / Health Connect and the app stores.
Event organisers, venues and clubs — the details needed for your entry, booking or membership, including emergency and medical information you've provided.
Anthropic and Google Vertex AI — used only for our internal back-office tooling (for example, designing badges). Riders' personal data is not sent to these services for training.

We may also share information when the law requires it, to protect riders' safety, or as part of a business transfer — and we'll tell you if that ever happens.

6.Advertising

In short: Some feed posts are sponsored by organisers and partners, always labelled "Sponsored". No ad networks, no cross-app tracking, and you can hide ads.

Sponsored posts are targeted by interest and region using your profile settings — never by your private data, health data or contacts. We don't use third-party advertising networks, don't track you across other apps or websites, and never sell your information to advertisers. Every sponsored post carries a "Sponsored" label and a hide option.

7.Your rights and choices

In short: You can see, fix, export, restrict or delete your data, and say no to marketing — whenever you like.

Under POPIA, and GDPR if you're in the EU or UK, you can ask us to access, correct, export or delete your personal information; object to or restrict certain uses; and withdraw consent at any time. Most of this you can do yourself in the app under Me → Edit profile and Settings. For anything else, email letsride@dirtanian.com and we'll respond within 30 days.

Every marketing email has an unsubscribe link, and you can manage push notifications in Settings or your phone. If you're not happy with how we've handled something, you're welcome to complain to South Africa's Information Regulator (inforegulator.org.za) or your local data-protection authority.

8.How long we keep data

In short: As long as you have an account. After that, only what the law makes us keep — with your name removed.

When you delete your account, your ride tracks, content and profile are deleted. Orders, race results and the financial ledger are kept for five years, the period South Africa’s Tax Administration Act requires for financial records, with your name and contact details removed so they no longer identify you. Race results stay in the sporting record indefinitely, in the same de-identified form. Backups age out within 30 days.

9.Deleting your account

In short: Delete in the app or by email. Done within 30 days.

You can delete your account in the app under Settings → Delete account or Me → Edit profile, on the web at app.dirtanian.com/delete-account, or by emailing letsride@dirtanian.com. We complete deletion within 30 days.

10.Children and dependents

In short: You need to be 13 or older to hold an account. Younger riders take part through a guardian.

Dirtanian accounts are for riders aged 13 and over. Riders under 18 enter events as dependents managed by a parent or guardian, who provides their details and consents on their behalf. We don't knowingly collect personal information from anyone under 13; if you believe we have, email us and we'll delete it promptly.

11.Security and where data lives

In short: Encrypted in transit and at rest, access-controlled, and stored on Google Cloud.

Data travels encrypted (TLS) and is stored encrypted on Google Cloud infrastructure with access limited to what each feature needs. Sensitive fields such as payout details are stored server-side only. Our servers are hosted by Google Cloud in the United States — the database in Google’s multi-region nam5, file storage in its US multi-region, and our server functions in Iowa (us-central1) — so your data is processed outside South Africa; those transfers are covered by Google's contractual safeguards and, for EU/UK riders, standard contractual clauses.

12.Changes and contact

In short: If this policy changes in a way that matters, we'll tell you in the app first.

We'll update this page when our practices change and update the date at the top. For material changes we'll let you know in the app or by email before they take effect. Questions or requests? We're at letsride@dirtanian.com.