Privacy Policy

Last updated: 14 November 2026

Dirtanian is the app for off-road sport — recording rides, entering events, following your people and seeing how you're progressing. To do that well we handle some personal information, including a few sensitive kinds like location and health data. This page explains what we collect, why, who sees it and how you stay in control. We've kept it in plain English on purpose: nothing hidden, nothing buried.

Who we are
What we collect, and why
Location, health and other sensitive data
Connected devices and apps
What other riders can see
Who we share data with
Advertising
Your rights and choices
How long we keep data
Deleting your account
Children and dependents
Security and where data lives
Changes and contact

1.Who we are

In short: Dirtanian, based in Pretoria, South Africa, is the "responsible party" for your data. Email us any time at letsride@dirtanian.com.

Dirtanian is operated by DIRTANIAN (registration number 2026/755674/07), a company registered in South Africa ("we", "us"). We run the Dirtanian app, the website and the developer API. We are the responsible party under South Africa's Protection of Personal Information Act (POPIA) and, where it applies, the controller under the EU and UK General Data Protection Regulation (GDPR).

Our Information Officer, Tiaan de Bruin, can be reached at letsride@dirtanian.com, on +27 61 503 6596, or at 141 Lynnwood Road, The Willows, Pretoria, Gauteng 0081, South Africa.

2.What we collect, and why

In short: We collect what the features need — your account, your profile, your rides, your entries and purchases — and we use it to run Dirtanian for you. Most of it is optional and you decide what to add.

What	Why we use it
Account — name, surname, email, phone, password (handled by Firebase Authentication), or Google / Apple sign-in.	To create and secure your account, sign you in and reach you about your entries and account.
Profile — photo, about, date of birth, gender, weight (all optional), address, race number, club, interests, your bikes and vehicles, licences.	To show your profile, place you in the right class and age group, and complete event entries and payouts.
Medical information and emergency contacts (optional).	Only for the SOS feature and to help organisers and medics look after you at an event. See section 3.
Dependents — details of under-18 riders you manage as their guardian.	So you can enter and manage them for events. See section 10.
Rides and location — precise GPS while you record, including in the background; live tracking you choose to share.	To record your activity, calculate distance, speed, segments, KOMs and rankings, and show your live position to the audience you pick. See section 3.
Nearby riders — Bluetooth proximity and NFC tags.	To let you "bump" and connect with a rider next to you. Used only while you use the feature.
Health and fitness data from Apple Health or Health Connect, with your permission.	To show your own stats alongside your rides. See section 3.
Contacts — your contacts’ email addresses and phone numbers, only when you tap "Find contacts on Dirtanian".	They are sent to our server and compared once against Dirtanian accounts, so we can show you which of your contacts are already riding and let you invite the rest. They are used for that comparison only: we do not store your contact list, those addresses or those numbers. We only message a contact when you tap Send an invite for them: then we send that one person one invite from you, by email or (if we only have their number) by text message. We keep a one-way, scrambled fingerprint of that address so nobody gets invited over and over, a masked note of the invite (for example +2782•••4567) so we can check invites are arriving, and every invite tells them how to stop all future invites (a link in an email; in a text, reply OPT OUT). We read replies to our invite number only to act on those requests, and we don't keep what they say.
Camera, photos and microphone.	For your profile picture, posts, and event photos — only when you choose to add them.
Your content — posts, comments, chat messages, polls, reviews.	To show them to the riders you share them with and keep the community healthy.
Purchases and payment metadata — event entries, venue bookings, club memberships, event photos, advert credits.	To fulfil what you bought, issue receipts and refunds, and keep our books. Card details go straight to Peach Payments and never touch our servers. The Shop is sold and shipped via Shopify.
Organiser and photographer payout details — ID number and bank account.	To verify you and pay you out. Stored server-side only and never shown in the app to anyone else.
Device, diagnostics and usage — push tokens, crash reports (Firebase Crashlytics), analytics (Firebase Analytics).	To send you notifications you've asked for, fix crashes and understand which features help riders most.

Under POPIA and GDPR our legal bases are: performing our contract with you (running the app you signed up for), your consent (location, health, contacts, camera, marketing), our legitimate interest in keeping Dirtanian safe and working, and our legal duties (tax and accounting records).

3.Location, health and other sensitive data

In short: Location runs only while you record or share live. Health data is yours alone — never sold, never used for ads, never handed to third parties. You can switch either off at any time.

Location

When you start recording a ride, Dirtanian uses your precise location, including while the app is in the background or your screen is off, so your whole track is captured. Recording stops when you stop it. Live tracking during an event or outride shows your position only to the audience you select, and only while you keep it on. Ride tracks are stored losslessly so results and segments are fair.

Health and fitness data

With your explicit permission we read the categories you grant from Apple Health or Health Connect — such as heart rate, workouts, steps, calories, distance, weight, height and sleep — to show your own stats to you. If you turn on Save to Apple Health or Save to Health Connect, we also add the rides and workouts you save in Dirtanian there as workouts (type, time, distance and, on Apple Health, calories) so all your training lives in one place; switch it off at any time on the app's Health screen. That is all we use health data for. We never sell it, never use it for advertising or marketing, never share it with third parties except the cloud provider that stores it for you, and never use it to make decisions about you. You can revoke access in your phone's health settings at any time.

Medical information

Medical notes and emergency contacts are optional. They are shared only with your emergency contact when you trigger SOS, and with the organiser and medical team of an event you enter, so they can look after you.

4.Connected devices and apps

In short: You choose which devices and apps to connect, under Settings → Devices and apps. Each one brings in only what you allow, is used only to show you your own riding and training, and you can disconnect it at any time.

The sections below cover each device or service separately: what we read, what we use it for and how to switch it off. Some providers set their own terms for how their data may be used, and where they do, we follow them as well as this policy. Data from a connected device is never sold, never used for advertising, never processed by AI systems and never used to train AI, and never passed on to anyone except the cloud provider that stores it for you (Google Cloud, section 6).

Apple Health and Apple Watch

On iPhone, with your permission, we read the Apple Health categories you grant — such as heart rate, workouts, calories and distance — and, if you turn it on, save your Dirtanian rides back to Apple Health (section 3). The Dirtanian Apple Watch app records rides and heart rate on your watch and sends them to your phone. Manage or remove access in the Health app under Sharing → Apps.

Health Connect (Android)

On Android, with your permission, we read the Health Connect categories you grant — such as heart rate, exercise sessions, calories and distance — and, if you turn it on, save your Dirtanian rides there (section 3). Manage or remove access in Health Connect under App permissions.

Samsung Health and Galaxy Watch

Samsung Health shares with Dirtanian through Health Connect on your phone. We never connect to a Samsung account directly, so everything under Health Connect above applies. You choose what Samsung Health passes to Health Connect in the Samsung Health app.

Garmin Connect

What we receive. When you connect your Garmin account, you approve on Garmin's own page which data Garmin shares with Dirtanian. Garmin then sends us your activities as soon as your device syncs with Garmin Connect: the activity type, time, duration, distance, GPS track, elevation, speed, heart rate, cadence, power, temperature and calories, plus the name of the Garmin device that recorded it. If you allow health data, Garmin may also send daily summaries such as resting heart rate, heart-rate variability, sleep and stress.

How we use it. To create your rides in Dirtanian automatically, with your full track and heart rate; to show you your stats, progress and training; to credit your rides to challenges and events you've joined; and, if you ask, to send routes you choose to your Garmin device as courses. Rides from Garmin follow each ride's visibility setting and are shown with a "Garmin" credit and the device name. Garmin data is not offered through our public developer API.

Who processes it. Only Google Cloud (Firebase), which hosts our servers and database (section 6). We don't sell or share Garmin data with anyone else, and no AI systems process it.

Your choices. Disconnect at any time under Settings → Devices and apps → Garmin, or by removing Dirtanian in the Garmin Connect app. Either way we delete our Garmin access straight away and receive nothing more. Rides already imported stay on your profile as your own rides. You can delete any of them, or ask us to delete all of them, whenever you like, and they're deleted with your account. You can also see, correct and export them as described in section 8.

5.What other riders can see

In short: Dirtanian is a community, so your name, photo, posted rides and results are visible to other signed-in riders. You control your ride visibility and live-tracking audience.

Your profile name and photo, the rides you post, event results, leaderboards, segment times, badges and your comments are visible to other signed-in Dirtanian riders. Your email, phone number, address, date of birth, medical details and payout details are never shown to other riders. Each ride has a visibility setting, and live tracking is off unless you turn it on. Our public developer API exposes only the same public profile projection — never email, phone or address — and never data from connected devices such as Garmin.

6.Who we share data with

In short: Only the providers we need to run the app, plus the organisers of events you enter. We never sell your personal information.

Google Firebase and Google Cloud — hosting, database, storage, sign-in, analytics, crash reporting and BigQuery reporting.
Peach Payments — card payments and payouts. Shopify — the Shop checkout, shipping and returns.
SendGrid — transactional emails. Panacea Mobile — text-message invites you ask us to send. Cloudflare R2 — photo storage and delivery.
Mapbox and Protomaps — the maps you see.
Apple and Google — sign-in, push notifications, HealthKit / Health Connect and the app stores.
Event organisers, venues and clubs — the details needed for your entry, booking or membership, including emergency and medical information you've provided.
Anthropic and Google Vertex AI — used only for our internal back-office tooling (for example, designing badges). Riders' personal data is not sent to these services for training, and data from connected devices such as Garmin, Apple Health or Health Connect is never sent to them at all.

We may also share information when the law requires it, to protect riders' safety, or as part of a business transfer — and we'll tell you if that ever happens.

7.Advertising

In short: Some feed posts are sponsored by organisers and partners, always labelled "Sponsored". No ad networks, no cross-app tracking, and you can hide ads.

Sponsored posts are targeted by interest and region using your profile settings — never by your private data, health data or contacts. We don't use third-party advertising networks, don't track you across other apps or websites, and never sell your information to advertisers. Every sponsored post carries a "Sponsored" label and a hide option.

8.Your rights and choices

In short: You can see, fix, export, restrict or delete your data, and say no to marketing — whenever you like.

Under POPIA, and GDPR if you're in the EU or UK, you can ask us to access, correct, export or delete your personal information; object to or restrict certain uses; and withdraw consent at any time. Most of this you can do yourself in the app under Me → Edit profile and Settings. For anything else, email letsride@dirtanian.com and we'll respond within 30 days.

Every marketing email has an unsubscribe link, and you can manage push notifications in Settings or your phone. If you're not happy with how we've handled something, you're welcome to complain to South Africa's Information Regulator (inforegulator.org.za) or your local data-protection authority.

9.How long we keep data

In short: As long as you have an account. After that, only what the law makes us keep — with your name removed.

When you delete your account, your ride tracks, content and profile are deleted. Orders, race results and the financial ledger are kept for five years, the period South Africa’s Tax Administration Act requires for financial records, with your name and contact details removed so they no longer identify you. Race results stay in the sporting record indefinitely, in the same de-identified form. Backups age out within 30 days.

10.Deleting your account

In short: Delete in the app or by email. Done within 30 days.

You can delete your account in the app under Settings → Delete account or Me → Edit profile, on the web at app.dirtanian.com/delete-account, or by emailing letsride@dirtanian.com. We complete deletion within 30 days.

11.Children and dependents

In short: You need to be 13 or older to hold an account. Younger riders take part through a guardian.

Dirtanian accounts are for riders aged 13 and over. Riders under 18 enter events as dependents managed by a parent or guardian, who provides their details and consents on their behalf. We don't knowingly collect personal information from anyone under 13; if you believe we have, email us and we'll delete it promptly.

12.Security and where data lives

In short: Encrypted in transit and at rest, access-controlled, and stored on Google Cloud.

Data travels encrypted (TLS) and is stored encrypted on Google Cloud infrastructure with access limited to what each feature needs. Sensitive fields such as payout details are stored server-side only. Our servers are hosted by Google Cloud in the United States — the database in Google’s multi-region nam5, file storage in its US multi-region, and our server functions in Iowa (us-central1) — so your data is processed outside South Africa; those transfers are covered by Google's contractual safeguards and, for EU/UK riders, standard contractual clauses.

13.Changes and contact

In short: If this policy changes in a way that matters, we'll tell you in the app first.

We'll update this page when our practices change and update the date at the top. For material changes we'll let you know in the app or by email before they take effect. Questions or requests? We're at letsride@dirtanian.com.