Legal
Privacy policy
What we collect, why we collect it, and how to get rid of it.

Last updated: 3 September 2026

Cycletowns is operated by Sport2040 (ABN 73 680 648 855), based in Australia. This policy explains what personal information the site collects, what we do with it, who else can see it, and how you can get a copy of it or have it deleted. If anything here is unclear, email hello@cycletowns.com and we will answer you.

You can use most of the site without giving us anything

Town guides, rankings, news, the trip planner and the loop builder all work without an account. We do not run advertising trackers, and we do not use analytics or profiling cookies. We do not sell personal information, and we never will.

What we collect when you make an account

  • Your email address. Required — it is how you sign in, because we do not use passwords.
  • Basic Google profile details, if you choose to sign in with Google: your name, email address and profile picture. Google does not give us access to anything else in your Google account.
  • Anything you choose to add to your profile: display name, home town, country, how you ride, your ability level, a short bio, and a photo if you upload one. All of these are optional.
  • What you contribute: reviews and ratings of towns, posts, groups you join, cafés and routes you suggest, towns you save, trip plans and loops you save.
  • Your points balance and the record of how you earned it.

What is public and what is not

Your reviews, posts, and your display name and profile picture are visible to anyone using the site — that is the point of a rider-ranked guide. Saved loops are shareable by link. Your email address is never shown publicly and is not visible to other riders. Towns you save and trip plans you have not shared are private to your account.

Payments

Insider membership is billed through Stripe. We never see or store your card details — those go straight to Stripe, which is certified to handle them. We keep a Stripe customer reference, whether your membership is active, whether it is monthly or annual, and when it runs to. Stripe’s own privacy policy governs what it does with the payment data it holds.

Email

We email you sign-in links, and messages about your account or membership when there is something you need to know. We will not add you to a marketing list without asking you first, and any marketing email we do send will have a working unsubscribe link.

Cookies

We set cookies for one reason: to keep you signed in and to complete the sign-in process securely. There are no advertising or tracking cookies on this site. Clearing them signs you out; nothing else breaks.

Who else handles your information

These are the services the site runs on. Each only receives what it needs to do its job.

  • Supabase — the database and sign-in system that stores your account and contributions.
  • Netlify — hosting. It keeps standard server logs, including IP addresses, for security and diagnostics.
  • Stripe — payments and subscriptions, if you become a member.
  • Google — only if you choose to sign in with Google.
  • Resend — delivery of sign-in and account emails.
  • OpenRouteService and OpenStreetMap — building loop routes and drawing maps. When you build a loop, the start point and distance are sent to OpenRouteService. This is not tied to your account, and we do not send it your identity.

Some of these providers operate servers outside Australia, so your information may be stored or processed overseas, including in the United States and the European Union.

How long we keep it

We keep your account for as long as it exists. If you delete your account we remove your profile, saved towns, trip plans and loops. Reviews and posts may remain, with your name removed, because other riders’ rankings depend on them — tell us if you want yours taken down entirely and we will remove them. Payment records are kept for as long as Australian tax and record-keeping law requires.

Your rights

You can ask us for a copy of everything we hold about you, ask us to correct it, or ask us to delete your account and its contents. Email hello@cycletowns.com and we will action it within 30 days. You can edit or delete most of it yourself from your account page at any time. If you are in the UK or EU, you also have the right to object to processing and to lodge a complaint with your local data protection authority; in Australia you can complain to the Office of the Australian Information Commissioner.

Children

Cycletowns is not intended for children under 16, and we do not knowingly collect their information. If you believe a child has made an account, tell us and we will remove it.

Security

The site is served over HTTPS, sign-in uses one-time links rather than passwords, and the database enforces per-row access rules so riders can only read and change their own data. No system is perfect; if we ever have a breach affecting you, we will tell you and the relevant regulator as the law requires.

Changes

If we change this policy we will update the date at the top, and for anything significant we will tell account holders by email rather than quietly editing the page.

Contact

Privacy questions, access requests and complaints: hello@cycletowns.com.

Sport2040 (ABN 73 680 648 855)
Level 15, 461 Bourke Street
Melbourne VIC 3000
Australia

The Cycletowns newsletter
New town guides, routes and features. No schedule, no spam, unsubscribe any time.

Send me the Cycletowns newsletter — new town guides, routes and features. Unsubscribe any time. We don’t share your address, and we don’t email you about anything else.

© 2026 Cycletowns™ · A Sport2040 project · ABN 73 680 648 855