Privacy Policy

Last updated: 1 November 2026

Pedal Valencia is a bicycle tour app for Valencia: a map, listings, augmented-reality (AR) views of historic photos and self-guided tours, unlocked with a code from the bike shop you rent from. Partner bike shops also use it, in the app and at app.pedalvalencia.com, to start rentals and look after their fleet, including bikes fitted with GPS trackers.

This policy explains what data is handled, why, who can see it and what your rights are. It covers the Pedal Valencia app (iOS and Android) and the shop portal.

1. Who we are

Pedal Valencia is developed and run by James Methven (JAM), an independent app developer based in Valencia, Spain. For the data described here, except tracker data (see section 4), James Methven is the data controller.

Contact: pedalvalencia.support@gmail.com

2. Using the app

Location

With your permission, the app uses your phone's precise location to show where you are on the map and to place AR content accurately (through Google's ARCore Geospatial API, see section 6). This happens on your phone. Pedal Valencia does not store your location or send it to our servers.

Camera

With your permission, the app uses the rear camera to show historic photos in place. Camera images are processed in real time and are not stored or sent to us. Google processes camera images for the AR positioning, as described in section 6.

Maps and app content

Map tiles come from Mapbox, and photos, listings and tours are downloaded from our content servers. As with any internet request, these services receive your IP address and basic device information (such as the app version) in order to deliver the content.

3. Rental codes

When you rent a bike, the shop gives you a code (for example on a QR code). When you enter it, the app creates a random, anonymous identifier for your phone (Firebase Authentication anonymous sign-in) and links the code to it, so the code works on one phone only. We store:

• the code, which shop issued it, its access level (Lite or Pro) and when it was redeemed;
• the rental it belongs to: which bikes, when it started, the agreed return time and when the bikes were returned;
• if you use Report stolen, which bike you reported and when.

This lets the app unlock your access for the right period, show your rental and the shop's details, and pass a theft report straight to the shop. The shop sees its own rentals and codes. We also use redeemed codes to invoice the shop. None of this includes your name or contact details; the shop's own rental paperwork is handled by the shop.

4. Bikes with GPS trackers

Some partner shops fit GPS trackers to some of their bikes. The tracker belongs to the bike, not to you, and its purpose is to manage the fleet and to find and recover stolen bikes. Your phone is never tracked.

Because a bike's position during your rental shows where it was ridden, we treat it as personal data and protect it accordingly.

• What the tracker sends: the bike's position, the time, the tracker's battery level and the bike's frame details. It reports every few minutes while the bike is moving and goes to sleep when it is parked.
• After a theft report (by you or by the shop) it reports every 30 seconds until the bike is recovered.
• Who sees it: only staff of the shop that owns the bike, in the shop's Fleet screen in the app and on the shop portal. They see the current position and, for finding a bike, the route of the last 2 or 24 hours. Renters don't see bike positions in the app.
• Police: if a bike is stolen, the shop may give the police the bike's last known position, its frame serial number and the time of the report.
• What it is not used for: watching how or where you ride, speed checks, profiling or marketing.

The shop decides to track its own bikes and is the data controller for tracker data; Pedal Valencia processes it on the shop's behalf and under its instructions. Shops that use trackers tell renters at the time of rental. If you have a question about a tracked bike, you can contact the shop or us.

5. Shop staff accounts

Owners and staff of partner shops sign in with an email address and password. We store their email, name, role (owner, co-owner or staff), which shop they belong to, and the actions they take in the app or portal (for example who started a rental, invited a colleague or reported a bike stolen). Passwords are handled by Firebase Authentication; we never see them. Invite codes expire after 24 hours or once used.

The shop portal at app.pedalvalencia.com stores only what is needed to keep you signed in. It uses no advertising or tracking cookies.

6. Google ARCore

This application runs on Google Play Services for AR (ARCore), which is provided by Google LLC and governed by the Google Privacy Policy. The AR views use the ARCore Geospatial API. In summary, according to Google:

• ARCore always collects device or Google account identifiers, performance and diagnostic data, and data about the API calls the app makes, to produce analytics and keep ARCore working well. Google does not share this with third parties.
• When the Geospatial API is used, ARCore also collects precise location and camera video to work out where the phone is. This is stored temporarily and marked for automatic deletion; Google may keep anonymised data derived from it to improve its products.
• Data collected by ARCore is encrypted in transit.

Full details: ARCore privacy requirements.

7. Service providers

We use these providers to run Pedal Valencia. They act on our instructions and may not use the data for their own purposes, except Google ARCore as described above.

Where data is processed outside the European Economic Area, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

8. How long we keep data

• Unredeemed codes: void after 24 hours or when the rental ends.
• Rental details (bikes, times, theft reports): 12 months, then reduced to what we need for invoicing (code, shop, access level, date), which we keep for as long as Spanish accounting law requires.
• Tracker position history: 30 days. Each bike keeps only its latest position after that. For a stolen bike, positions are kept until it is recovered and for as long as the police case needs them.
• Anonymous phone identifier: until you delete the app (it is then no longer linked to anything).
• Staff accounts: while the person belongs to a shop. Removed staff lose access immediately; the account is deleted on request or when the shop leaves Pedal Valencia.

9. Legal bases

• Providing the app and your rental access (codes, rentals, theft reports): performance of a contract (GDPR Art. 6(1)(b)).
• Shop staff accounts: performance of our contract with the shop, and the shop's legitimate interest in managing its staff's access (Art. 6(1)(b) and (f)).
• Bike trackers: the shop's legitimate interest in protecting its property and recovering stolen bikes (Art. 6(1)(f)), limited to the bike's position and only visible to that shop.
• Invoicing and accounting: legal obligation (Art. 6(1)(c)).
• Location and camera on your phone: your permission, which you can withdraw at any time in your phone's settings.

10. Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Write to pedalvalencia.support@gmail.com. Because renters are anonymous, include your rental code so we can find the records that belong to you. We reply within one month.

If you are unhappy with how we handle your data, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or the authority in your own EU country.

11. Children

Pedal Valencia is not aimed at children under 14 and we do not knowingly collect personal data from them. Children may ride a bike on a family rental; the rental code is used on an adult's phone.

12. Changes and contact

We may update this policy as the app changes. The date at the top shows the latest version; important changes will also be announced in the app.

Questions: pedalvalencia.support@gmail.com