Who we are
Tarmac Ltd ("Tarmac", "we", "us") runs the Tarmac mobile app and website. We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Questions about privacy? Email [email protected].
What we collect
Account details
- Email address, username, and optionally your first and last name.
- A securely hashed password, and one-time sign-in codes we email to you.
- Your profile photo, if you add one.
Rides, routes and groups
- Routes you create or import, including stops, via and shaping points.
- Groups you create or join, your role in them, invites and ready checks.
- Messages, photos, captions and kudos you share with a group.
- Hazard reports and reports you make about other members.
Location
- Live location during an active ride, shared with the other members of that ride so the group can see where everyone is.
- Location attached to photos or hazard reports you choose to post.
Device and technical data
- A device identifier used to keep you signed in securely, and when it was last seen.
- Basic logs such as IP address, app version and error reports.
How we use it
- To provide the service — plan and navigate routes, run group rides, share live location, suggest traffic diversions (contract).
- To keep accounts secure — sign-in, refresh tokens, lockouts after failed attempts, password resets (legitimate interests).
- To keep riders safe — hazard and speed camera alerts, and handling reports about behaviour in groups (legitimate interests).
- To improve Tarmac — diagnosing bugs and understanding how features are used (legitimate interests).
- To contact you — service emails such as sign-in codes and invites. We only send marketing if you opt in (consent).
Location sharing
Location is at the heart of a group ride, so we are deliberate about it. We only collect your live location while you are in an active ride and have granted the permission on your device.
Your live position is visible to members of that ride only. You can stop sharing at any time by leaving the ride or turning off location permission for Tarmac in your device settings.
How long we keep it
- Account data is kept while your account is open.
- Detailed live location from a ride is kept only as long as needed to run and summarise that ride, then deleted or anonymised.
- Sign-in codes and password reset links expire shortly after they are issued.
- When you delete your account we remove your personal data within 30 days, except where we must keep it to meet legal obligations.
Your rights
Under UK data protection law you can:
- access a copy of your data, or have it sent to another service;
- correct inaccurate data;
- ask us to delete your data;
- object to or restrict how we use it;
- withdraw consent at any time where we rely on it.
Email [email protected] and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Security
We use encryption in transit, hashed passwords, short-lived access tokens with rotating refresh tokens, and account lockouts to protect your data. No system is perfect, so if you believe your account is at risk, contact us straight away.
Children
Tarmac is not intended for anyone under 16. We don't knowingly collect data from children; if you believe a child has created an account, let us know and we'll delete it.
Changes to this policy
We'll update this page when our practices change and tell you in the app about anything significant. Please also read our terms of use.