In short
- Visitor statistics with Google Analytics only if you say yes in the cookie box. Say no and nothing loads from Google.
- The newsletter: your email and city are kept by Brevo, who sends the emails. Unsubscribe in one click.
- If you claim a club, what you write reaches us as an email. It isn’t stored anywhere else.
- We never sell your data.
- The app at app.rulla.cc has its own privacy policy for accounts, rides and chat.
Who is responsible
The controller for rulla.cc is Upstrat Lab AB (company no. 559172-7218), which runs Rulla, Nordhemsgatan 56, 413 11 Gothenburg. Send questions about your data to privacy@rulla.cc.
What this policy covers
This policy covers the website rulla.cc. When you use the app at app.rulla.cc, with an account, rides, sign-ups and chat, the app’s privacy policy applies.
The newsletter
When you sign up for The week’s rides, the form sends your email address, your city or the town you type, the kinds of riding you picked if you picked any, your language and the page you signed up on.
They go through a function at Supabase straight to our list at Brevo, who sends the emails. They aren’t stored in Rulla’s own database.
We use them to email you the group rides near you every Sunday, in your language. The legal basis is your consent.
You’re on the list straight away and get a welcome email. Every email has a link to unsubscribe in one click, and then we stop sending. If you want your details deleted completely, email privacy@rulla.cc.
Claiming a club
The form on a club page sends your email address, what you write and which club it’s about. It reaches info@rulla.cc as an email. Nothing is stored in Rulla’s database.
We use it to check that you may speak for the club and to reply to you. The legal basis is our legitimate interest in handing club pages only to the right people. The email stays in our inbox for as long as the request needs it.
Bot check
Both forms are protected by Cloudflare Turnstile, which checks that a person is sending them. It loads only when you start filling in the form. Cloudflare then sees technical details such as your IP address and browser.
Visitor statistics with Google Analytics
If you say yes to statistics in the cookie box, we use Google Analytics to see how rulla.cc is used: which pages are visited, where visitors come from, what kind of device they use and what they click, such as going on to the app, downloading a route or signing up for the newsletter. We never send your name, your email or what you type in a form to Google.
The legal basis is your consent. If you say no, or nothing at all, nothing loads from Google and no such cookies are set.
Google Analytics is run by Google Ireland Limited, which processes the data on our behalf. Google Analytics doesn’t store IP addresses, and we keep the statistics for 14 months.
You can change your choice any time under Cookie settings at the bottom of every page. If you take back a yes, we also remove Google’s cookies from your browser.
Maps and your location
The maps load their map images from OpenFreeMap. If you choose another map, such as satellite or terrain, the images come from Mapbox, Thunderforest, Tracestrack, CyclOSM or Mapterhorn. Whoever serves the map images sees your IP address and the area you’re looking at, as with any visit to a website.
If you tap Near me, your browser asks for your location. It’s used only in your browser, to show the map where you are or sort clubs by distance, and isn’t sent to us.
Search
When you search for a name, such as a club or a city, the search looks in your own browser. What you type isn’t sent to us.
If you describe a ride in your own words and choose to show it on the map, the text goes to a function at Supabase in the EU and is read by TypeSafe, which turns it into the map’s filters. The text itself isn’t stored. The answer is kept for 30 days under a code that can’t be turned back into text, so the same search is quicker next time. Your IP address is used only to limit how many searches can be made.
Don’t type personal details into the search field. What you type is never sent to Google, even if you’ve said yes to statistics.
Hosting and logs
The website and its films are delivered by Vercel, and the fonts are on our own server. Like any web server, Vercel processes your IP address and browser details to show the pages and protect them from attacks. We don’t use those logs for statistics.
On a ride’s page, your browser fetches how many are going from Rulla’s database at Supabase in the EU. It’s a number only, no names.
Cookies and browser storage
rulla.cc sets no cookies of its own. If you say yes to statistics, Google Analytics sets two:
- _ga: tells your browser apart from others, so a return visit counts as one. Kept for 13 months.
- _ga_ followed by a code: keeps one visit together. Kept for 13 months.
The site also keeps a few small things in your own browser. They’re never sent to us:
- your choice in the cookie box, for 12 months, so we don’t ask again;
- that you closed the newsletter question, so it stays away for 30 days, or that you signed up, so it doesn’t come back;
- what you ticked on the Vätternrundan packing list;
- during your visit: that the newsletter question has already shown, and whether you chose the list in the race calendar.
If you’re signed in to the app, the app sets a small cookie, rulla_signed_in. It only says that you’re signed in, not who you are, so the site can show Open Rulla instead of Log in. It’s used for that button only, never for statistics. It goes when you sign out, or after 30 days without opening the app. You can clear all of this in your browser’s settings.
What the pages show
Rides, clubs and races on rulla.cc come from the app and from public sources, such as the clubs’ and organisers’ own pages.
We never show who is going on a ride, only how many. An organiser’s name shows only when the ride isn’t a club’s and the organiser has a public profile in the app.
If something about you or your club should change or come down, email hello@rulla.cc.
Data outside the EU
Some providers are US companies or process data in the United States, for example Vercel, Cloudflare, Mapbox, TypeSafe and Google. When data leaves the EU and EEA we rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
Your rights
You have the right to know what data we hold about you, to have it corrected or deleted, to object to how we use it and to withdraw your consent. Email privacy@rulla.cc.
If you’re unhappy with how we handle your data, you can complain to the Swedish data protection authority, Integritetsskyddsmyndigheten, at imy.se.
Changes
If the website changes so that this no longer holds, we update it. The date at the top shows when it last changed.
