Privacy Policy

What this covers

Cygo is a road-comfort map and route planner for cyclists in New Jersey. This policy describes exactly what the app collects, why, how long it's kept, and who else can see it. It applies to the Cygo web app and any mobile wrapper of it.

What we collect

Data	Why	Source
Email address, password (hashed — we never see or store the plain password)	Creating and signing in to your account	You, when you sign up
Name (optional)	Shown on your profile inside the app	You, at sign-up
Name, email, and profile photo, if you sign in with Google or Apple	Same as above — an alternative to an email/password account	Google or Apple, with your explicit consent during that sign-in flow
Saved routes — GPS coordinate traces of roads you drew or planned to ride	Letting you save, revisit, rename, and export (GPX) routes across sessions and devices	You, when you draw a route and tap Save
Distance/speed unit preference	Remembering your preferred display units	You, in Settings

About location data specifically: saved routes are GPS traces. A route's start or end point can reveal approximately where you live, work, or frequently ride — even though we never ask for or store your real-time location directly. Treat "my saved routes" as the sensitive part of this app. Cygo does not collect background or continuous location; the only location-adjacent data is what a route you deliberately drew and saved contains, and the optional "use my current location" button, which reads your device's location once, at the moment you tap it, only to center the map — that position is never stored or sent anywhere.

What we don't collect

No advertising identifiers, no ad tracking, no sale of data to third parties.
No background or continuous location tracking.
No payment or financial information (Cygo doesn't process payments).
No profile fields beyond name/email — we don't ask for anything we don't have an active use for.

Who else processes this data

We use a small number of infrastructure providers ("subprocessors") to run Cygo. None of them can use your data for their own purposes — they process it only to provide the service to us.

Provider	What it handles
Supabase	Hosts our database and authentication — your account, saved routes, and sign-in credentials live here.
Cloudflare	Hosts the app itself and the underlying (non-personal) NJ road-network map data; sees standard web request logs (IP address, requested URL, timestamp) as any web host does.
Google / Apple	Only if you choose "Continue with Google/Apple" — they authenticate you and share the profile fields you approve at that time.

The road-comfort data itself (speed limits, traffic counts, shoulder widths) comes from NJDOT/NJSLD public records and OpenStreetMap contributors — this is public infrastructure data, not personal data about you.

How long we keep it

Your account and saved routes are kept until you delete your account. Deleting your account (available in-app, under Profile → Delete account) immediately and permanently removes your account and every route associated with it — this is not a "deactivation," and it cannot be undone.

Your rights

Delete your account and all data — in-app, any time, under Profile → Delete account.
Export your routes — any saved route can be exported as a GPX file at any time.
Guest mode — you can use the map, draw routes, and export GPX files without creating an account at all; guest routes exist only in that browser session and are never sent to our servers.

Children's privacy

Cygo is not directed at children under 13, and we do not knowingly collect data from them.

Changes to this policy

If this policy changes in a material way, we'll update the "Last updated" date above and, where required, notify signed-in users in-app.

Contact

Questions about this policy or your data: siraj2sheikh@gmail.com