Privacy policy

Overview

RideMyPark (RMP) is a service for discovering and sharing skate spots, events and shops, provided free of charge by its publisher. This policy explains what data is collected when you use the website and the app, for what purpose, and how you can exercise your rights.

Data we collect

Account data: email address and password (encrypted), or the identity provided by your login provider (Google, Apple) if you use third-party sign-in. Depending on what you provide: display name, username, avatar, country, sports you practice, links to your social profiles, date of birth and gender.

Purposes and legal bases

Providing the service (account, publishing listings, reviews, favorites, messaging, booking a class): processing necessary to perform the service you requested. Passing participant details on to the instructor relies on the same basis: without them, they can neither run the class nor insure it.

Cookies and audience measurement

Strictly necessary cookies: a session/authentication cookie (“rmp_token”) keeps you signed in for 30 days; it is essential to how accounts work and does not require consent. Your banner choices are kept in your browser's local storage (“rmp_consent_prefs”), as is your objection to anonymous measurement if you set one (“rmp_audience_optout”), until you change them or clear the site's data — keeping them is what saves us from asking you again on every visit.

Providers and data location

We rely on a limited number of technical providers, acting as data processors:

AI agents and the MCP server

RideMyPark runs an MCP (Model Context Protocol) server at mcp.ridemypark.com. It lets an AI assistant read public data and, with your authorisation, read account data or perform specific actions. With account write permission, an agent can propose a spot, event or shop listing for review, or create a session. Proposed listings are not published until reviewed; a session is created immediately.

Without account authorisation, an agent can read the public catalogue: spots, partner pages, events, articles, geographic areas, weather and site counters. Account records remain protected. Public pages may contain information that contributors have chosen to publish.

Account access requires OAuth 2.1 and your explicit consent on a screen that names the requester, redirect address and permissions. Separate permissions cover your public identity, account records (bookmarks, lists, contributions, sessions, notifications and activity), and account actions. Staff permissions also allow administration reads and specific writes, such as activation codes and submission quotas, subject to the account’s current role. The legal basis for this processing is your consent.

That consent is recorded (account, client, permissions granted, grant date, last-use date) and stays revocable at any time from Settings then “Connected agents”. Revocation takes effect immediately; an access token already issued expires ten minutes later at the latest.

Each tool call is logged for security and operations: tool name, permission, status, error code, duration, response size, IP address prefix and timestamp. Arguments are stored only as a fingerprint. This audit log is kept for 90 days, then purged automatically. Product analytics use PostHog in the EU to measure tool use, duration, success or failure and client information. Authenticated calls use a pseudonymous account identifier; anonymous calls share one identifier. Arguments, responses, request summaries and error message content are excluded from these analytics.

The agent’s access token stops at the MCP server. The server queries the API with its own service identity. Tool responses are returned to your assistant and may be processed by its provider under its own privacy policy. Check that policy before you authorise account access. For questions: contact@ridemypark.com.

Retention period

Your account data and contributions are kept for as long as your account is active. When you delete your account, your personal data is erased, but the spots, shops and events you created are kept, detached from your account (see the “Account deletion” section). Two exceptions held by a legal obligation survive it: class bookings, kept for 10 years as accounting records (art. L123-22 of the French commercial code), and the tax details declared by instructors, kept for 10 years for the annual platform operator report (DAC7).

Security

Exchanges with the site are encrypted (HTTPS), passwords are stored as hashes, and access to data is restricted. Since no method of transmission or storage is 100% secure, absolute security cannot be guaranteed.

Children's privacy

Signing up is restricted to people aged 15 or over, the age at which a person can consent on their own to the processing of their personal data in France (art. 45 of the French Data Protection Act): no minor has an account or access to messaging. An adult who books a class may, however, sign up a minor as a participant. In that case we collect the participant's first name, last name and date of birth, together with their legal representative's authorization, its date and the version of the text accepted. This information is passed on to the instructor running the class, a separate data controller for their own activity, and is used only to welcome the participant and for insurance needs; it is erased 12 months after the class. The legal representative may at any time request access to it, its rectification or its erasure at contact@ridemypark.com, independently of the account the booking was made from.

Your rights (GDPR)

Under the GDPR, you have the right to access, rectify, erase, and port your data, to object to and restrict its processing, and to withdraw your consent to audience measurement at any time.

Account deletion

You can delete your account at any time from the “Delete my account” page, accessible from the footer and your settings. Deletion is permanent. It erases your personal data, including your profile, your email addresses, the reviews and posts you wrote, your edit proposals that weren't approved, and your contributor credit on listings. The spots, shops and events you created aren't deleted: they're detached from your account, then the RideMyPark team either attributes them to RideMyPark or leaves them without an author. Approved edits and the photos you added to a listing also stay online, without your name.

Changes to this policy

This policy may be updated to reflect changes to the service or to applicable regulations. Any change is published on this page, with the date at the top updated accordingly.

Contact

For any question about this privacy policy or your personal data: contact@ridemypark.com.