1. Scope
This Privacy Policy applies to the MashON iPhone and Apple Watch app, the website at mashon.link, and related MashON services. “MashON,” “we,” and “us” refer to the operator of the MashON service.
MashON is an activity app for cycling, running, and walking, not an emergency, medical, traffic-safety, or collision-avoidance service. Stay aware of your surroundings and follow local laws.
2. Data we process
Account and profile data
If you create an account, we process your email address, authentication identifier, display name, optional name and nickname, initials, avatar color, optional profile photo, and account timestamps. Authentication is provided through Amazon Cognito. MashON does not receive your plain-text password.
Ride, group, and challenge data
We process ride names, activity type, invitation codes, membership and leader status, challenge state, route summary, timestamps, completed-activity summaries (including Mash type, duration, distance, elevation gain, and available average and maximum heart rate, power, cadence, and speed), and public-challenge leaderboard results. Invitation and claim tokens are security-sensitive; anyone who has a valid private link may be able to claim its invitation.
Health and fitness data
With permission, MashON may read workouts and associated routes, heart rate, power, speed, cadence, distance, and timing from Apple Health. MashON may start and save a workout from Apple Watch or iPhone. Workouts created by MashON include metadata (an activity identifier, Mash type, and related Mash, Team, or Challenge identifier when applicable) so the app can identify and sort its own workouts later. For a completed activity, MashON stores available average and maximum heart rate, power, cadence, and speed with the account’s activity summary so the user can view fitness history and results. MashON does not use health or fitness information for advertising, marketing, or sale. Full completed route geometry remains in Apple Health unless you choose a feature that requires a cloud route, such as a challenge, optional group route, or optional Saved Activity cloud sync.
Location and route data
During an active group Mash, MashON processes precise location so authenticated participants in that Mash can see current relative positions. Precise live location is transmitted as a temporary live stream and is not written to MashON’s durable activity database or application request logs.
When a signed-in user saves a completed-activity summary, our AWS delivery service may infer a country code and, when available, a state or region code from the network address used for that request. MashON stores only those coarse codes with the summary for regional usage totals. MashON does not store the source IP address, city, postal code, or GPS coordinates for this purpose.
Shared challenge geometry is stored in private encrypted object storage. Public challenges may keep the start point of the privacy-trimmed route and a coarse geographic cell to support discovery. Private challenges do not keep route coordinates in the durable database. Optional group routes contain simplified map geometry without sensor data or original workout timestamps.
Sensors, device, and diagnostics
MashON may process Bluetooth cycling-sensor readings, Apple Watch workout readings, app state, connectivity state, and bounded technical error information needed to provide and protect the service. Production logging is designed to exclude request payloads, live telemetry, and coordinates.
Photos and files you choose
If a team admin adds a team photo, MashON stores it privately and makes it available to that team's members through short-lived links. An admin can remove the photo. Only the team owner can delete the team, which removes its stored photo.
If you add a profile photo or import/export a GPX file, MashON processes that item at your direction. The Cloud Sync setting in App Settings is off by default. When off, newly saved equipment, maintenance reminders, bike setup calculations, and Saved Activities stay on this device. If you enable it, MashON stores this useful-tool data and your saved GPX activities in your account so they can sync with your signed-in devices. Activity files may contain precise routes, timestamps, and fitness measurements such as heart rate, power, and cadence. If you trimmed an activity, the untrimmed original is also uploaded so you can revert later. Turning sync off stops new transfers from that device but does not delete existing cloud copies. You can delete Saved Activity cloud copies in App Settings without removing the activities on your device; deleting your account also removes your synced private content. Profile photos and routes stored through cloud features are delivered using short-lived, scoped links.
Optional integrations
If you connect Strava, MashON requests only the access needed to upload an activity. OAuth credentials are encrypted, and temporary GPX transfer files expire after no more than one day. If weather is enabled, Apple WeatherKit may receive a location needed to return current conditions, subject to Apple’s terms and privacy practices.
Website data
If you subscribe to MashON updates, we process your email address, request and confirmation timestamps, consent-text version, and subscription preferences using Amazon Web Services in the United States. Subscription is optional, separate from an app account and from website analytics consent. We send a confirmation email first; you receive product news and release updates only after confirming. Use an unsubscribe link to cancel a pending request or stop updates. Unsubscribing does not delete your app account. Newsletter email addresses and confirmation tokens are never sent to PostHog.
Confirmation links expire after 24 hours. Unconfirmed requests are scheduled for deletion after seven days; removal may take additional time. We retain active subscription records until you unsubscribe or request deletion, and retain limited opt-out, delivery-suppression, and consent records as needed to respect your choices and prevent unwanted email. Contact privacy@mashon.link to request deletion. Encrypted backups may persist temporarily; failed delivery-feedback records expire within 14 days. We do not enable email-open or email-link click tracking.
The MashON website uses PostHog’s US service for limited page-view and selected-button analytics on the public home, QR landing, support, privacy, and terms pages. Selected-button events record clicks on “Download on the App Store” and “Open MashON,” along with the button’s fixed page placement, without sending its destination URL. On the public /download/ QR landing page, analytics may also include source, medium, campaign, and content labels from UTM parameters to help us understand which printed QR codes bring visitors to the website. These labels are not linked to newsletter email addresses. Analytics can include the public page path, time of visit, browser, operating system, and screen dimensions. PostHog receives network information, including your IP address, when your browser connects; our configuration disables IP-based geographic enrichment. We do not send account, health, ride, or precise location data to PostHog. We disable automatic click capture, session recordings, and identified person profiles. Analytics is not loaded on private invitation, challenge, team, protected gallery, or other non-public-page paths, and event URLs omit query strings, fragments, and referrers.
On /download/, this limited analytics begins when the page loads unless your browser sends Do Not Track or Global Privacy Control, or you previously selected “Decline.” No consent banner is shown on that page. On every other analytics-enabled page, analytics starts only after you select “Allow analytics.” You may decline or change your choice below. The website stores your consent choice locally in your browser. PostHog uses an in-memory anonymous identifier rather than an analytics cookie or persistent visitor identifier in this implementation. PostHog’s handling of analytics data is described in its Privacy Policy.
Our hosting and security providers necessarily process basic network information, such as IP address, user agent, requested path, and timing, to deliver and protect the site. We do not enable CloudFront access logs for this website because invitation paths can contain private tokens. The website does not use advertising cookies or account forms.
The landing page includes Strava-hosted club widgets. When a widget loads, your browser connects directly to Strava, which receives network and device information such as your IP address and user agent and may use cookies according to Strava’s own privacy practices. MashON displays these widgets to show club information and recent rides, not for behavioral advertising.
The landing page also embeds a video using YouTube’s privacy-enhanced player. Loading the player connects your browser to Google/YouTube, which receives network and device information. The player receives only our website origin, not page paths or invitation tokens, as its referrer. Playing or interacting with the video may involve cookies or local storage under Google’s privacy policy. The video does not autoplay.
3. How we use data
We use data to:
- create and secure your account;
- record workouts and show personal ride statistics;
- create, join, operate, reconnect, and finish group Mashes;
- share current ride position and metrics with authorized active participants;
- create, deliver, claim, manage, and score route challenges;
- provide optional route, useful-tool and Saved Activity cloud sync, weather, profile-photo, and Strava features;
- understand aggregate completed Mash activity by country and region;
- improve the public website using optional, consent-based page-view and selected-button analytics;
- send product news and release updates to confirmed newsletter subscribers;
- protect the service from fraud, misuse, and technical failure;
- respond to support, privacy, and account-deletion requests; and
- meet legal obligations.
Depending on your location, our legal basis may be performance of the service you request, your consent (especially for Health, location, Bluetooth, camera, photo, and integration permissions), our legitimate interest in securing and improving the service, or compliance with law.
5. Retention
We keep information only as long as needed for the feature, security, legal compliance, and reliable deletion:
- live ride telemetry and precise locations are transient and are not stored as durable ride history on MashON servers;
- account, profile, ride-membership, completed-activity summary, and challenge records remain while needed to operate the account and related features, then expire or are deleted under service retention rules;
- temporary Strava upload files expire within one day;
- temporary optional group-route overlays expire within 30 days;
- cloud-synced Saved Activities remain until you delete the cloud copies or your account; unfinished uploads are scheduled to expire after one day;
- local workouts, tracks, exports, and settings remain on your devices until you remove them or the operating system does; and
- encrypted backups and security records may persist for a limited period before aging out.
Account deletion removes your login, profile, cloud-synced Saved Activities, other owned private content in scope, and active membership relationships. Finished-ride history may retain anonymized or aggregate records that no longer identify your account.
6. Your choices and rights
You control Health, Location, Bluetooth, Camera, Photos, Weather, and related permissions in iOS Settings and the Health app. Disabling a permission may disable the feature that depends on it. You can disconnect Strava from MashON and from your Strava account settings.
You can edit your rider profile or delete your MashON account in the app under Account → Delete Account. Depending on where you live, you may also request access, correction, deletion, portability, restriction, or objection by contacting us. We may need to verify your request before acting.
To exercise a privacy right or ask a question, email privacy@mashon.link.
7. Security
MashON uses encrypted network connections, private encrypted cloud storage, short-lived transfer links, scoped authorization, access controls, password-safe managed authentication, keychain-backed session storage, and monitoring designed to exclude sensitive ride payloads. No security measure is perfect, so protect your device and account and avoid posting private invitation links publicly.
8. Children
MashON accounts are available from age 13, or a higher minimum age where local law requires it. The app checks the birth date entered during account creation only to determine eligibility; it does not save or send the birth date. Existing account sign-ins do not require an age check. We do not knowingly collect personal data from a child below the applicable age without valid authorization. Contact us if you believe a child has provided data improperly.
9. International use
MashON and its providers may process information in the United States and other countries where they operate. Those countries may have different data-protection laws. Where required, we use lawful transfer mechanisms and appropriate safeguards.
10. Changes to this policy
We may update this policy as MashON changes. The effective date above will be revised, and material changes may also be announced in the app or by another appropriate method.
11. Contact
Privacy questions and requests: privacy@mashon.link
General app support: support@mashon.link