This Privacy Policy explains how BUNCH APP Ltd ("we", "us", "our") collects and uses your personal data when you use the BUNCH app and services (the "Service"). We are the data controller. It is written to meet the UK GDPR and the Data Protection Act 2018.
We do not sell your personal data.
1. Who we are and how to contact us
Controller: BUNCH APP Ltd, Suite RA01, 195-197 Wood Street, London E17 3NU, registered in England and Wales, company no. 17402808.
We ask for your date of birth once, to confirm you are 18 or over. It is not shown on your profile or to other people.
Optional profile details: home area, sport preference, and a profile photo.
Activity & community data
Activities, clubs, crews and places you create, join, lead, follow or claim, and your participation state (e.g. going, waitlisted).
Messages you send in activity or club chats and direct messages.
A limited private record used to power reliability and "ridden with / been to" history.
Location
With your permission, your approximate device location, to power "near me" and the map. On the web this uses your browser's location prompt; on mobile it uses your device location. You can decline or turn this off; the app still works, it just can't sort by distance. We also geocode any addresses you enter (via Mapbox) to place them on a map.
Photos
Photos you upload for identity/utility (your profile, a club or place logo, a venue or activity image). Photos you post from a run or ride appear in the BUNCH feed for the people who can see that post.
Email news (optional)
If you tick "Send me BUNCH news" or turn on "Email me BUNCH news", we send occasional product news by email. We use Resend to send it. You can switch it off in You > Notifications or with the unsubscribe link in any email.
Connected apps: Garmin (optional)
If you choose to connect your Garmin account, we receive the activities you record on your Garmin device (such as the date, distance, duration and route) so you can share them with your club and on BUNCH. We only receive data after you connect, and only what you have agreed to in Garmin's permission screen.
You can disconnect Garmin at any time in BUNCH or in your Garmin Connect account settings. When you disconnect, we stop receiving new data, and you can delete the activities we imported, or ask us to, at any time.
Device & usage data
Basic technical information needed to run and secure the Service (e.g. app version, device type, and diagnostic/log data), and a push-notification token if you enable notifications.
Local storage
We store an authentication token on your device to keep you signed in.
3. How and why we use your data, and our lawful bases
Purpose
Examples
Lawful basis
Provide the Service
Show activities and who's attending; run clubs/crews/places; deliver chat; keep you signed in
Performance of a contract with you
"Near me" & maps
Sort by distance; show map pins; geocode addresses
Consent (location) / contract (maps)
Notifications
Send the alerts you've asked for
Consent (you enable them)
Safety & integrity
Prevent abuse, enforce our Terms, moderate content, keep the Service secure
Legitimate interests (keeping people and the Service safe)
Improve the Service
Understand usage and fix problems
Legitimate interests (running and improving the Service)
Legal & disputes
Comply with the law; establish or defend legal claims
Legal obligation / legitimate interests
Where we rely on consent (e.g. location or notifications), you can withdraw it at any time in your device settings or by contacting us; this won't affect processing already carried out.
4. Who your data is shared with
Other users. By design, other people can see what you'd expect on a community app: your name and photo, the activities and clubs you're part of, and your messages in chats you belong to. Consider what you share.
Service providers (processors) who help us run the Service under contract:
Supabase: hosting, database, authentication and file storage.
Mapbox: maps, static map images and geocoding.
Apple and Expo: push notifications.
Resend: sending BUNCH news emails you have opted into.
ChottuLink: invite and share links, including opening the right page after you install BUNCH.
Garmin is a data source, not a processor: if you connect it, Garmin sends us the activity data you have authorised. Garmin's own privacy policy covers how Garmin handles your data.
We do not sell your data or share it for third-party advertising. We may disclose data where required by law, to protect people's safety, or in connection with a business transfer, subject to appropriate safeguards.
5. International transfers
Some providers may process data outside the UK. Where they do, we rely on an appropriate safeguard under UK data protection law (such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses). Our primary data store (Supabase) is configured in the European Union (Paris, eu-west-3) region. Contact us for details of the safeguards in place.
6. How long we keep it
Account & profile: for as long as your account is active. When you delete your account it is disabled immediately and removed after a short recovery window of 30 days, after which personal data is deleted or anonymised, except where we must keep some by law.
Event chats: ephemeral - automatically deleted a couple of weeks after the activity (the activity itself remains as history). Club/crew chats persist while the club exists.
Backups and logs: kept for a limited period for security and recovery, then deleted or overwritten.
7. Your rights
Under UK data protection law you have the right to:
access the personal data we hold about you;
rectify inaccurate or incomplete data;
erase your data ("right to be forgotten"), where applicable;
restrict or object to certain processing, including profiling;
data portability (receive your data in a portable format); and
withdraw consent at any time where we rely on it.
You can delete your account in the BUNCH mobile app: You › Delete account.
To exercise any of these, email hello@bunch.cc. We'll respond within the time the law allows (usually one month). You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) - though we'd appreciate the chance to help first.
8. Children
The Service is intended for people aged 18 and over. We do not knowingly collect data from anyone under that age. If you believe a child has given us personal data, contact us and we will delete it.
9. Security
We use technical and organisational measures to protect your data, including access controls at the database level (row-level security), encrypted connections, and keeping secret keys off user devices. No system is perfectly secure, but we work to protect your information and will notify you and the ICO of a breach where the law requires.
10. Changes to this policy
We may update this policy as the Service develops. We'll post the updated version and, for material changes, take reasonable steps to tell you.
11. Contact
Privacy questions or requests: hello@bunch.cc, BUNCH APP Ltd, Suite RA01, 195-197 Wood Street, London E17 3NU.