About
Privacy Policy
Effective date: September 30, 2026
This Privacy Policy explains what information bikelanebumps.org and the BumpWatch watch app — available for Apple Watch on the App Store, and for Wear OS on Google Play as "Bike Lane Bumps" (together, "BumpWatch," "we," "us," or "our") — collect, how it's used, and how it's shared. There is no account or sign-up for either the app or the website — most of what follows is simpler as a result.
1. Information We Collect
From the BumpWatch watch app
When you use BumpWatch to record a ride, the app collects and uploads:
- Location data: GPS coordinates, accuracy, speed, and direction of travel at the moment each bump is detected.
- Route: GPS points sampled roughly every 20 meters along the ride, so the map can show which streets have actually been ridden. Every point within 150 meters of the ride's first and last point is removed before it's stored, so a route doesn't reveal exactly where a ride began or ended.
- Bump data: the severity (peak acceleration) and timestamp of each detected bump.
- Heart rate: your heart rate at each detected bump, and the ride's average and maximum heart rate.
- Ride metadata: a randomly generated ride ID, along with the ride's start and end time and total bump count.
- Anonymous app ID: the app signs in with Firebase Anonymous Authentication, which creates a random ID for your installation of the app — with no name, email, or account behind it. We record which ID submitted each ride so we can deal with abuse and handle removal requests. It's stored privately, separate from the public ride data, and isn't shown on or readable from this website.
We do not collect your name, email address, Apple ID, Google account, phone number, or any hardware device identifier.
BumpWatch uses your watch's accelerometer continuously while recording to detect bumps, but that raw motion stream is processed on your watch and never leaves it — only the individual bump events described above are uploaded.
On Apple Watch, BumpWatch starts an Apple HealthKit workout session while recording, which is what lets it keep tracking your ride in the background. This creates a normal workout entry in your own Health app, including the ride's route map, the same as any fitness app would. During the ride, the app reads the heart rate, distance, and active calories HealthKit collects for that workout, to show them on your watch and to upload the heart rate values listed above. We don't read any of your other Health data, and the workout entry itself is never sent to us.
On Wear OS, BumpWatch uses Google's Health Services to run an exercise session while recording, and reads the heart rate, distance, and calories it measures during that session — again, to show them on your watch and to upload the heart rate values listed above. The app doesn't read from or write to Health Connect or any other stored health data. While a ride is recording, the app shows an ongoing notification so it can keep running in the background.
On both platforms, distance, calories, and elevation gain are shown on your watch only and are not uploaded.
From bikelanebumps.org
The website reads the public ride and bump data described above to render the heatmap and stats. If you allow it, your browser's own location (used only to center the map on your area) is requested through your browser's native permission prompt — that location is used entirely on your device to position the map and is never sent to us or stored anywhere.
The home page shows ads served by Google AdSense. Google and its partners may use cookies to serve ads based on your visits to this and other websites. You can opt out of personalized advertising in Google's Ads Settings, and read more about how Google uses information from sites that show its ads at policies.google.com. Apart from those ads, this website doesn't use accounts or analytics trackers and doesn't set cookies of its own.
2. How Information Is Used
Ride and bump data is used for exactly one thing: rendering the public heatmap, the summary stats, and the ranked list of priority stretches on this site.
3. How Information Is Shared
Everything submitted is public. Because there's no account system, there's no private view of ride data — everything a ride uploads through BumpWatch, as listed above (including exact GPS locations, the route, and heart rate), is publicly readable by anyone who visits this site or queries its database. The one exception is the anonymous app ID, which is stored privately and never made public. If you're recording rides on routes that could identify you (like the streets right around your home), keep in mind that data is visible to anyone.
Service providers: Ride and bump data is stored using Google Firebase (Authentication, Cloud Functions, and Cloud Firestore), hosted on Google Cloud infrastructure. Google acts only as our infrastructure provider for that data and does not use it for its own purposes. Ads on the home page are served by Google AdSense, as described above. The website's map tiles are served by CARTO, built from OpenStreetMap data; the mapping library (Leaflet) is loaded from a public CDN (unpkg.com). Requests to these third parties are subject to their own standard server logging.
We do not sell data, and we don't share it with anyone for advertising or marketing purposes.
Legal requirements: We may disclose information if required by law.
4. Data Retention and Removal
Ride and bump data is kept indefinitely, since the map's value comes from building up a complete picture over time. Because data isn't tied to an account, we can't look it up by who submitted it — if you'd like a ride removed, email us with the approximate date, time, and route, and we'll do our best to locate and remove it.
5. Security
Ride data is uploaded over HTTPS and written to Firestore through a Cloud Function that only accepts uploads carrying a valid sign-in token from the app's anonymous sign-in (older app versions use a key embedded in the app instead) — it isn't written to the database directly by any client. Firestore's own access rules allow public read access (so the map can load without an account) but block public write access entirely. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.
6. Children's Privacy
BumpWatch isn't directed at children, and since it doesn't collect names, emails, or any other personal identifiers from anyone, there's no age-gated account data to speak of.
7. Changes to This Policy
We may update this policy from time to time. If we make material changes, we'll update the effective date above.
8. Contact Us
Questions about this policy, or a data removal request, can be sent to:
This document is provided for informational purposes and is not legal advice. If you have questions about how it applies to your specific situation, consider consulting an attorney.