Privacy Policy

Last updated: July 15, 2026

This Privacy Policy explains how PassBy ("we", "us", "the app") collects, uses, and protects your information when you use the app. PassBy is operated by ADD Studios (Netherlands). If you have any questions, contact us at hello@addstudios.nl.

PassBy lets an athlete share their live location during a sports event so that supporters can follow along and see an estimated time of arrival. Two roles use the app: the athlete (the person being tracked) and the supporter (the person following a ride through a shared link).

Who is responsible for your data

ADD Studios is the data controller for the personal data described in this policy. You can reach us at hello@addstudios.nl.

What data we collect

Athlete account

To share a ride, the athlete signs in. On iOS this uses Sign in with Apple; on Android it uses Google Sign-In. When you sign in we store an account identifier provided by Apple or Google (a Firebase Authentication user ID). If you sign in with Apple and choose to share your email, Apple may provide a private relay email address, which is stored with your account. We do not receive or store your password; authentication is handled by Apple and Google.

Supporters stay anonymous

Supporters do not sign in and are not asked for any personal details. The app gives each supporter an anonymous, random identifier that contains no personal information, used only so the app can read ride data.

Location data

When an athlete starts a ride, the app collects the athlete's device location (GPS coordinates and speed) and shares it in real time so that supporters who have the ride link can follow the ride and see an ETA. Location is only collected while a ride is active and with your permission.

The app does not stop tracking automatically. Location sharing continues until you end the ride yourself by tapping Finish in the app. This is intentional, so that a ride is never cut off during a rest, a mechanical problem, or an emergency. You stay in control of when tracking stops.

On the supporter side, if you grant location permission, the app uses your device location on your device to calculate the athlete's ETA relative to your position. This supporter location is not uploaded to our servers or shared with anyone.

Route data

An athlete can load a route file (GPX) for a ride. The route coordinates are stored with the ride so the shared map and ETA can be shown to supporters.

Diagnostic data

To keep the app stable we use Firebase Crashlytics, which may collect crash reports and basic technical information (such as device type, operating system version, and app state at the time of a crash). This helps us find and fix problems.

How we use your data

• To provide the core service: sharing an athlete's live location and calculating an ETA for supporters.
• To identify a ride's owner, so only the athlete who created a ride can change or delete it.
• To keep the app secure and stable, and to diagnose crashes.

Legal basis (EU/EEA users)

We process your data on the following bases under the GDPR: performance of the service you request (sharing and following a ride), your consent (for device location, which you can withdraw at any time in your device settings), and our legitimate interest in keeping the app secure and stable.

Third parties we use

We use the following service providers to run the app:

• Firebase (Google): Firebase Authentication for sign-in, Firebase Realtime Database to store and share ride data, and Firebase Crashlytics for crash reporting.
• Apple: Sign in with Apple, used for athlete sign-in on iOS.
• Google: Google Sign-In, used for athlete sign-in on Android.

We do not sell your personal data, and we do not use it for advertising.

Data retention and automatic deletion

Ride data is temporary and is removed automatically:

• Finished and cancelled rides are removed after a short period.
• Active rides are removed once they have been inactive for a period of time.
• Planned rides are removed after their planned start time has passed, and any planned ride belonging to a deleted account is removed automatically.

This clean-up runs on a daily schedule, so residual ride data is removed within a short retention window (typically within a few days) rather than kept indefinitely. Your account identifier is kept only while your account exists. When you delete your account, it is removed as described below.

Deleting your account and data

Athletes can permanently delete their account from within the app, at any time, in the account screen. When you delete your account, we sign you out, revoke the sign-in connection with Apple or Google, remove the ride sessions stored on your device, and delete your account identifier. Remaining ride data is removed automatically by the scheduled clean-up described above.

Your rights

If you are in the EU/EEA, you have the right to access, correct, or delete your personal data, to restrict or object to its processing, and to data portability. You can exercise most of these rights directly in the app (see "Deleting your account and data") or by contacting us at hello@addstudios.nl. You also have the right to lodge a complaint with your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens.

Children's privacy

PassBy is not directed at children and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, contact us and we will remove it.

Data security

We use industry-standard measures provided by our service providers to protect your data. However, no method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security.

International transfers

Ride data is stored on Firebase servers in the European region. Our sign-in providers (Apple, Google) may process authentication data in other countries under their own privacy policies and applicable safeguards.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Significant changes will be communicated where appropriate.

Contact us

If you have questions about this policy or your data, contact us at hello@addstudios.nl.