Privacy policy
Draft. This policy describes how DeisBikes works today and is pending review by Brandeis University. It will be finalized before the app is publicly released.
What we collect
- Account: your Brandeis email, name and phone number, your role, and whether you've accepted the rider agreement and completed the safety course (with dates).
- Rides: which bike, start and end times, and where the ride started and ended.
- Bike location during rides: the bike's smart lock (made by LINKA) reports its own GPS position and status to LINKA and to us while it's unlocked and moving. This can show the route a bike took during your ride.
- Reports: problems you report, including any photos you attach. Photos are re-encoded on your phone before upload, which removes location metadata.
- Unlock records: when a bike was unlocked or locked and by whom, for safety and theft investigations.
We don't collect payment information, Social Security numbers or government ID numbers, and we don't use advertising or tracking SDKs.
How we use it
- To run the service: approve accounts, unlock bikes, enforce ride time limits and the campus boundary.
- To keep bikes safe and working: maintenance, battery alerts, and recovering lost or stolen bikes.
- To contact you about your ride or account, for example an overdue ride.
- To understand usage in aggregate (for example, rides per day) and report to Brandeis.
Who can see it
- You can see your own account and rides.
- DeisBikes staff see what their role needs: maintenance crew see bikes and reports; fleet managers also see rides and accounts; admins manage settings and roles. Staff accounts require two-step sign-in.
- Brandeis University Police, if a bike is reported lost or stolen or as required by law.
We don't sell your data.
Service providers
We use Supabase (database and sign-in), Vercel (website and staff dashboard), Resend (email), LINKA (smart locks and their location reports), and Apple and Google (app distribution, maps and notifications). They process data only to provide their service to us.
How long we keep it
- Ride start and end locations are deleted after 90 days. Ride records without locations are kept longer for safety and reporting.
- Sent notification records are deleted after 90 days.
- Your account is kept until you delete it or it's removed by the DeisBikes team.
Your choices
- Location: the app asks for location while you use it. Ending a ride needs it.
- Notifications: ride reminders are optional and can be turned off in your phone's settings.
- Deleting your account: see Delete your account.
Security
Access to data is enforced by the database itself, not just the apps. Data is encrypted in transit, staff accounts use two-step sign-in, and sensitive actions are logged.
Contact
Questions or requests: deisbikes-support@brandeis.edu.