Privacy Policy

Operator: DirtDaisy LLC
Service: DirtDaisy Collective
Version: 1.2
Effective date: 7/28/26

Welcome

DirtDaisy Collective is a community centered on women and girls in mountain biking. DirtDaisy LLC ("DirtDaisy," "we," "us," or "our") operates the DirtDaisy Collective website, application, and related community services (the "Collective").

This Privacy Policy explains what information we collect, how we use and share it, and the choices available to members, parents, guardians, and other visitors. It applies to the Collective, including member accounts, profiles, ride listings, Trail Guides, Ride Memories, support requests, and related features.

It does not apply to a third-party website, app, trail system, land manager, map, weather service, social network, or other service that has its own privacy practices.

Where the Collective operates

The Collective is operated from Minnesota and may help members connect for rides and community activities throughout the United States. We apply the practices described in this policy to all members regardless of the state in which they live or ride, and any member may submit the privacy requests described in Section 9.

1. Information we collect

The information we collect depends on how you use the Collective.

Account and eligibility information

When you create or maintain an account, we may collect:

• your name, email address, login credentials, and account identifiers;
• birth month and year or other age-confirmation information;
• profile photo, city or general location, riding level, favorite trails, community roles, and other profile details you choose to provide;
• account settings, privacy choices, and communication preferences;
• acceptance records for the Terms of Service, Community Guidelines, applicable activity waiver, and other agreements; and
• information used for limited account, age, guardian-approval, or eligibility confirmation.

Please do not place a precise home address, personal phone number, school name, daily schedule, or similarly sensitive information in a public profile or post.

Teen members and guardian approvals

An individual must be at least 16 to create a Collective account. For a member age 16 or 17, we may collect:

• the teen member's account and profile information;
• the parent or legal guardian's name, email address, stated relationship to the teen, and approval status;
• information reasonably needed to record guardian approval; and
• the versions, dates, times, and context of the guardian's and teen's acceptances and acknowledgments.

Our guardian-approval process records a guardian's stated identity and stated relationship to the teen. It is a consent record. It does not conclusively verify that a person is who they say they are or that they hold legal guardianship.

Teen accounts use privacy-protective defaults. We do not publicly display a teen member's precise home address, phone number, school, or private guardian information. We retain the approving guardian's contact information privately as part of the approval record.

Children brought to rides

Children under 16 may not create Collective accounts, public profiles, directory listings, or independent memberships.

A member may bring their own child to a ride. A child brought to a ride does not register with DirtDaisy and is not a member or participant of the Collective.

We do not intentionally request child registration information or create a child registration record. We do not ask for a child's name, age, or any other detail, and we do not ask a member to tell us that a child is coming. The parent or legal guardian who brings the child is responsible for that child, as described in the Terms of Service.

The one exception is an incident. If a safety incident occurs at a ride and someone reports it to us, that report may contain information about anyone who was present, including a child. We keep incident reports as described in Section 10.

Ride activity and community participation

When you browse, create, host, join, waitlist, leave, or participate in a ride, we may collect:

• ride title, trail or meeting location, date, time, route, distance, difficulty, pace, capacity, and Ride Vibes;
• host, participant, waitlist, cancellation, and attendance information;
• ride-specific acknowledgments and applicable waiver status;
• information you provide about parking, what to bring, or trail conditions;
• incident, safety, moderation, or member-support reports; and
• community milestones, badges, ride history, or related participation records.

Ride listings are intended to help people meet in person. A trailhead or meeting location included in a listing may therefore be visible to other members and, depending on the feature and settings, may be publicly visible. A ride listing shows where a group of people plans to be at a specific time. Do not use a private residence as a ride meeting location, and consider what a listing reveals about your own routine before you post it.

Profile, Trail Guide, and garage information

You may choose to provide information such as:

• riding level, favorite trails, Trail Wishlist items, notes, and trail observations;
• bike type or other "My Garage" details;
• general city or region;
• community roles and member-since information; and
• privacy choices controlling whether certain profile fields appear to others.

Some fields are designed to be public or member-visible, while others are private by default. Review the visibility controls before saving information. "My Garage" information is private by default unless you choose otherwise.

Content and communications

We collect content you submit through the Collective, such as:

• Ride Memories, photos, captions, stories, comments, and trail observations;
• profile information and profile images;
• feedback, surveys, support requests, reports, and communications with DirtDaisy; and
• copyright, photo-removal, safety, or Community Guidelines reports.

Content posted to a profile, ride, Trail Guide, or community area may be visible to other members or the public, depending on the feature and your settings. Other people may save, copy, or reshare information they can see. Please share thoughtfully and obtain permission before posting another person's image or personal information.

Photos may contain embedded metadata, including the date, device information, or location where the photo was taken. You should remove sensitive metadata before uploading. We may process available metadata to operate, secure, or moderate the Collective.

Permission for DirtDaisy to use member content or a person's likeness outside the Collective for advertising or promotion is governed by the separate, optional Community Media License. Promotional permission is not required to become a member or participate in a ride. DirtDaisy does not use identifiable images of children under 16 in advertising, merchandise, or promotion, and does not offer a Community Media License covering a child under 16. A member's acceptance of that license applies to that member only. Because no minor media license is offered, we hold no media-consent record for a child.

Health, disability, and medical information

The Collective does not provide dedicated fields for health, medical, disability, or diagnostic information, and DirtDaisy does not intentionally request that information for ordinary ride registration. Please do not submit it unless reasonably necessary when reporting or responding to an incident.

We do not share this information with Ride Hosts or other members. See Section 4.

Technical and device information

When you use the Collective, we and our service providers may automatically receive:

• IP address, browser type, device type, operating system, and language;
• login, session, authentication, security, and error information;
• pages or features viewed, dates and times of access, referring pages, and general interaction information;
• approximate location inferred from an IP address; and
• cookies, local storage, and similar technologies needed to keep you signed in, remember settings, prevent misuse, and operate the service.

The Collective does not request continuous or background precise device location. Ride locations that you create, join, or view are different from device-location tracking and may reveal where you plan to be.

Information from others

We may receive information about you from:

• a parent or legal guardian completing a teen-account approval;
• a Ride Host or member submitting attendance, safety, conduct, or incident information;
• another person who includes you in content or submits a report; and
• service providers that support authentication, hosting, storage, security, or communications.

2. How we use information

We may use information to:

• create, authenticate, maintain, and protect accounts;
• confirm age eligibility and record guardian approval;
• provide profiles, ride listings, Trail Guides, Ride Memories, wishlists, badges, and other Collective features;
• process ride registrations, waitlists, cancellations, and activity acknowledgments;
• show information according to a member's privacy settings and the design of a feature;
• communicate about accounts, rides, safety, policy updates, support requests, and community news;
• operate, maintain, troubleshoot, improve, and secure the Collective;
• prevent spam, fraud, abuse, harassment, unsafe conduct, and violations of our policies;
• moderate content, review reports, and enforce the Terms of Service and Community Guidelines;
• respond to emergencies, incidents, legal requests, privacy requests, copyright reports, and photo-removal requests;
• maintain records of agreements, waivers, guardian approvals, and other legal or operational decisions;
• develop new features and understand how the Collective is used; and
• comply with law and protect the rights, safety, and integrity of members, Ride Hosts, DirtDaisy, and others.

We may combine information collected through different parts of the Collective when reasonably necessary for these purposes.

3. What other people can see

The Collective includes social and in-person community features. Depending on the feature and your choices, other members or the public may see:

• your name, profile photo, general city or region, riding level, favorite trail, community roles, and member-since information;
• rides you host or appear as a participant in;
• Ride Memories, comments, trail observations, and other content you post;
• badges or community milestones; and
• information included in a public or member-visible ride listing.

The Member Directory

The Collective includes a Member Directory that helps riders find one another.

The Member Directory is available only to signed-in Collective members. It is not publicly accessible, is not a publicly searchable member list, and is not indexed by search engines.

What an adult member's listing displays

When provided, the following appear in an adult member's directory listing:

• profile photo and member name
• favorite trail
• community roles, such as Ride Host, when you hold one
• member-since information

The following appear only when you choose to share them, and are controlled by your privacy settings:

• city --- a general area, not a precise address
• riding level

You may also remove your entire listing from the directory rather than adjusting individual fields. Turning off your listing does not close your account or prevent you from joining rides.

Keep in mind that a favorite trail suggests where you are likely to ride. If you would rather not signal that, leave the field blank or turn off your listing.

Members ages 16 and 17

Members ages 16 and 17 are hidden from the Member Directory by default. A teen listing appears only after both the teen member and the approving parent or legal guardian affirmatively enable directory visibility. Until that happens, none of the fields above are displayed for a teen account, whether or not the teen has filled them in.

A teen member or their approving guardian may turn directory visibility off again at any time.

Ride history

Ride participation and ride history do not appear in the Member Directory. That is not currently a directory feature. If we ever add it, we will update this policy and provide notice before the change takes effect.

Children under 16

Children under 16 do not appear in the Member Directory. They have no account, profile, or directory listing.

We will use profile privacy settings where the feature provides them, but privacy settings cannot control information another person independently posts, photographs, copies, or shares. If you want content involving you reviewed or removed, follow our Photo & Content Removal Policy or contact us.

Guardian contact information, waiver records, reports, and internal moderation records are not displayed in public profiles or listings and are not shown to other members.

4. How we share information

We may share information in the following circumstances.

With members and the public

We display profile, ride, Trail Guide, Ride Memory, and other community information according to the applicable feature and privacy settings.

With Ride Hosts and participants

A Ride Host's role is to post a ride and help the group meet. We may share information reasonably needed to coordinate a ride, such as participant names, capacity and waitlist status, general member profile information, and ride communications.

We do not share medical, health, disability, accessibility, or emergency-contact information with a Ride Host. Ride Hosts may not use participant information for any purpose other than coordinating that ride, and may not request, collect, or retain health, medical, or disability information from participants. Misuse of member information violates our Terms of Service and Community Guidelines and may result in removal of Ride Host privileges or the account.

With service providers

We use companies that help provide services such as cloud hosting, databases, authentication, file and photo storage, email delivery, security, error monitoring, and technical support. These providers may process information for us under contracts or instructions that limit how they may use it.

The Collective currently uses Supabase for core database, authentication, and storage services. Additional providers may be added or replaced as the Collective develops.

For safety, legal, and policy reasons

We may preserve, use, or disclose information when we reasonably believe it is necessary to:

• respond to an emergency or protect someone from serious harm;
• investigate a safety incident, policy violation, fraud, abuse, or security issue;
• enforce our agreements and protect legal rights;
• comply with a subpoena, court order, law, or valid government request; or
• report conduct to a land manager, emergency responder, law-enforcement agency, insurer, attorney, or other appropriate person.

We evaluate requests based on the circumstances and applicable law. We do not promise that DirtDaisy, a Ride Host, or another member will monitor communications or respond to an emergency.

During a business change

If DirtDaisy is involved in a merger, financing, reorganization, sale of assets, acquisition, dissolution, or similar business transaction, information may be reviewed, transferred, or disclosed as part of that transaction, subject to applicable law.

With your direction or consent

We may share information when you ask us to or provide separate consent. Optional promotional use of content or a person's likeness is governed by the Community Media License.

5. What we do not do

We do not currently:

• sell personal information for money or other valuable consideration;
• use personal information for cross-context behavioral or targeted advertising;
• use automated profiling to make decisions that produce legal or similarly significant effects;
• conduct criminal or similar background checks on members, Ride Hosts, or anyone a member brings to a ride;
• share member health, disability, medical, or emergency-contact information with Ride Hosts or other members; or
• collect continuous or background precise device location.

Limited account, age, guardian-approval, or eligibility confirmation is not a background check and is not a guarantee of a person's identity, character, qualifications, conduct, or safety.

If our practices materially change, we will update this Privacy Policy and provide any notice or choice required by law.

6. Cookies and similar technologies

The Collective may use cookies, local storage, and similar technologies that are reasonably necessary to:

• authenticate users and maintain sessions;
• remember preferences and privacy settings;
• protect accounts and prevent misuse;
• measure basic service performance; and
• identify and resolve errors.

Blocking necessary cookies or storage may prevent some features from working. If DirtDaisy later introduces nonessential analytics, advertising, or tracking technologies, we will update this policy and provide consent or opt-out controls when required.

7. Children's and teens' privacy

The Collective is not designed for children to create accounts. No one under 16 may open an individual account.

Children under 16 may not create Collective accounts, public profiles, directory listings, or independent memberships, and may not interact with account features.

A member may bring their own child to a ride. We do not intentionally request child registration information or create a child registration record. The child does not register, does not sign anything, and provides nothing to us. We do not ask a member how many children are coming or who they are.

Information about a child can still reach us in two ways: an incident report describing what happened at a ride, and a photo another member posts. Those are the stated exceptions, and they are covered in Section 1 and Section 10.

Because we do not intentionally request child registration information or create child registration records, a parent will ordinarily have no child registration information to access or delete. If information about their child appears in an incident report, photograph, or other member-submitted content, the parent or legal guardian may contact removal@dirtdaisy.com to request that we locate and address it.

If we learn that a child under 16 created an account, we will suspend it and delete or limit the information.

Members ages 16 and 17 require guardian approval. Guardians may contact us about the teen's approval record or exercise rights on the teen's behalf as permitted by law. Teen members may also contact us directly.

8. Your privacy choices

Depending on the feature, you may:

• review or update account and profile information;
• choose whether certain profile fields are public, member-visible, or private;
• leave a ride, remove content, or close an account;
• decline the optional Community Media License;
• withdraw future promotional permission as described in that license;
• manage email preferences, while continuing to receive necessary account, safety, legal, or ride communications; and
• request help with content involving you under the Photo & Content Removal Policy.

Removing information from your account does not always remove copies already shared by other people, preserved in records, included in backups, or retained for legal, safety, fraud-prevention, or policy-enforcement reasons.

9. Access, correction, deletion, and other privacy rights

Regardless of where you live, you may submit the requests listed below. We will respond in a manner consistent with applicable law, the nature of the request, our ability to verify it, and any legal, safety, security, insurance, or recordkeeping obligations.

Some states have comprehensive privacy laws that give residents specific rights, along with defined procedures, deadlines, and remedies. Whether such a law applies to DirtDaisy depends on that law's own applicability thresholds, and we have not confirmed that DirtDaisy currently meets those thresholds in any state. Where a law does apply to us and to you, we will honor the rights it provides on its terms. Where it does not, we will still consider the same requests as a matter of practice, but the specific procedures, deadlines, and remedies that statute provides will not apply.

Requests you may submit

You may ask us to:

• confirm whether we process personal information about you;
• provide access to or a copy of that information;
• correct inaccurate information; or
• delete information.

Requests provided where required, and considered otherwise

The following are provided where applicable law requires them, and considered as a matter of practice where it does not:

• providing certain information in a portable format;
• identifying categories of information and the purposes for which we use it;
• providing information about third parties to which information was disclosed;
• accepting a request submitted by an authorized agent on your behalf; and
• reviewing, on appeal, a decision denying a privacy request.

Because we do not sell personal information, use it for targeted advertising, or use automated profiling for significant decisions, there is no current need to opt out of those activities. If that changes, we will provide applicable controls.

To submit a request, email privacy@dirtdaisy.com with the subject line "Privacy Request." Describe your request and the account or guardian record involved.

We may ask for information reasonably necessary to verify your identity, authority, or relationship to a minor. We will use verification information only for the request and related security or legal records. Where applicable, an authorized agent may submit a request for you, but we may require proof of authorization or confirmation directly from you.

If we deny a request, you may appeal by replying to our decision with the subject line "Privacy Appeal." Where applicable law sets a response deadline, we will respond within it and explain any additional complaint options that apply. Otherwise we will respond within a reasonable time.

We will not discriminate against you for exercising an applicable privacy right.

10. Data retention

We keep personal information only as long as reasonably necessary for the purposes described in this policy, including to operate the Collective, protect safety and security, comply with law, resolve disputes, and enforce agreements.

Retention depends on the type of information:

• Account and profile information: generally kept while the account is active and for a limited period after closure to complete deletion, prevent abuse, and maintain necessary records.
• Ride and community content: kept while it remains part of the Collective or until it is deleted, removed, or no longer reasonably needed. Some information may remain in backups for a limited period.
• Policy, guardian-approval, waiver, and ride-acknowledgment records: may be retained after an account closes or a ride ends for the period reasonably necessary to document consent, address claims, and meet legal or insurance requirements. Records involving minors may need to be kept longer.
• Safety, incident, moderation, copyright, and support records: kept as reasonably necessary to investigate, protect the community, document actions, prevent repeated misuse, resolve disputes, and comply with law.
• Removal requests and related verification: records of a request made under the Photo & Content Removal Policy --- what was requested, what we decided, and what we did --- are kept as reasonably necessary to enforce the removal, handle repeat issues, and document our actions. Any information provided to confirm a requester's identity, or a guardian's authority to make a request about a child, is kept on a shorter schedule and deleted once it is no longer needed to process or defend the request.
• Optional media-consent records: kept while the consent is in effect and afterward for the period reasonably necessary to document what was permitted, when, and by whom, including after a consent is withdrawn.
• Technical and security records: kept for periods appropriate to troubleshooting, security, fraud prevention, and system integrity.

We may retain de-identified or aggregated information that cannot reasonably be linked to an individual. When deletion is not immediately possible because information is stored in a backup, we may isolate it from ordinary use until the backup is overwritten or deletion becomes practicable.

11. Security

We use administrative, technical, and organizational measures designed to protect personal information. These may include access controls, authentication, permissions, database security rules, logging, backups, and service-provider safeguards.

No online service or storage system can be guaranteed completely secure. You are responsible for using a strong password, protecting access to your email and device, and notifying us if you believe your account has been compromised.

If a security incident affects personal information, we will investigate and provide notices required by applicable law.

12. Third-party links

The Collective may link to outside resources such as land-manager websites, trail information services including TrailBot and Trailforks, map providers, weather services, or social networks.

At launch, these resources are provided as outbound links rather than Collective account integrations. DirtDaisy does not intentionally exchange Collective account information with these services merely because we link to them. When you follow an external link, your browser and the third-party service may automatically exchange technical information, such as your IP address and referring page, under that service's own privacy practices.

We include these links so you can check current trail and weather conditions before you ride. If you visit or use a third-party service, that service may collect information under its own privacy policy. DirtDaisy does not control those services or their privacy practices.

Do not treat a link, map, trail status, or other third-party resource as an endorsement or guarantee of its accuracy, privacy, availability, or safety.

13. Communications

We may send:

• account verification, guardian approval, password, security, and administrative messages;
• ride confirmations, updates, cancellations, waitlist notices, and safety information;
• responses to support, moderation, privacy, copyright, or removal requests; and
• community news or promotional messages where permitted.

You may unsubscribe from optional marketing emails using the method provided in the message. You cannot opt out of communications that are necessary to provide an account, document an agreement, protect safety, or give a required legal notice.

14. Changes to this Privacy Policy

We may update this Privacy Policy as the Collective grows, features change, or legal requirements evolve. We will post the revised policy with a new effective date and version.

If a change materially affects how we use previously collected personal information, we will provide additional notice or request consent when required. Continued use of the Collective after an updated policy takes effect means the updated policy applies to future use, but it does not replace consent where the law requires consent.

15. Contact us

For privacy questions or requests, contact:

DirtDaisy LLC Privacy requests: privacy@dirtdaisy.com Photo and content removal: removal@dirtdaisy.com Mailing address: available on request