What we hold, and why.
Last updated 15 June 2026
plotholes is a crowd-sourced pothole map. We try to hold as little about you as possible, and to be plain about what we do hold. We are the data controller; reach us at tristan@triwats.com.
What we collect
- Your email — to sign you in (magic link). No passwords.
- The holes you flag — the coordinate + time of each lap you tapped, linked to your account. We do not store your route or ride file; only the flagged points.
- Strava tokens (only if you connect Strava) — encrypted at rest, used solely to read the activity you ask us to analyse. We never post to Strava.
- Anonymous analytics — coarse, aggregate counts (visits, uploads) with no personal data and no tracking cookies.
Why (lawful basis)
- Your account + analysing your rides — to provide the service you asked for.
- Adding your holes to the shared map — your explicit consent, off by default. It's a single toggle, never required to use the tool, and you can withdraw it any time. Withdrawing stops future contributions.
Cookies
One essential cookie keeps you signed in — nothing else rides on it, and there are no advertising or tracking cookies. A small preference (sound on/off) lives in your browser, not on our servers.
What's on the map
The map shows individual flagged holes as “reported” until at least three distinct riders flag the same spot, when it becomes “confirmed”. We only ever publish the points you flagged — never your raw route or ride. The road-defect datasets we share with local authorities are confirmed holes only, aggregated and k-anonymised (k≥10). You can erase your contributions any time (below).
Your rights
- See or correct what we hold — email us.
- Withdraw consent — flip the contribution toggle off any time.
- Erasure — “Delete my account & data” on your impact page erases your email, connections, tokens, and the link between you and your flags. The already-confirmed holes stay on the public map — they belong to the crowd and no longer point to you.
Retention
- Account data — until you delete it.
- Cached rides (to save Strava calls) — automatically expire within ~6 days.
- Flagged-hole points — retained as anonymous evidence; the link to you is removed on erasure.
We're a UK service and follow UK GDPR. You can complain to the ICO (ico.org.uk).