Privacy Policy

2.1 Authentication

Throttl supports Sign in with Apple, Sign in with Google, and phone number authentication. We do not offer email/password account creation. We never receive or store your identity provider password. Phone authentication uses a one-time SMS verification code — we do not store the code after verification.

2.2 Information We Do Not Collect

We do not collect:

5.1 Service Providers

We use the following third-party services to operate Throttl. Each processes your data only as directed by us, under data processing agreements, and only to the extent necessary to provide their service.

5.2 Other Users

Your name, profile photo, bike photos, and approximate location (city/area) are visible to other Throttl users. Your email address is never shown to other users.

Event data you create is visible to users who view or RSVP to your events. Messages in event chats are visible to all event participants. 1:1 messages are visible only to you and the recipient.

Links you add to your Instagram or TikTok profiles in your Throttl profile are visible to all other riders who view your profile.

If you are a Throttl Premium subscriber, you can see a list of users who have viewed your profile. This means other premium subscribers can see when you view their profile.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Marshal Labs, our users, or the public. We will notify you of such disclosures where legally permitted.

5.4 Business Transfers

If Marshal Labs LLC is acquired, merges with another entity, or transfers substantially all of its assets, your information may be transferred as part of that transaction. We will post an updated privacy policy and provide in-app notice before your information becomes subject to a materially different privacy policy.

6.1 Per-Category Retention Schedule

6.2 Anonymization

"Anonymized" means all directly identifying fields (name, email, user ID linkage, profile photos) have been removed or replaced with a generic label such as "Former Member." Anonymized records cannot reasonably be re-linked to you.

7.1 Deletion Process

Immediately upon your deletion request: Your profile is hidden from rider discovery and is no longer visible to other users. Future events you created with no RSVPs are deleted immediately. Shared links to those events will return a not-found error.

During the 30-day soft-delete window: Your account data is preserved in a hidden state to allow for accidental deletion recovery. Contact support@getthrottl.com to restore your account during this window. Future events with RSVPs remain visible to attendees during this window and are deleted when the window closes.

After 30 days (hard delete): All remaining personal data is permanently deleted, including: your authentication service record; push notification tokens; database profile and account records; profile photo and bike photos held by our file storage provider; your subscriber record with our subscription management provider.

7.2 Event Handling at Deletion

At the time of deletion, you may choose to also delete future events you created. Past events are anonymized — your name is replaced with "Former Member" — to preserve other attendees' content and messages. The following rules apply:

7.3 Financial Records After Deletion

When you delete your account, your subscriber record with our subscription management provider (the link between your user identity and subscription status) is deleted as part of the hard-delete process described above. However, anonymized financial transaction records (purchase dates, amounts, and subscription periods) are retained by our subscription management provider for 7 years from the transaction date to comply with US federal tax law and Canadian GST/HST requirements. These records are not linked to your App profile after deletion.

7.4 Processing Time

We will acknowledge account deletion requests within 45 days of receipt and complete deletion promptly thereafter.

8.1 Free Accounts

Notice at 21 months of inactivity: Push notification and in-app notice.

Purge at 24 months of inactivity: Your account becomes subject to deletion, and account and associated data are deleted using the same process described in Section 7.

8.2 Premium Accounts

Notice at 33 months of inactivity (or 21 months after subscription expiry, whichever is later): Push notification and in-app notice.

Purge at 36 months of inactivity, or 24 months after subscription expiry, whichever is later: Your account becomes subject to deletion.

8.3 Pausing and Resetting the Purge Clock

A pending data portability request pauses the purge clock until the request is fulfilled. Signing in, creating content, or making a payment resets your activity date.

How to Submit a Request

Email support@getthrottl.com with the subject line "Privacy Request — [Right You Are Exercising]." Include the email address associated with your Throttl account so we can verify your identity. We will respond within 45 days. If we need additional time, we will notify you within the initial 45-day window.

You may also designate an authorized agent to submit requests on your behalf. We will require written authorization and may verify your identity directly.

13.1 Categories of Personal Information Collected (Last 12 Months)

13.2 Sources

Personal information is collected from: you directly (profile setup, content creation), your single sign-on provider or phone number (sign-in), our subscription management provider (subscription events), and our authentication and push messaging providers (device tokens).

13.3 Business Purpose

As described in Section 3. We collect personal information only for disclosed purposes — not for profiling, sale, or cross-context behavioral advertising.

13.4 Third-Party Disclosure

As described in Section 5. No personal information is sold or shared for cross-context behavioral advertising.

13.5 Sale and Sharing

We have not sold or shared any personal information in the past 12 months, and we do not intend to do so.

13.6 Sensitive Personal Information

We do not collect sensitive personal information as defined by CPRA. Approximate location data, which may qualify as sensitive under certain interpretations, is used solely to power rider discovery and event proximity features — not to infer characteristics about you. You may limit our use of this data by revoking location permission in your device settings or by contacting support@getthrottl.com; however, doing so will disable location-based features.

13.7 Your California Rights

In addition to the rights described in Section 12, California residents have the right to:

Know the specific pieces of personal information collected about them.

Limit use of sensitive personal information (not applicable — we do not collect sensitive personal information).

To exercise your rights, contact support@getthrottl.com. We will verify your identity and respond within 45 days (extendable by an additional 45 days with notice). We do not charge a fee for the first request in any 12-month period. You may designate an authorized agent to submit requests on your behalf.

13.8 Other US State Residents

Residents of Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Delaware (DPDPA), New Jersey (NJDPA), New Hampshire, Minnesota, Rhode Island, and Maryland may have rights under their respective state privacy laws similar to those described in Section 13 (California). These rights generally include the right to know what personal information we collect, the right to access and delete that information, the right to correct inaccuracies, the right to data portability, and the right to opt out of the sale or sharing of personal information or targeted advertising.

Throttl does not sell personal information, does not share personal information for cross-context behavioral advertising, and does not process personal information for profiling that produces legal or similarly significant effects. To exercise any applicable state privacy right, please follow the instructions in Section 12 (Your Privacy Rights) or contact us at the address in Section 17.

14.1 Accountability

Marshal Labs LLC is responsible for personal information under its control. Our designated privacy contact is reachable at support@getthrottl.com.

14.2 Identifying Purposes

We identify the purposes for collecting personal information at or before the time of collection. These purposes are described in Section 3 of this policy.

14.3 Consent

By creating a Throttl account using Sign in with Apple, Sign in with Google, or phone number authentication, you consent to the collection, use, and disclosure of your personal information as described in this policy. You may withdraw consent at any time by deleting your account or by contacting support@getthrottl.com, subject to legal or contractual obligations. Withdrawing consent may mean we can no longer provide the App to you.

14.4 Limiting Collection

We collect only the personal information necessary for the purposes identified in this policy. We do not collect personal information indiscriminately.

14.5 Limiting Use, Disclosure, and Retention

We use and disclose personal information only for the purposes for which it was collected, except with your consent or as required by law. We retain it only as long as necessary, as described in Section 6.

14.6 Accuracy

We take reasonable steps to keep personal information accurate, complete, and up to date. You may update your profile information directly in the App or request corrections at support@getthrottl.com.

14.7 Safeguards

We protect personal information using security safeguards appropriate to the sensitivity of the information, as described in Section 15. These include encryption in transit and at rest, access controls, and authentication via established identity providers.

14.8 Openness

This Privacy Policy is publicly available at getthrottl.com/privacy. We make information about our privacy practices available upon request at support@getthrottl.com.

14.9 Individual Access

Upon request, we will provide access to the personal information we hold about you, including what we hold, how we use it, and to whom we have disclosed it, subject to limited exceptions under PIPEDA. You may also request correction of inaccurate information. See Section 12 for how to submit a request.

14.10 Challenging Compliance

You have the right to challenge our compliance with PIPEDA. Contact support@getthrottl.com with questions or complaints. We will investigate all complaints and respond within 30 days. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

14.11 Financial Records and GST/HST

Anonymized financial transaction records (purchase dates, amounts, and subscription periods) are retained for 7 years in compliance with Canadian GST/HST requirements under the Excise Tax Act, even after account deletion. Your subscriber record with our subscription management provider (the link between your identity and subscription status) is deleted as part of the account deletion process described in Section 7.

14.12 Cross-Border Data Transfers

Your personal information is processed by the service providers listed in Section 5.1, which includes our platform-as-a-service provider, cloud hosting provider, edge content delivery and security provider, subscription management provider, in-app map rendering provider, and content-safety scoring provider. All of these processors are located in the United States; some may have subprocessors in additional jurisdictions. Section 5.1 describes these providers in more detail. By using Throttl, you consent to this transfer. We implement contractual and technical protections during such transfers.

Breach notification

If we discover a security incident that has compromised or is reasonably likely to have compromised your personal information in a manner creating a real risk of significant harm, we will notify affected users without unreasonable delay. Such notice will describe the nature of the incident, the categories of personal information affected, the steps we have taken in response, and any recommended actions you can take to protect yourself. Where required by law, we will also notify the applicable regulatory authorities, including the Office of the Privacy Commissioner of Canada (as required under PIPEDA) and the California Attorney General (as required under California Civil Code § 1798.82). You may contact us at the address in Section 12 to report a suspected security incident.