Who we are
Disciples of Dirt is a volunteer-run, non-profit mountain bike advocacy and trail-work club based in Eugene, Oregon. This policy covers the member portal at this domain and the data we collect when you create an account, sign the annual waiver, log trail-work hours, or have your membership verified at a partner bike shop.
What information we collect
We try to keep what we collect proportional to what the club actually needs to operate. That means:
Account data. Your email address, full legal name, the member code you were issued, your member type, and the role grants the board has assigned to your account (member, bike shop, fulfillment, admin).
Mailing address. Optional. We only ask for it when you place a merch order so we can ship things to you.
Waiver signatures.Each year you sign the annual liability waiver, we record your typed signature, the IP address the request came from, your browser’s user agent string, and the exact timestamp. The federal ESIGN Act requires that electronic signatures be retainable and attributable, so these fields are non-optional.
Trail-work hours.Trail-work is logged in TrailWerk, a separate system run by trail organizations across the region. The portal reads your hour totals from TrailWerk for display; we don’t collect your check-in location, tool list, or anything else from those events.
Authentication tokens.Supabase Auth issues a session token when you sign in. The token lets us tell who you are on subsequent requests; we don’t use it for anything else.
How we use it
We use member data to verify membership status, prevent duplicate accounts, satisfy the ESIGN Act’s retainability requirement for the annual liability waiver, send transactional emails (account confirmation, password reset, waiver confirmation, dues reminders), and let authorized bike shops verify your membership at the point of service. That’s the whole list. We do not profile members, sell ad inventory, or build behavioral models off portal activity.
Who we share it with
Three vendors process member data on our behalf:
Supabase hosts the Postgres database and handles authentication. They are US-based.
Resend delivers transactional email. They receive the recipient email address and the message body for each email we send.
Vercel hosts the web application itself and receives the standard server-side request metadata (IP, user agent, URL path) that any web host receives.
We do not work with advertising vendors. We do not sell member data — not now, not ever. If a court order or valid legal process compels disclosure we’ll comply, but we’ll narrow what we hand over to the minimum the order requires.
How long we keep it
Waiver signatures we keep indefinitely. They are the legal record that you accepted the participation agreement, and we may need to produce them years after the fact.
Member account data we keep until you ask us to delete it or until your account has been inactive for three years, whichever comes first.
The audit log— the internal record of administrative actions taken in the portal — is kept indefinitely. It exists specifically so the board can reconstruct what happened if something goes wrong.
Your rights
You have the right to access the data we hold about you, correct anything that’s wrong, and request deletion. Email the board at board@disciplesofdirt.org and we’ll respond within a reasonable window. Deletion requests for an active member will end your membership; we can’t maintain a membership record without a corresponding identity record.
Children
The portal and the underlying club membership are for adults 18 and over. If you believe a minor has created an account, please email the board so we can remove it.
Changes
If we make material changes to this policy we’ll update this page and notify active members by email before the changes take effect.
Last updated
. This is the initial version of the policy; the board will publish a lawyer-reviewed revision before the next membership cycle opens.