Privacy Policy

Rider's Route S.R.L. is the controller of the personal data processed through the Services. We are a limited liability company incorporated in Romania, with our registered office at Str. Bega nr. 47, Ghiroda, Timiș County, Romania, registered with the Trade Register under no. J2026038748004 (EUID ROONRC.J2026038748004), sole registration code (CUI) 54898440, VAT number RO54898440.

For anything relating to your personal data or to this policy, write to contact@ridersroute.app. We have not appointed a Data Protection Officer, as we are not required to; this address reaches the people responsible for data protection.

This policy covers both surfaces of Rider's Route and applies to users worldwide:

• the App — the Rider's Route mobile application for iOS and Android;
• the Website — https://ridersroute.app, including the public route catalogue, the Help section, the contact form and the account deletion request form.

We comply with the EU General Data Protection Regulation (GDPR) and Romanian data protection law (Law no. 190/2018). Storage of and access to information on your device is governed by the ePrivacy Directive as transposed by Romanian Law no. 506/2004 — see the Cookie Policy. A separate section below covers the rights of residents of US states with comprehensive privacy laws.

Account and identity

Your email address, a hashed password (handled by our authentication provider, Supabase Auth — we never store or see your plain-text password), and your name as given at sign-up. If you use Sign in with Google, we receive basic identity information from Google to create your account.

Profile

What you choose to set: username, display name, bio, city, avatar photo, riding style / rider level, and language preference. We also store an approximate home location you set, used to show nearby routes and rides in your feed.

Vehicle data

When you add a motorcycle to your Garage: make, model, year, engine size, category and nickname, plus any photos you upload. You may also record the licence plate and vehicle document details used for maintenance reminders — inspection (ITP), insurance (RCA) and registration expiry dates, service intervals, odometer readings, chain mileage, and the registration certificate (CIV) number.

Ride records

When you record a ride we collect precise GPS location (see section 6) and derive the full GPS track (stored as a GeoJSON file), speed (average and maximum), elevation profile, timestamps, distance, duration and derived statistics such as estimated calories.

Social graph and user content

Who you follow and who follows you, salutes exchanged, reactions and comments, reviews and ratings, routes you create, routes you save, and photos attached to rides, stops or routes.

Device and technical data

Your push notification token and platform, app version, operating system and device information, IP address as seen by our infrastructure and diagnostics providers, and crash, error and performance diagnostics.

Consent records

When you accept the Terms and this policy at sign-up, we record which document versions you accepted and when, as a compliance audit trail.

Support and reports

If you contact us or report content or a user, we keep the communication and what you provided in it — for reports, the reason, any details you add, and identifiers of the reported content or account.

You can browse the Website, including the public route catalogue, without an account. What we process depends on what you do.

Contact form

The name, email address and message you submit. These are emailed to our support inbox through Resend so we can reply. We do not use them for marketing.

Account and data deletion requests

The email address of the account to delete, an optional reason, and your confirmation. We use these to identify the account and carry out the erasure, and we keep a record of the request and its outcome as proof that we honoured it.

Cookies and analytics

A consent cookie recording your cookie choices, a language cookie, and — only if you consent — Google Analytics cookies measuring aggregate use of the site. Full details, including a live scan of what is stored in your own browser, are in the Cookie Policy.

Maps

Route maps in the catalogue are rendered from base map tiles served by Mapbox using OpenStreetMap data. Loading a map means your browser contacts Mapbox directly, and Mapbox receives your IP address and basic request information as a technical necessity of delivering the tiles. See the Mapbox privacy policy.

Server logs

Our hosting provider, Vercel, records standard request data — IP address, timestamp, requested URL, referrer, user agent and response status — to deliver the site, keep it secure and diagnose faults.

Administration area

The Website has a restricted administration area used by our team to publish routes. It sets a Supabase authentication cookie for signed-in administrators. It is not accessible to the public and processes no visitor data.

Where we rely on consent you may withdraw it at any time — by revoking the device permission, or through the cookie settings on the Website. Withdrawal does not affect processing carried out before it, but it will limit the corresponding functionality.

Where we rely on legitimate interests, we have weighed them against your rights and freedoms, and you may object at any time (see section 12).

Location is central to what Rider's Route does, so it deserves its own explanation.

The App collects foreground location (while the App is open) and background location (while it is minimised or your screen is locked) exclusively to record the path, speed and elevation of the rides you choose to track, and to provide turn-by-turn guidance during an active ride.

We request background access because a recording session may continue while your phone is in your pocket or you are using other apps. We use this data only for your ride — never for advertising, profiling, or building a location history unrelated to the rides you record.

What stays private and what becomes visible

• Your full-resolution GPS track file is private and accessible only to you.
• If — and only if — you publish a ride, an approximate, reduced-resolution route line, including its start and finish area, becomes visible to other users. A ride you keep private is shown to no one.
• Published routes may also appear in the public catalogue on the Website, where they can be seen by anyone and indexed by search engines.

You can disable foreground location, background location or both at any time in your device settings. Without location you cannot record rides, but you can still browse routes, manage your garage and use the social feed.

We do not sell your personal data and we do not share it with advertising networks or data brokers. Disclosure happens only as follows.

Other users

Content you publish is visible to others: your public profile (username, display name, bio, city, avatar, riding style and statistics), routes you create, published ride summaries and their approximate route lines, reviews and comments. Please consider that before publishing.

The public Website

Routes published to the catalogue are visible to anyone on the internet, without an account, and may be indexed by search engines and shown in link previews when shared.

Service providers

The processors listed in the next section, acting only on our instructions.

Legal disclosures and business transfers

We may disclose data to public authorities, courts or law enforcement where required by law or legal process, or where necessary to prevent imminent harm, fraud or illegal activity. If we are involved in a merger, acquisition or asset sale, data may transfer as part of it, subject to this policy.

These providers process personal data on our behalf, under data processing agreements and only on our instructions. Which ones apply depends on which surface you use.

Rider's Route S.R.L. is established in Romania, in the EU. Some processors handle data on servers outside the European Economic Area, including in the United States. Where that happens, the transfer relies on one of the safeguards recognised by Chapter V GDPR:

• an adequacy decision — for recipients in the United States certified under the EU–U.S. Data Privacy Framework, on the basis of the European Commission's decision of 10 July 2023;
• the European Commission's Standard Contractual Clauses, supplemented where necessary by additional technical and organisational measures, for every other transfer.

You may request a copy of the safeguards applying to a specific transfer by writing to contact@ridersroute.app.

We may keep limited data for longer where the law requires it, or to establish, exercise or defend legal claims. In every case we keep only what is necessary for the specific purpose.

If you are in the EEA, you have the right to:

• access — obtain a copy of the personal data we hold about you;
• rectification — have inaccurate or incomplete data corrected;
• erasure — have your data deleted, subject to lawful exceptions;
• restriction — have processing restricted in certain circumstances;
• portability — receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• object — object at any time to processing based on our legitimate interests, on grounds relating to your particular situation;
• withdraw consent — where we rely on it, at any time, without affecting the lawfulness of prior processing.

How to exercise them

Email contact@ridersroute.app, delete your account in the App at Settings → Account → Delete Account, or use the Account & Data Deletion page. We answer within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. Exercising your rights is free; we may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive.

We may need to verify your identity before acting — normally by confirming the request from the email address on the account.

Complaining to a supervisory authority

You may lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul General Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, Romania — https://www.dataprotection.ro. You may also complain to the supervisory authority in your EU country of residence or place of work.

This section applies if you live in a US state with a comprehensive consumer privacy law — including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, New Jersey and others as their laws come into force.

What we collect

In the past 12 months we have collected: identifiers (name, email, username, account and device identifiers); geolocation data (precise GPS tracks for the rides you record); internet or network activity (app and site usage, diagnostics); audio/visual information (photos you upload); and inferences limited to ride statistics and content relevance. We do not collect government-issued identification numbers and we do not knowingly collect data from minors.

No sale, no sharing

We do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA as amended by the CPRA and under comparable state laws. We use no advertising trackers and no data brokers.

Your rights

You have the right to know and access, to delete, and to correct your personal information; to opt out of sale, sharing and targeted advertising (not applicable, as we do none); to limit the use of sensitive personal information; to appeal a refusal where your state's law provides for it; and not to be discriminated against for exercising any of these.

Global Privacy Control

The Website honours the Global Privacy Control signal. If your browser or an extension sends GPC, we treat it as a valid opt-out of sale and sharing and disable marketing cookies automatically, with no further action from you.

To exercise a right, email contact@ridersroute.app or delete your account in the App. You may use an authorised agent; we verify requests through the email address on the account.

We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing within the meaning of Article 22 GDPR.

The App ranks and personalises your feed — for example by favouring routes near the home location you set, or content from riders you follow. This is content relevance ranking. It produces no legal or similarly significant effect, is not used to profile you for advertising, and you can influence it by changing your home location, who you follow, and your preferences.

Where automated means are used in a content moderation decision, we tell you so in the statement of reasons required by the Digital Services Act — see section 8 of the Terms & Conditions.

Rider's Route accounts are for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that a user is under 18, we will close the account and delete the associated data promptly.

If you believe someone under 18 has given us personal data, write to contact@ridersroute.app and we will act.

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. In particular:

• all traffic to the App and the Website is encrypted in transit with TLS;
• passwords are stored hashed, never in plain text, and we cannot read them;
• private files — your GPS tracks, vehicle documents and photos — are access-controlled to your account;
• database access is governed by row-level security policies, so one account cannot read another's private data;
• privileged credentials are held server-side only and are never exposed to the browser or the app bundle;
• the administration area of the Website requires authentication and is restricted to our team.

No method of transmission or storage is completely secure and we cannot guarantee absolute security. Keeping your own credentials confidential is your responsibility.

Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours, and we will inform you directly where the risk is high.

We may update this policy. When changes are material we will publish the revised version with a new version number and effective date and, where appropriate, notify you in the App or by email. Continued use after the effective date constitutes acceptance of the revised policy.

Earlier versions are available on request.

For any question, concern or request about this policy or your personal data:

• Rider's Route S.R.L.
• Str. Bega nr. 47, Ghiroda, Timiș County, Romania
• Trade Register no. J2026038748004 · EUID ROONRC.J2026038748004
• CUI 54898440 · VAT RO54898440
• Email: contact@ridersroute.app