Privacy policy

MotoTrails is a logbook for motorcyclists: it records and imports GPS tracks, shows them on a map, helps you plan a ride and follow it, and lets you share tracks with a link. This page explains which data we process, why, for how long, and what rights you have, under Regulation (EU) 2016/679 (GDPR).

Data controller

Emanuele Chiavelli · [email protected]

In short

• Your rides, points and places are private: only you can see them, until you create a link.
• We use your location only while you record or navigate.
• No advertising, no profiling, no analytics, no sale of data.
• You can delete everything, at any time, from the app or the website.

What data we process

• Account: your email address and, if you sign in with Google or Apple, the name and identifier they pass on to us. If you use email and password, the password is kept only by Firebase in an irreversibly hashed form and nobody can read it. We also record whether the account was created from the website or from the app and the user-agent at that moment, to understand how people sign up and to protect the service from abuse.
• Tracks: the GPS positions recorded with the app or contained in the GPX files you import, with the date and time, elevation, speed and accuracy of every point (and, on Android phones that have the sensor, the measured atmospheric pressure, which is used to correct the elevation), the ride title and the GPX files you uploaded. If you import other people's tracks, make sure you are allowed to.
• Planned rides and navigation: the routes you generate or save, the waypoints and the manoeuvre points. When you follow a ride with navigation, together with the recorded track we keep the guidance events (leaving the route, rejoining it, manoeuvres made or missed), which help show how the ride went.
• Content: your points of interest with their notes, and the ratings you give to roads.
• Saved places: the places you choose to save in the route generator (name and position, at most 10). Only you can see them.
• Share links: the stretch of track you chose, the title, the points of interest included and the number of visits. Of the visits we count only the number: we do not record who opened the link.
• Subscription: from Apple or Google we receive the subscription status, its expiry date and a purchase identifier. We do not receive or see your payment details: the payment is handled by Apple or Google under their own policies.
• Technical data: a session cookie, needed to stay signed in to the website, and two preference cookies, lingua and tema, which remember the language and look you chose. They are not profiling cookies.

We use no analytics tools, no advertising cookies and no tracking pixels, we do not profile you and we do not sell data to anyone. We do not collect health data or heart rate.

Location in the app

The app uses your location only while you record a ride or follow a navigation, from the moment you tap RECORD or Navigate to the moment you stop, including with the screen off or the app in the background. While you record, the system shows a notification (on Android) or a Live Activity (on iPhone) with the ride's data, to remind you that recording is on. You can revoke the permission at any time in your phone's settings.

Data on your phone

Recorded points stay on your phone until they are uploaded to the server, and are then removed. If you have no active subscription, your rides stay on the phone and are uploaded when the subscription resumes. The app also keeps on the phone a copy of your archive (list of rides, track shapes, details, points of interest and links) and the navigation packages you downloaded, so that it opens faster and works without a network. This data lives in the app's private area and is deleted when you sign out of the account.

Why, and on what legal basis

• To provide the service you asked for (account, tracks, map, planning, navigation, sharing, subscription): performance of the contract, Art. 6(1)(b) GDPR.
• To protect the service against abusive access, keep backups, provide support and improve the route generator with aggregated data: legitimate interest, Art. 6(1)(f) GDPR.
• To comply with legal obligations, when required (for example accounting ones, or those from an authority): Art. 6(1)(c) GDPR.

Where the data is, and who processes it

The data is stored on a server in Italy run directly by the controller. To make the service work we rely on these providers:

• Cloudflare: traffic to mototrails.app passes through its network, which sees the IP address and the technical data of the request.
• Google Firebase Authentication: handles account sign-in (email, name, sign-in method identifier and technical data for security) and sends the confirmation and password-reset emails.
• Google and Apple, if you choose to sign in with their account, under their own policies. With Apple you can hide your email: in that case we receive a relay address.
• Apple App Store and Google Play, for buying and managing the subscription: they tell us the subscription status and we check it with them.
• CARTO and Esri: they provide the map and satellite imagery. Your browser or the app downloads it directly from them, and they see the IP address and the map area requested.
• OpenStreetMap Nominatim: when you search for a place by name, the search text goes from our server to this service, which sees the text but not who wrote it: the IP address it receives is our server's.
• unpkg: provides the website with the library that draws the map, and sees the IP address of whoever opens the site.

Route and navigation calculation runs on our own servers, with OpenStreetMap data: the positions you choose for a ride are not sent to third-party services.

Some of these providers may process data in the United States, on the basis of the EU-U.S. Data Privacy Framework or of the European Commission's standard contractual clauses. Our technical logs do not record visitors' IP addresses.

Support and account access

To resolve a problem you report to us, the service administrator can view your account as you see it. This is read-only by default; changes are enabled only when needed to resolve your request. Every access is logged: who, when, from which IP address and device, for how long and which changes. It gives no access to your password or payment methods. The log serves to ensure the access was legitimate and is kept for 12 months, even if you delete the account in the meantime, and is then deleted.

Aggregated road data

To suggest routes riders like, we count which roads the archived rides pass through. The count is per road, not per person: for each road we only keep how many different users have ridden it, and only roads ridden by at least 5 different users make the list. The list contains no dates, times, rides or accounts: it is not possible to tell who rode what.

This data feeds the route generator and will only be used once there is enough of it to be meaningful. The basis is legitimate interest (Art. 6(1)(f) GDPR) in improving the service. You can object at any time by turning off “Contribute to aggregated data” in the app's Settings or in the account menu on the website: your rides leave the count right away.

Security

The connection is encrypted (HTTPS). On the phone, your sign-in is kept in the system's protected storage (Keychain on iPhone, encrypted storage on Android). Backups are encrypted. No measure is absolute: if an incident affecting you occurs, we will notify you as the law requires.

For how long

• Your account data and your content stay until you delete the account. If you do not sign in for 24 months we warn you by email; if you do not sign in within the following 30 days either, the account and all its data are deleted. An active subscription counts as use.
• You can delete the account at any time, from the app (Settings › Account) or from the website: account, tracks, points of interest, links, navigation data and uploaded GPX files are deleted right away.
• Share links expire after 30 days, unless renewed.
• Backups, which are encrypted, are overwritten within 6 months. Until then they may contain data that has already been deleted, and they are used only to restore the service after a failure.
• Apple and Google keep the purchase data under their own rules: deleting your MotoTrails account does not cancel the subscription, which you cancel in the store's settings.
• The support-access log is kept for 12 months, as stated above.

Your rights

You can ask for access to your data, for its rectification, erasure, the restriction of processing and its portability, and you can object to the processing, by writing to [email protected]. We answer within one month. Many of these things you can do yourself in the app: export your rides as GPX, delete content or the whole account.

You can also lodge a complaint with the supervisory authority of the country where you live or work, or of the place where you believe the infringement took place. In Italy it is the Garante per la protezione dei dati personali; the list of every European authority is on the EDPB website.

Minors

You must be at least 14 years old to register.

Changes

If this policy changes in a significant way we will say so in the app, on the website or by email at least 30 days before the changes take effect. The date at the top marks the latest version.