Privacy Policy
Last updated: 2026-07-23
This Privacy Policy explains how Velaro (“we”, “us”, “our”) processes personal data when you use the Velaro mobile applications (iOS and Android) and related APIs (the “Service”).
Velaro is a social platform for motorcycle riders: you can create a profile, record GPS rides, share posts, follow other riders, join trusted groups, and optionally share live location on Explore.
By creating an account or using the Service, you acknowledge this Policy. Where required by law, we will ask for consent for specific processing.
1. Who is responsible for your data?
The data controller is:
Istvor
Poland
Email: [email protected]
If you have questions about this Policy or your rights, contact us at the privacy address above.
2. What data we collect
2.1 Account and profile
- Email address and authentication identifiers provided via Firebase Authentication (email/password, Google Sign-In, and/or Sign in with Apple)
- Handle (username), display name, bio
- Profile avatar image
- Account preferences (language, profile visibility)
- Privacy zone (map centre and radius) if you configure one
- Garage / bike information you add (name, make, model, year, photos, and related specs)
2.2 Rides and location
- GPS points and derived ride statistics when you record a ride (including distance, duration, speed metrics, elevation, and timestamps)
- Ride metadata you provide (title, description, bike used, visibility-related choices)
- Live location only while you use Explore “go live” / share location during ride recording (session-based; not stored as a permanent live track archive)
2.3 Social and feed content
- Posts you publish (including ride snapshots, captions, gallery images, visibility)
- Comments and respects (likes)
- Follow relationships (who you follow and who follows you)
- Trusted-group memberships and groups you create
- Events you create or join
- Posts you choose to hide from your feed
2.4 Device, diagnostics, and security
- App diagnostics and crash reports (for example via Firebase Crashlytics)
- Technical logs necessary to operate, secure, and debug the Service (IP address, timestamps, request metadata, error traces), retained only as long as needed for those purposes
2.5 Payments
We do not process in-app purchases in the current version of the Service. If that changes, we will update this Policy and the store data-safety disclosures.
2.6 Data we do not sell
We do not sell your personal data.
3. Why we process data (purposes and legal bases)
Depending on your location (including the EEA/UK), we rely on one or more of the following bases under the GDPR / UK GDPR:
| Purpose | Examples | Typical legal basis |
|---|---|---|
| Provide the Service | Account, profile, rides, feed, explore, social graph | Performance of a contract |
| Safety and security | Abuse prevention, fraud detection, incident response | Legitimate interests / legal obligation |
| Improve reliability | Crash diagnostics, performance monitoring | Legitimate interests (and consent where required) |
| Communicate about the Service | Transactional emails (verification, password reset) | Contract / legitimate interests |
| Legal compliance | Responding to lawful requests | Legal obligation |
You may object to processing based on legitimate interests where applicable (see §8).
4. Who we share data with
4.1 Other users
Content and profile information are visible to other users according to the visibility and privacy settings you choose (for example public profile, followers only, trusted group, or private). Live Explore sharing may show limited presence information to permitted viewers; strangers may see only anonymised presence where the product is configured that way.
4.2 Service providers (processors)
We use vendors that process data on our instructions, including:
| Provider / category | Role |
|---|---|
| Firebase Authentication (Google) | Sign-in and identity |
| Firebase Crashlytics (Google) | Crash reporting |
| Cloud hosting & database | Application servers and databases hosted with cloud infrastructure providers in the European Union (EEA) |
| Object storage | Photos and other media files stored with cloud object-storage providers (primary storage in the EEA) |
| Map / location SDKs | Third-party map and location libraries used to display maps in the app |
| Email delivery | Transactional email for verification / password reset |
Each provider has its own privacy terms. We require appropriate contractual safeguards (including data-processing agreements where required).
4.3 Where we store data
Core Service data (profiles, rides, social content, and media) is stored on cloud servers in the European Union (EEA). Authentication and crash-reporting services (Firebase) may also process data in other regions operated by Google — see §5.
4.4 Legal disclosure
We may disclose data if required by law, court order, or to protect the rights, safety, and security of Velaro, our users, or the public.
5. International transfers
Primary application and media data are processed and stored in the EEA. Some providers (notably Google Firebase) may process data in other countries, including outside the EEA.
Where we transfer personal data outside the EEA/UK, we use appropriate safeguards such as Standard Contractual Clauses and provider compliance mechanisms, unless an adequacy decision applies.
6. Retention — active accounts
While your account is active, we keep:
| Data | Retention |
|---|---|
| Profile, settings, garage | Until you change/delete them or delete the account |
| Rides and GPS route data | Until you delete the ride or delete the account |
| Posts, comments, media | Until you delete them or delete the account |
| Follows / group memberships | Until you change them or delete the account |
| Live Explore sessions | Only while sharing; stale sessions are dropped automatically |
| Security / diagnostic logs | For a limited operational period, then deleted or anonymised |
7. Account deletion — what we delete and when
You can delete your account in the app under Settings → Delete account (confirmation required; re-authentication may be required by your sign-in method).
7.1 Immediately (within the deletion request processing)
After you confirm deletion:
- Your Firebase Authentication user is deleted so the same authentication UID cannot sign back in
- Your profile identity fields are anonymised (email and handle freed so you can register again later with the same email if you wish)
- Your content becomes invisible to other users: profile, rides, feed posts, comments, respects (likes), follow relationships (both directions), and group memberships
- Groups you own are deactivated/hidden; events you created are cancelled/hidden
- Media you own (avatar, bike photos, ride/post images) is queued for removal from object storage
7.2 Within 30 days — permanent deletion
Residual records that remain in our systems only in non-public / soft-deleted form (for security, recovery, and operational integrity) are permanently deleted within 30 days after your account deletion timestamp, including remaining database rows associated with the deleted account (for example soft-deleted rides, posts, comments, settings, and the anonymised user tombstone), except where we must retain specific data longer to comply with law, establish or defend legal claims, or investigate abuse/security incidents.
7.3 What may remain
- Content created by other users that does not constitute your personal account data (for example another rider’s post) remains; your comments on others’ posts are hidden and then purged under §7.2
- Aggregated or anonymised statistics that no longer identify you
- Backup copies for a limited additional period until rotated, then destroyed
7.4 Data on your device
Deletion signs you out of the app. Local caches on your device may remain until you clear app storage or uninstall. Registering again with the same email creates a new account.
8. Your rights
If the GDPR / UK GDPR (or similar laws) apply to you, you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase data (“right to be forgotten”) — primarily via in-app account deletion
- Restrict or object to certain processing
- Data portability
- Withdraw consent where processing is consent-based
- Lodge a complaint with your supervisory authority (in Poland: UODO; elsewhere, your local DPA)
To exercise rights, contact [email protected]. We may need to verify your identity. A full structured data-export (takeout) feature may not yet be available; contact us and we will assist reasonably.
9. Children
The Service is not directed at children under 16. We do not knowingly collect personal data from children under that age. If you believe a child has provided data, contact us and we will delete it.
10. Security
We use technical and organisational measures appropriate to the risk, including encrypted transport (HTTPS), access controls, and soft-deletion with delayed hard purge. No method of transmission or storage is 100% secure.
11. Changes to this Policy
We may update this Policy from time to time. We will revise the “Last updated” date and, where required, notify you in the app or by email. Continued use after the effective date constitutes acceptance where permitted by law.
12. Contact
Istvor
Poland
Privacy: [email protected]
Support: [email protected]
Website: https://istvor.com