Privacy Policy

2. Data We Collect

We collect the following categories of personal data:

Account data

Your name, email address, and password (stored as a hashed value - we never store your plain password). Provided when you register. Your email address is used to sign you in, verify your account, reset your password, and - unless you opt out - to send you occasional emails about the Service (see section 3). It is never shown to other users.

Profile data

Any additional information you choose to add to your public profile, such as a profile photo, bio, location (city level), and vehicle details. Profile photos may be taken using your device camera or selected from your photo library.

About you (optional)

During setup you can optionally provide your date of birth and gender. Your date of birth is used only to derive your age for rider search filters - it is never displayed to other users. Gender is used in rider search filters and to enforce events that an organiser has limited to a specific gender. Both fields can be left empty and can be removed later from your profile.

Your position on the rider map

If you grant the app location access, we store your most recent position so nearby riders can discover you on the rider map and in "riders around you" features. What other users see is governed by your privacy settings: if you set a private home zone, anyone viewing the map while you are inside it sees only a displaced approximate point, never your actual position - and you can hide yourself from the map entirely in settings. If you never grant location access, no position is collected.

Private home zone (optional)

To power the masking described above, you define a home area - a centre point and radius. We store that area and use it solely to compute the masked position shown to other users. The zone itself is never visible to anyone but you.

Precise location during rides

When you actively participate in a live ride event, the app collects your precise GPS location in the background and shares it in real time with other confirmed participants of that ride. Location sharing is only active during a ride you have explicitly started and stops immediately when you end the ride or leave the event. You are always in control of when tracking is active.

Event alert preferences (optional)

If you set up event alerts, we store the location, radius, and event types you choose so we can surface matching events to you. This location is one you pick by hand - it is not tracked from your device.

Referral attribution (optional)

If you enter a referral code during setup, we permanently link your account to the referring partner so we can credit them for the referral. The partner never receives your identity - only aggregate referral counts and reward amounts.

Sign-in with Google or Apple

If you create your account through Google or Apple sign-in, we receive your email address and first name from that provider to create the account. We do not receive your contacts, calendar, or any other provider data.

Push notification token

A device identifier issued by Apple (APNs) or Google (FCM) is stored with our push delivery provider (OneSignal) and used solely to deliver push notifications to your device. This identifier is not used for advertising or cross-app tracking.

Purchases and subscription status

If you buy RPMunity premium or another in-app product, the payment itself is processed entirely by Apple or Google - we never see your card or bank details. We receive and store your subscription status and anonymised transaction identifiers (via our subscription management provider, RevenueCat) so we can unlock what you paid for and handle refunds.

Advertising identifier

If you see advertisements in the app, Google and its advertising partners may access your device advertising identifier (IDFA on iOS, Advertising ID on Android) and basic technical data such as approximate location, device type and IP address, in order to select, deliver and measure ads. We never send your account, profile, ride or message data to advertisers. This only happens where you have given consent, and you can withdraw it at any time - see section 8. RPMunity premium removes advertisements entirely.

Activity and karma data

Records of events you created or joined, your attendance history, and your calculated karma score. This data is core to how the platform works.

Direct messages

When you use the in-app chat, we store the message content, the sender and recipient identities, and the timestamp of each message. Messages are visible only to the participants of that conversation. You control who can reach you: only riders you follow or who follow you can initiate a conversation, and you can accept or decline incoming message requests. Blocking a user prevents any further messaging between you.

Support correspondence

Email correspondence if you contact our support team.

Technical data

IP address, browser type, and device information collected automatically when you use the Service. Used for security, debugging, and performance monitoring. Crash and error reports are processed by our error monitoring provider (Sentry).

3. How We Use Your Data

We use your data to:

Create and manage your account
Operate the karma system and calculate your reliability score
Display your profile and activity to other users where relevant
Show your most recent position to nearby riders on the rider map - masked by your private home zone if you set one, and only while you allow location access
Share your precise GPS location in real time with fellow ride participants during an active ride you have started
Filter rider search results by the age and gender you optionally provided
Surface events matching the alert preferences and location you set
Credit the partner whose referral code you entered during setup
Deliver direct messages between users in conversations they are part of
Send transactional notifications (event updates, join requests, karma changes, new messages) via push notification
Send account and security emails: address verification, password reset, and important notices about your account or this policy
Send occasional product and re-engagement emails - for example when you have not finished setting up your profile or have been away for a while. Every such email contains an unsubscribe link, and opting out never affects account or security emails
Unlock premium features and purchases you paid for and handle refunds
Respond to support requests and resolve disputes
Detect and prevent fraud, abuse, and security threats
Improve and develop the Service based on aggregated usage patterns

The free version of the app may display advertisements provided by Google AdMob. Your account, profile, ride history, location traces and messages are never shared with advertisers or used to target ads. Advertising relies only on the device advertising identifier and technical data described in section 2, and only with your consent. We do not sell or rent your personal data to any third party.

4. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases under Article 6 GDPR:

Contract - Processing necessary to provide the Service you signed up for (account management, karma system, event coordination)
Legitimate interests - Security monitoring, fraud prevention, service improvement, and occasional emails about the Service to existing users (always with an unsubscribe link), where these interests are not overridden by your rights
Legal obligation - Where we are required to retain or disclose data by applicable law
Consent - For personalised advertising and any other optional processing we describe to you at the point of collection. Advertising consent is collected through Google's consent form and can be withdrawn at any time

5. Data Sharing

We share your data only in the following limited circumstances:

Other users - Your profile, karma score, and event history are visible to other registered users as part of the platform's core functionality. During an active ride, your precise real-time location is shared with confirmed participants of that ride only.
Infrastructure providers - Hosting, database, email delivery, push notification delivery, subscription management, and error monitoring providers who process data on our behalf under data processing agreements
Map services - Address searches and route requests are relayed through our servers to OpenStreetMap-based services (Nominatim, OSRM) without your identity or IP address attached. Map tiles are loaded by your device directly from a tile CDN, which - like any embedded map on any website - sees your IP address and the map areas you view, but no account information
Advertising partners - Where you consent to advertising, Google AdMob and its certified partners receive your device advertising identifier and technical data in order to serve and measure ads. Google acts as an independent controller for this processing; see Google's privacy and terms
Legal requirements - Where required by law, court order, or to protect the rights and safety of our users or the public

All third-party service providers we use are selected to ensure an adequate level of data protection consistent with GDPR requirements.

6. Data Retention

We retain your data for as long as:

Your account is active
Necessary to operate the karma system and provide event history to other users
Required by applicable law or regulatory obligation

If you delete your account, we will remove or anonymise your personal data within 30 days, except where retention is required for legal compliance or to resolve open disputes. Aggregated and anonymised statistics derived from your usage may be retained indefinitely.

7. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

Access - Request a copy of the personal data we hold about you
Rectification - Request correction of inaccurate or incomplete data
Erasure - Request deletion of your personal data ("right to be forgotten")
Restriction - Request that we limit processing of your data in certain circumstances
Portability - Receive your data in a structured, machine-readable format
Objection - Object to processing based on legitimate interests
Withdrawal of consent - Where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at jan.klecka@rpmunity.eu. We will respond within 30 days. If you believe we are handling your data unlawfully, you have the right to lodge a complaint with the Office for Personal Data Protection (UOOU) in the Czech Republic, or the supervisory authority in your country of residence.

8. Cookies and Tracking

RPMunity uses a minimal set of cookies and local storage mechanisms:

Authentication tokens - Stored in browser local storage to keep you signed in. These are essential to the Service and cannot be disabled while using the app.
Session cookies - Temporary cookies used for security (CSRF protection) and basic session management.

The public website uses no advertising cookies, cross-site tracking pixels, or third-party analytics that identify you individually. It uses Google reCAPTCHA on contact forms to prevent spam - this is subject to Google's Privacy Policy.

In the mobile app, where advertisements are shown, Google AdMob may store identifiers on your device to serve and measure ads and to limit how often you see the same ad. Before any ad is requested we ask for your consent through Google's consent form, and you can change or withdraw that choice at any time from the privacy settings in the app. Withdrawing consent does not remove advertisements, but they will no longer be personalised. RPMunity premium removes advertisements altogether.

9. Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), hashed password storage, and JWT-based authentication. No method of transmission over the internet is completely secure; we cannot guarantee absolute security but we take reasonable steps to protect your data.

10. Children

RPMunity is not directed at anyone under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has registered an account, please contact us and we will promptly delete the account and associated data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify registered users by email before the updated policy takes effect. The effective date at the top of this page will reflect the most recent revision.

12. Contact

For any privacy-related questions or to exercise your rights, contact us at jan.klecka@rpmunity.eu. We aim to respond to all privacy requests within 30 days.

1. Who We Are and Who Controls Your Data