Privacy policy

Last updated 8 October 2026

MotoRides helps motorcyclists find group rides, places and roads, and ride together. This policy says what we collect, why, who else handles it, how long we keep it, and your rights.

Who we are

MotoRides is run by Matej Pribanić, Croatia ("we", "us"), the data controller. Contact: matej.pribanic1@gmail.com, or "Send feedback" in Settings.

What we collect, and why

• Your account. When you sign in with Apple or Google we receive an account identifier and, if you allow it, your name and email address (Apple may give a private relay address). Google may also share your profile picture link. Used to sign you in and keep your account (contract).
• Your profile. Rider name, photo, riding level, interests, country (filled in from your phone's region; you can change it), and optionally gender and Instagram handle. You choose who sees your gender and Instagram. Also figures the app keeps for you: rides completed, distance, places and routes added, XP and level, and the totals of "would ride again" votes others gave you (contract).
• Your bikes. Type, name, colour and photos (contract).
• Group rides. The rides you host or join, with their exact meet point, time, title and notes. Everyone signed in can see an upcoming ride, its meet point and who is on it, so riders can decide whether to join. Once a ride is over, only the riders who were on it can see it. Please never use your home as a meet point (contract).
• Places and routes. Places you add (exact location, details, photo) and routes you plan (exact stops and the drawn road). Public ones are visible to everyone; private ones only to you (contract).
• Messages. Group chats (seen by everyone on that ride) and private messages (seen only by you and the other rider), with any photos, polls, routes, group rides or locations you send. A location you send is as exact as your phone allows (exact if you've allowed Precise Location). Messages are encrypted on the way and where they're stored, but not end to end. We don't read them, except a message someone reports to us (see Safety and moderation) and messages you send us through "Send feedback" (contract).
• Your social connections. Ride buddies and requests, riders you block, votes you give, what you've read and muted (contract).
• Your rough area when you look for riders near you. While the app is open, it asks our server who's around, sending your position rounded on your phone to a grid of about 5 km (never your exact position). To stop anyone working out where someone is by searching from many places, we keep a log of the areas you looked from for 24 hours, and each rider can only look from a few areas a day (contract; legitimate interest in keeping riders safe for the log).
• Your rough area, kept, only if you turn it on. If you turn on "Show me in Riders near you", nearby ride alerts or "heating up" alerts, we keep that rough area while the feature is on, and record when you turned it on. Other riders see at most a rough distance in 5 km steps and how long ago you were around (or no distance, if you hide it), never a position. These features are off until you turn them on and can be turned off in Settings at any time (consent).
• Notifications about things that happen to you, shown in your activity in the app, and reminders two hours before your rides, which your phone schedules itself (contract).
• Crash reports. If the app crashes or freezes, iPhone gives the app a technical report the next day: the device model, iOS and app version and where in the code it happened, with no messages, photos or location. It's the technical report iPhone produces (MetricKit), which can also include memory and timing figures; we receive it with your account identifier to fix the problem. Only if you say yes (consent): we ask when you set up, and you can change it in Settings → Your data → Share crash reports. Turning it off also deletes the reports already sent.
• Usage stats, only if you say yes. Anonymous counts of which features get used (for example "a ride was joined", "a place was added") and when the app is opened, sent to PostHog in the EU. They carry a random ID for this phone, never your account, name, location, messages or anything you type, and that ID is replaced when you turn the switch off or sign out. Off until you agree; change it in Settings → Your data (consent).
• Server logs. Our providers keep technical logs, including IP addresses, for security and to keep the service running (legitimate interest).

We don't use advertising, we don't track you across other apps or websites, and we don't sell your data.

Safety and moderation

To keep riders safe, and because EU law (the Digital Services Act) requires us to handle reports, we process:

• Reports. When someone reports a rider, a message, a group ride, a place, a photo or a route, we keep the report and a copy of what was reported, made by our server at that moment. For a reported message, the copy includes up to 5 messages before and 5 after it, only from the same chat, only ones the person reporting could already see. A rider report keeps only that rider's public profile card.
• Who reviews it. Only the founder, as a person. Opening the messages around a report or any photo in it is a deliberate step, and each opening is logged. We never read chats on our own initiative.
• Decisions. Warnings, removed messages, suspensions and bans, each with its reason, which we send to the rider concerned. We tell the people who reported something the outcome. We never tell anyone who reported them.
• Bans. A suspended or banned rider can still see why and delete their account. If they delete it while banned, we keep a scrambled code (a keyed hash) of their Apple or Google sign-in until the ban would have ended, at most 365 days, only so it can't be used to sign up again. Nothing else is kept for this.
• Serious crimes. If something suggests a crime threatening someone's life or safety, such as child sexual abuse material or credible threats, we must report it to the police, and we keep the evidence they need.

Legal basis: our legal obligation under the Digital Services Act for illegal content, and our legitimate interest in keeping riders safe for breaches of our Terms. Decisions about accounts are always made by a person. Automatic rules are limited to: refusing posts that contain words on our list of slurs and sexual terms, hiding a message that three different riders reported until a person reviews it, rate limits, new accounts waiting a day before messaging strangers, and a shared route coming off the public list after 50 "wouldn't ride it" votes.

Who else handles your data

• Supabase (database, file storage and sign-in), hosted in the EU (Frankfurt, Germany), our processor under a data processing agreement. Supabase is a US company; transfers are covered by the EU Standard Contractual Clauses.
• Cloudflare hosts the founder's moderation dashboard, our processor under its data processing agreement. Cloudflare is a US company; transfers are covered by the EU-US Data Privacy Framework and the Standard Contractual Clauses.
• PostHog (anonymous usage stats, only if you agreed), hosted in the EU (Frankfurt), our processor under its data processing agreement.
• Apple and Google, when you sign in with them, act under their own privacy policies.
• Apple Maps shows maps, Look Around images and addresses in the app; map views and searches are sent to Apple under its privacy policy. If you open directions in another app (Apple Maps, Google Maps, Waze), that app receives the destination.
• Authorities, only when the law requires it.

How long we keep it

• Your account, profile, bikes, places, routes and connections: while your account exists, unless you delete them sooner.
• Group rides, with their group chats and polls: deleted 12 months after the ride (a cancelled ride: 30 days after its date).
• Sign-ins that never finished setting up a profile: 7 days.
• The log of areas you looked for riders from: 24 hours.
• Private conversations: deleted 12 months after the last message in them.
• Notifications: 60 days once read, 180 days at most.
• Photos you replaced or removed: deleted within a day or two.
• Your rough area: 30 days without an update, and at once when you turn the feature off.
• Reports and moderation decisions: 365 days, or longer only if the police ask us to keep them. The messages around a report from people who didn't report anything: 30 days after a report is dismissed, 365 days when action was taken.
• Crash reports: 365 days.
• Anonymous usage stats: kept by PostHog for up to 7 years by default; they can't be linked to you.
• Backups taken by our provider can hold deleted data for a short time until they expire.

When you delete your account (Settings → Delete account) we delete your profile, all your photos, bikes, buddies, ratings you gave, notifications, crash reports and private data, your private places and routes, and your private conversations (for both of you). If you signed in with Apple we also revoke MotoRides' access to your Apple ID, and with Google we disconnect it. What stays: the words of messages you sent in group chats remain for the other riders, shown as "Deleted rider" (photos and locations you sent there are deleted); group rides you hosted pass to another rider on them (or are cancelled); public places and routes stay without your name; reports and moderation records stay for their 365 days; and if you were banned, the scrambled sign-in code described above.

What you have to give us

To use MotoRides you need to sign in and choose a rider name and level: without them we can't run your account or show you to other riders. Everything else (photo, bikes, gender, Instagram, location, notifications, crash reports) is optional; leaving it out only means the features that use it won't.

Your rights

You can see and edit your profile in the app, download a copy of everything we hold about you (Settings → Your data → Download my data: a zip with your data and photos, in a format other services can read), and delete your account in Settings. Under the GDPR you also have the right to a copy of your data, to correct it, to have it deleted, to restrict or object to processing (including our legitimate interests), to withdraw consent at any time (Settings), and to take your data elsewhere. Email us to use these rights; we'll answer within one month. You can complain to the Croatian data protection authority (AZOP, azop.hr) or the authority where you live.

Age

MotoRides is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you believe a minor is using the app, tell us and we'll remove the account.

Changes

If we change this policy in a way that matters, we'll tell you in the app before it takes effect.