PRIVACY POLICY

WHO WE ARE

Rmaps (“Rmaps”, “we”, “us”) is a motorcycle and rider companion app that lets you record rides, navigate, share your live location with friends and crew, and request help in an emergency. This Privacy Policy explains what we collect, why, who we share it with, and the choices you have.

Rmaps is operated by Wildcat Devs. For questions or requests, contact us at team.wildcatdevs@gmail.com.

DATA WE COLLECT

We only collect what the app's features need. We do not sell your data, do not use it for advertising, and do not share it with data brokers or use it for cross‑app tracking.

• Account & contact — Email, name, username, phone number, optional gender and avatar. Used to create and secure your account, show you to friends and crew, let friends and family who already have your number find you on rMaps, and let SOS alerts and live tracking reach the right people. Your number is not shown on your profile.
• Precise location — GPS coordinates, speed, heading, and altitude — in the foreground and background. Used for ride recording, trip metrics, live group‑ride and friend location sharing, and emergency SOS.
• Emergency contacts — Names and phone numbers you add, including ones imported from your device address book. Used to notify or contact people you choose in an emergency.
• Beta invitations & WhatsApp number — If you applied for the rMaps beta, we keep your email address and your survey answers, and a record of which beta emails we sent you and when. If you tap "Yes, add me" in one of those emails, we store the WhatsApp number you enter, with its country code and the date, only to add you to the rMaps riders' community. If you tap "No thanks", we record that and stop sending you beta emails; you can undo it from the same email.
• Photos — Images you attach — avatar, group gallery, vehicle photos, receipts, SOS evidence — used only for the feature you used them for.
• Messages & content you create — Group‑ride and live‑ops messages, SOS chat, direct messages, and ride notes. Used to deliver messaging and SOS features.
• Vehicle, ride & expense data — Vehicles, recorded ride sessions and routes, fuel and service logs and their costs. Used for Garage, ride history, metrics, and cost tracking.
• Diagnostics — Crash and error logs, performance and hang metrics, a short breadcrumb trail, device model, OS version, app version, and approximate country. Used to keep the app stable and debug problems.
• Documents you save (Doc Vault) — photos and details of documents you choose to store — registration, licence, IDP, insurance, PUC — including any document number you type. They stay on your device unless you switch on cloud backup, which is off by default; if you do, the document number and any notes are stored encrypted on our servers.
• Motion activity — only if you turn on Auto‑detect rides: the type of movement your phone's own motion detector reports (for example "in a vehicle" or "on a bicycle"), with its confidence and time. Used to start recording when you begin riding. It is processed on your device and never uploaded.
• Road‑condition observations — after a ride ends, short measurements of the road surface: where you slowed sharply, motion‑sensor impulses while your phone is mounted, and a roughness reading per ~50 m — each with its coordinates, direction, speed, time and vehicle type. Used to warn other riders about speed humps and rough road. On by default; you can turn it off.
• Network address — your IP address on requests to our servers, and the approximate country, region and city we derive from it. Used for rate limiting, abuse prevention and security, and to understand roughly where the app is used. We store the IP itself alongside diagnostic logs and password‑reset requests; on your account we keep only the derived approximate place.
• Identifiers — Account ID, a per‑device ID, and push‑notification token. Used to operate the service and send notifications.
• Social profile — your city, riding interests, profession, and links to your social media profiles, if you choose to add them. Used to help other riders find and recognise you. You choose who sees each — only you, friends, or everyone. City and social links start as visible only to you; riding interests and profession start as visible to everyone, and you can change that at any time.
• Blood group — only if you choose to add it. This is health data, stated by you — it is not a medical record, and medics still test before a transfusion. It is shared only with your emergency contacts, and with a confirmed responder while a medical SOS is active. It is never shown on a public SOS share link, and is not shown anywhere else in the app.

We do not record audio, and we do not access photos beyond the images you pick through the system photo picker or capture with the camera.

On road‑condition observations: we upload the derived measurements above, not your recorded track — and only once, after a ride has finished, never live. A hazard that ends up on the map is built from several different riders' observations and is published with no author, so a speed hump on the map is not attributable to you or to anyone else. Rides you record as “Other Transport” (flight, bus, train) contribute nothing.

Data we derive: some of what we hold is inferred rather than collected — a riding profile (typical distances, pace, surface and terrain preferences, and a home region) computed from your recorded rides and used to suggest group rides that suit you; whether you currently appear to be away from your usual country; and whether the country from your GPS and the country from your IP address disagree, which we treat as a rough signal that a VPN is in use. Deleting your account deletes all of it.

HOW WE USE YOUR DATA

• Provide and operate the app's features — recording, navigation, live sharing, SOS, and chat.
• Authenticate you and keep your account secure.
• Send notifications you've enabled — ride invites, friend and crew activity, SOS, and alerts.
• Understand how the app is used in aggregate — how many riders are active, which features get used — so we know what to build and fix.
• Suggest group rides that match how you ride, using the riding profile described above.
• Diagnose crashes and improve reliability and performance.
• Comply with the law and protect users' safety and our rights.

What we never do: We do not sell your data. We do not use your data to serve you third‑party ads. We do not build ad profiles. Ever.

LOCATION, INCLUDING BACKGROUND

Some features collect location even when the app is closed or not in use:

• Ride recording / metrics — while you're recording a trip.
• Live group‑ride and friend sharing — while you choose to share.
• Emergency SOS — while an SOS you started or accepted is active.
• Auto‑detect rides — off unless you turn it on in Settings → Recording. When your phone reports that you've started moving in a vehicle or on a bicycle, the app starts recording your ride, even when it is closed, and stops after you've been still for about 10 minutes. A notification shows while it records, with a Not riding button that stops and deletes the recording.

Auto‑detected rides stay on your device until you decide. Each one waits for you to Keep or Delete it. Until you keep it, it is not backed up, not used for your records, stats or leaderboards, and contributes no road‑condition observations. Deleting it removes it and nothing is uploaded. If you don't answer within 24 hours, it is kept and treated like any ride you recorded yourself. The motion readings themselves never leave your device. A diagnostic log of detections (times, movement type, app state) also stays on your device unless you choose Settings → Share ride detection log.

You control this via Settings → Location sharing (Off / On rides / While tracking). Sharing stops when you turn it off, end the ride, or resolve the SOS. You can revoke location access at any time in your device Settings — the app keeps working without background features. We request background location only after showing an in‑app disclosure and the system permission prompt.

HOW WE SHARE DATA

• With other users you choose — your live location, messages, name, and avatar are shared with the friends, crew, or SOS responders you select. In an SOS, your precise location is shared with a responder only after you confirm them; others see only an approximate (~1 km) area.
• Service providers — cloud hosting, push‑notification delivery, app delivery and crash tooling (Expo), and Google Maps Platform for maps, directions, and place search. These providers process data on our behalf under contract.
• Links you create — a ride share link (/r/…), a group invite (/g/…) and an SOS share link (/sos/…) open a public web page that needs no account — anyone holding the link can open it. A live SOS link shows your name and your precise location for as long as that SOS is active, and stops showing the location once it is resolved or cancelled. Send these links only to people you mean to give access to.
• Legal / safety — when required by law, or to protect the safety, rights, or property of users or the public.
• Business transfers — as part of a merger, acquisition, or asset sale (with notice).

We do not sell personal data or share it for advertising or cross‑app tracking.

THIRD‑PARTY SERVICES

• Google Maps Platform — maps, directions, and place search. Subject to Google's Privacy Policy and the Google Maps APIs terms.
• Expo / EAS — app builds, over‑the‑air updates, and push notifications.
• Hosting & observability — backend infrastructure and diagnostics.

DATA RETENTION

We keep account data while your account is active.

• Live and operational data is short‑lived — live positions and emergency records are pruned on a rolling basis. When you switch location sharing off you stop being visible to friends immediately; your last recorded fix stays on your account until it is overwritten or the account is deleted.
• Road‑condition observations — individual observations are deleted after 90 days. Only the anonymous, multi‑rider result — a hump or a rough stretch — is kept, and that is retired once riders stop encountering it.
• Diagnostic logs — crashes, errors, breadcrumbs, and the IP address the report came from are kept while they are useful for debugging and deleted when they are not. We are moving this onto a fixed schedule; today they are removed by periodic purge rather than automatically.
• Deleting your account — reversible for 7 days if you sign back in. After that your personal data is erased, and the remaining record is deleted within 30 days.

We delete or anonymise data when it is no longer needed, except where we must keep it to meet legal obligations.

SECURITY

We use industry‑standard measures — encrypted transport (HTTPS), hashed credentials, JWT authentication, and access controls. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

YOUR CHOICES AND RIGHTS

Depending on where you live, you may have rights to access, correct, delete, export, or restrict processing of your data, and to object or withdraw consent. You can:

• Edit your profile and manage sharing and notification settings in the app.
• Contribute road conditions — turn this off in Settings to stop sending road‑condition observations. It is on by default; turning it off also clears the road hazards cached on your device. Hazard warnings themselves are unaffected.
• Cloud backup for Vault — off by default. Documents you save stay on your device unless you switch it on.
• Auto‑detect rides — off by default. Turn it on or off in Settings → Recording.
• Revoke camera, location, motion (Motion & Fitness / Physical activity), contacts, and notification permissions in device Settings.
• Export your data — request a copy of what we hold from the data request page. We respond within 30 days.
• Delete your account (which deletes associated personal data) from Settings → Account → Delete account, from this page, or by emailing team.wildcatdevs@gmail.com.

To exercise any other right, contact team.wildcatdevs@gmail.com. We will respond as required by applicable law.

CHILDREN

Rmaps is not intended for children under 13 or the minimum age in your region. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

INTERNATIONAL TRANSFERS

Your data may be processed in countries other than yours. Where required, we use appropriate safeguards — such as Standard Contractual Clauses — for international transfers.

CHANGES TO THIS POLICY

We may update this policy. We'll revise the “Last updated” date and, for material changes, provide notice in the app or by other reasonable means.

CONTACT

For any privacy‑related questions or requests, contact us at: