Privacy policy

Data controller

The controller is Roc Cutal. For privacy questions and to exercise your rights, write to contacto+trazo@qgen.es.

Age of users

Trazo is intended for people aged 16 or over. This version does not ask for a date of birth or include age verification. If you believe data of a person under that age is being processed, contact the controller so the case can be reviewed.

Data we use

When you sign in with Google, the authentication service receives an account identifier and the profile data authorised by Google, such as name, email and photo. Your Google photo is not automatically imported as your Trazo photo. We store the display name, alias, photo and city you choose; the alias is fixed once chosen. We also process your motorcycles, recordings, times, routes, metrics and the photos you provide.

Social features use follows, reactions, comments, saved route references, invitations and companion participation, clubs, member roles, meet-ups, itineraries and attendance responses. Notices, notification preferences, installation identifiers and push tokens are stored. Photo reports and review requests include the submitting account, the content concerned, the reason and its status. If you contact us, we receive the data in your message.

Location and sensors

With your permission, Trazo uses precise location to record route and speed. The accelerometer and gyroscope are used to estimate lean angle and other experimental metrics. Recording can continue in the background while a session is active, with a visible notification. You can end it from the app and manage permissions in Android settings.

To choose a city you can request approximate location or select a point on the map. The profile stores locality, country and administrative region, not the coordinates of the chosen point or a home address. The chosen city takes priority in Perfil and Cerca de ti; if missing, the end of your most recent public ride is used when it can be resolved. Hiding your city on your profile does not stop it being used as your own reference in Cerca de ti. System permissions do not replace this information about data processing.

On the phone and in the cloud

Detailed samples, drafts and bookmarks of your own rides are kept locally, separated by account. Supabase provides authentication, database and storage for profile, motorcycles, routes, summaries, photos and social data. When there is no connection, pending recording changes can be synced later; photos need a connection to upload. A recording pending review is synced as private; confirming the review applies the chosen audience. Detailed samples are not recovered from the cloud on another phone.

The search tool keeps on this phone, per account, up to ten identifiers of profiles opened from it. It does not store the text you type. You can remove recent items or clear them all from the search tool; deleting your account removes that history from the requesting phone. Opening recent items looks up current profile data, respecting city visibility.

What other users see

Your display name, alias and photo identify your profile. Other authenticated users can search for you, view your active motorcycles and their photos, and see your public rides and results in profiles, feeds and rankings. Your profile city is shown according to the visibility setting. Archived motorcycles are not included in the visible garage.

A private personal ride is seen only by the author and the companions who accept; before accepting a private personal invitation, the recipient receives the data needed to respond, without route or photos. A private club ride is seen by the author and the club's current members; club drafts are reserved to the author. Only the author changes visibility. Following someone or sharing a participation does not make a private ride public or extend access to their followers. Losing club membership removes access to its private rides, even if a historical participation exists.

Clubs, their members and meet-ups are viewed according to their visibility and permissions. Your reactions, comments and participations identify your account to those who can view that content. Saving a route does not grant new access to a private ride. Avoid publishing routes, meeting points or photos that reveal your home or other sensitive places.

Photos

You upload only the images you choose. You can crop them before sending. The server validates the file, generates a processed image and a thumbnail, and removes the original metadata, including EXIF and GPS; this does not hide information visible within the photo. Photos are kept in private storage and viewed through authorised temporary access. Those of a ride follow the audience of its route; those of profiles, motorcycles and clubs follow the permissions of those identities.

During the test phase, valid photos are approved after processing, without automatic review of their content using Google Cloud Vision. If that review service is activated, the processing will be disclosed before it is introduced. Reports and review requests may allow the photo and its reason to be reviewed to resolve an incident. Removing or replacing a photo withdraws its active reference; physical deletion is handled by server jobs. Downloaded copies and temporary access already issued may persist while valid.

Follows and notifications

Notices of follows, reactions, comments and invitations are kept, with their read status. Signing out does not delete that history. Push preferences are stored per account. Firebase Cloud Messaging receives device tokens and information needed for the notice, such as identifiers, the actor's name and the content title, in order to deliver it. You can deny the Android permission or turn off push and notice categories in Perfil → Ajustes → Notificaciones without losing in-app notices. Devices that do not update their registration for thirty days stop being used for delivery and are removed when the service clean-up runs.

External services

The Supabase project uses the free plan and the primary region eu-west-3, Paris (France), to host the project's database, authentication and files. This primary region does not mean that all Supabase services or its providers operate exclusively in France or within the European Economic Area: functions, content delivery, support and operations may involve other locations depending on their configuration.

Google is involved in sign-in, Google Maps and Firebase Cloud Messaging. The place-name service available on Android resolves cities. MET Norway provides weather data: when it is queried, coordinates rounded to four decimals, altitude when available and connection data are sent, without your Trazo account identifier. Map and geocoding queries may also disclose location and connection data to their providers. We do not request general access to your gallery: you choose the specific image you want to use.

Providers may process data outside the European Economic Area. Details of the services actually used, their time limits and transfer safeguards will be verified before general release. You can request additional information at the contact provided.

Purposes and controls

We use data to identify you, keep and sync the features you request, calculate metrics, show content according to its audience, manage clubs, meet-ups and interactions, send the notices you configure, and handle support and reports. We do not use this version to show personalised advertising.

You can choose which optional features you use, edit your name, photo and city, change the audience of your rides, withdraw permissions, turn off push and delete content or your account. Without an account you cannot access social features; without precise location a route cannot be recorded with that precision; without choosing photos no images are uploaded. Withdrawing a permission stops that access but does not by itself delete what has already been stored. The final identification of the legal bases for each processing activity is pending for the general release version.

Retention and deletion

Profile, recordings and social data are kept for as long as you keep your account and they are not deleted through its controls. Local samples and bookmarks remain on that device until deleted; signing out does not delete them. Data of a shared club or meet-up may continue while those features exist and other people take part.

Photo clean-up jobs remove incomplete uploads older than twenty-four hours, unresolved processes or reviews older than seven days, and metadata of removed or rejected photos more than thirty days after their last update. Uploaded originals are scheduled for deletion after processing. Clean-up may be delayed if the service fails; removed files are not republished because of that delay.

The Supabase free plan does not include access to the daily backups and restores of paid plans. No recovery history of seven, fourteen or thirty days is promised, nor a complete copy of files and local samples. Any additional copies held by the controller and the retention periods of providers' operational logs must be specified before general release; stating the free plan does not allow us to claim that no technical copy exists at the provider.

You can request deletion in Perfil → Ajustes → Información de cuenta or contact the controller. The app's process deletes your identity, profile, motorcycles, rides, routes and own photos from Trazo's active systems and, after server confirmation, that account's data on the requesting device. If it fails, you are informed and can try again. A club with other members may pass to another owner; with no members it is archived. Shared meet-ups and data contributed by other people may remain.

Your Google account, original photos in your gallery, exported cards, copies on other devices and copies sent to third parties are not deleted. Changing an audience or deleting content does not guarantee removing copies other people have already obtained. Deletion from active systems does not imply immediate deletion from providers' backups.

Your rights

You can request access, rectification, erasure, portability, restriction or objection in the cases provided for by law. If processing is based on consent, you can withdraw it without affecting the lawfulness of prior processing. Write to contacto+trazo@qgen.es, state what you are requesting and the minimum data needed to identify your account; do not send your password. If necessary, a proportionate identity check will be requested. You can also complain to the competent data protection authority, such as the AEPD in Spain, at www.aepd.es.

Test version information

This document describes the current version and its controls. The controller and contact are already identified; before general release, the legal bases, provider configuration, their time limits and transfer safeguards must be completed and verified. Keeping this information pending does not amount to certifying the legal compliance of the test version.