Privacy Policy

In short

RiderLife is a community for motorcyclists: the site rider-life.com and the Android and iPhone apps. This page explains what data we collect, why, how long we keep it, who receives it, and what rights you have.

• we don't sell data and we don't have ads, traffic analytics tools or tracking services;
• your real-time position is never written to the database; the only exception is the place of an alert you put on the map yourself (a pothole, fog, police…), which is saved with your name until it expires;
• the features that use location, camera, microphone or emergency contacts only start when you turn them on.

Who is responsible for your data

The data controller is Ungureanu Radu Constantin, a private individual from Romania, who runs RiderLife with no commercial purpose.

• for anything to do with your data, write to [email protected];
• we reply within 30 days at most; in a complicated case we may extend this by another two months, but we'll tell you why.

We don't have a data protection officer (DPO), because the law doesn't require one; the controller answers questions directly.

What data we collect

Account: email, password (kept only as a cryptographic hash, never in plain text), display name and username, country, county and city (optional), riding style and level, profile photo, bio, phone number (optional), chosen language, the moment you confirmed you're over 16, and, if you came through an invitation link, who invited you.

What you publish: posts, comments, reactions, poll votes, photos, clips and shorts, Marketplace listings (with price history), workshop reviews, theft reports, the clubs you create.

Your garage: make, model, year, mileage, photo, service history and reminders. The licence plate and chassis number don't appear on your public profile — only you and the administrators see them; we use them to check a motorcycle against the stolen-bike registry.

Kilometres: for each ride we keep the total distance, duration, top speed, start and end time, and the motorcycle you chose. The route you rode is not kept — your phone adds up the distance and sends us only the total.

Relationships: who you follow and who follows you, the clubs you belong to, who you've blocked, saved posts, favourite listings and saved searches.

Chat: the messages, reactions and photos you've sent, the conversations and groups you're part of.

Safety: emergency contacts (if you turn on crash detection), crash alerts, the "See where I am" links you create, reports you've sent and reports about your content.

Technical data: your phone's or browser's notification token, technical errors that occur on the page (the error message, the page, the browser type and, if you're signed in, your account number), your map visibility preference, last activity. We only use your IP address in the server's memory, for anti-abuse limits; we don't write it to the database.

Location

We use the phone's GPS in five situations, all of them turned on by you:

1. Kilometres. While a ride is running, your phone calculates the distance from GPS positions; we only need the total. In the app, tracking also works with the screen off, through a service with a visible notification; the app doesn't ask for "all the time" location access. A ride with no movement at all for 45 minutes stops on its own.
2. The "Who's on the road now" map. If you turn on sharing (or tick "Also show me on the live map while the ride is on"), your position, speed and direction reach other people in real time. You choose who sees you: all members, or only the people in your conversations.
3. "See where I am". You create a link valid for between 1 and 24 hours; whoever gets it sees you on the map, without an account, for as long as you're sharing. You can stop it at any time.
4. Road alerts. When you report something on the map (a pothole, gravel, fog, a traffic jam, police…), the place you picked, the type of alert, the time and your username are saved, and the alert is public. That's the only position that reaches the database, and only because you choose it yourself, by tapping a button. You can delete your alert at any time; otherwise it disappears on its own when its type expires, between 45 minutes and 30 days.
5. Crash detection — see the next section.

Positions are never written to the database, and we don't keep a history of your movements. They stay only in the server's memory, for as long as you're sharing:

• they disappear immediately when you stop sharing;
• if your connection drops while you're stationary, you disappear from the map after 90 seconds at most;
• if you lose signal while riding, other people see your last position, marked "no signal", for up to 30 minutes — so that on a group ride, people know where you entered the no-signal area;
• sharing stops on its own after 6 hours.

A position less accurate than 150 metres (derived from the network, not GPS) isn't sent to the map. We only save your visibility preference.

Crash detection

This feature is off until you turn it on in Settings, and only works in the Android app, while a ride is in progress.

• Emergency contacts (name and mobile number, and possibly their RiderLife account) are saved to your account, so you have them on any phone. The numbers belong to other people: no one but you can see them, we don't use them for anything else, and you can delete them at any time. Only add people who know you've listed them there.
• The accelerometer and GPS are read locally by your phone. Nothing is sent to us as long as nothing happens.
• If you fall and don't cancel the alert, your phone sends an SMS to your contacts (through your own plan, like any SMS). The server then receives an alert and, for up to 2 hours, your position, so people close to you can see you via the link in the SMS. As everywhere else on the site, your position is never written to the database: it stays only in the server's memory and disappears when you tap "I'm OK" or after 12 hours. We only save the fact that an alert happened and its time.
• We don't notify 112, nor other riders — only the people you've chosen.

Clips, shorts and live streams

• Clips and shorts are stored on our server, converted for the web, and are public: anyone can see them, even without an account. Clips attached to a post in a closed club are only visible to club members.
• We strip the metadata from clips and photos, including the GPS coordinates the phone adds to the file on its own.
• Live streams can be watched by anyone, without an account, and are not recorded: the server only keeps the last few seconds, just enough for playback to work, and deletes them immediately. Riders in your county get a notification when you go live, at most once every 45 minutes.
• The live chat isn't saved to the database: the server keeps the last 80 messages in memory, until the next stream.
• We only use the camera and microphone while you're streaming or filming.

Chat

Chat messages (public, private or group) are saved, because otherwise you wouldn't have any history. They aren't end-to-end encrypted: platform administrators can technically access the database. Don't send sensitive data through chat (passwords, ID documents, banking details). You can delete your messages at any time, and deleting your account also removes the associated private messages.

Marketplace and the stolen-bike registry

• Listings are public. The phone number in a listing is only visible to signed-in members. If you fill it in, the licence plate of the motorcycle for sale appears on the listing, so the buyer can check it. Before publishing, we automatically check the plate and chassis number against the stolen-bike registry; if they match a motorcycle reported stolen, the listing isn't published, and the owner who reported it is notified.
• Theft reports are public (make, model, area, photos), and the licence plate and chassis number can be checked through search — their purpose is to help find the motorcycle. The police case number is only visible to the author and the administrators, and the contact details in the report are only visible to signed-in members.
• We don't broker transactions and we don't process payments.

Model statistics

If you mark a motorcycle as public, the jobs in its history are added anonymised to that model's statistics (at how many km something was changed, how much it cost). You can turn this off at any time from the motorcycle's settings.

Feed ranking and moderation

• Ranking in feeds and clip lists is calculated automatically: how recent something is, likes and comments, the people you follow, your club and county, plus a random factor. It has no legal effect on you, and we don't profile you outside the platform.
• Moderation: any content and any person can be reported, and administrators review the reports. A post reported by at least three different people is automatically hidden until it's reviewed; new accounts (their first 24 hours) have limits on posts and links; certain words send the text for review. Nothing is deleted automatically, and the author is notified when something of theirs is hidden.
• Blocking someone cuts both ways: you no longer see each other's content and can no longer message each other.

Legal grounds

• Contract (Art. 6(1)(b) GDPR) — everything to do with your account and the features you choose to use: profile, garage, kilometres, chat, posts, clips, marketplace, map and notifications about your activity.
• Consent (point (a)) — push notifications, access to location, camera and microphone (you approve these from your phone or browser and can withdraw them at any time) and crash detection. Withdrawing consent doesn't affect what happened before.
• Legitimate interest (point (f)) — platform safety: anti-abuse limits, moderation, technical errors, backups, checking listings against the stolen-bike registry, defence in a potential dispute; also here, the emergency contact numbers you enter, and, in the event of a fall, the vital interest (point (d)) of the person who fell.
• Legal obligation (point (c)) — when an authority requests data from us under the law.

Who else receives data

We don't sell or rent data to anyone. A few providers use it, strictly for the service they provide us:

Weather forecasts (Open-Meteo), map tiles (OpenStreetMap) and real-road route calculations (OSRM) are requested from our server, without any data about you — not even your IP address reaches them. Emails (confirmation, forgotten password, reminders) are sent from our server.

SMS messages from crash detection don't go through us: they're sent by your phone, through your mobile carrier.

For transfers outside the European Economic Area, providers use the mechanisms provided for by the GDPR: the EU–US adequacy decision (Data Privacy Framework) or standard contractual clauses. Data may only reach authorities if the law requires it.

How long we keep it

After you delete your account, data may still remain in backups for up to 14 days, then disappears along with them.

How we protect it

• all connections are encrypted (HTTPS), and passwords are kept only as a bcrypt hash;
• the database isn't accessible from the internet, and the application runs on the server with limited privileges;
• your session is an httpOnly cookie on the web and a token kept in the app's storage on your phone; it expires after 400 days without use, and changing your password or the "Log out of all devices" button in Settings closes all sessions;
• backups are kept on a second server in the EU;
• if a breach that could affect you still happens, we notify the authority within 72 hours and you directly, as required by law.

Cookies and what we keep on your device

We don't use traffic analytics tools, ad networks or tracking services. If you're just browsing the site, without an account, you don't get any cookie.

After you sign in or use a feature:

• the login cookie (on the web) — remembers that you're signed in; it's marked httpOnly, so not even the page's code can read it. In the app, the same role is played by a token kept in the app's storage;
• local storage — your chosen language, what you wrote with no signal (so it goes out on its own once the network is back), the kilometre ride in progress, and the "Also show me on the live map while the ride is on" preference;
• pages saved for offline use — the last pages and images you viewed, so the site still works without internet.

All of these are necessary for the site to work; none of them are used for profiling or advertising, so we don't ask for your consent for them. You can delete them from your browser settings or by clearing the app's data.

Notifications

You only get notifications if you allow them. On the phone they go through Firebase Cloud Messaging (Google), and on the web through your browser's notification service; they contain only the notification's text and the link to its page. You can turn them off at any time from your phone's or browser's settings. If you don't have notifications turned on, service reminders may come by email; you can turn those off from Settings.

Your rights

You can request access to your data and a copy of it (including in a format that's easy to transfer to another service), its correction, its deletion, the restriction of its processing, and you can object to processing based on legitimate interest. You can withdraw consent you've given at any time, without affecting what was already done.

• A copy of your data is something you download yourself, from Settings → Download my data: a ZIP archive with your account data, in JSON format, and the files you've uploaded.
• Deleting your account is something you do yourself, from Settings → Delete account — the steps and what happens to your data are on the Account deletion page.
• For any other request, write to [email protected]. To avoid giving your data to someone pretending to be you, we may ask you to confirm from the account's email address.

If you're not happy with our answer, you can contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro — or the authority in the country where you live.

Minimum age

You can create an account from age 16 up — the age from which, in Romania, you can give your own consent for data processing. You confirm this when you register. If we find out an account belongs to someone under 16, we delete it.

Changes

When we change something important here, we notify you in the app before the change takes effect. The date of the last update is shown at the top of the page.